search

ma1uta / ma1sd

Federated Matrix Identity Server (formerly fork of kamax/mxisd)
GNU Affero General Public License v3.0
167 stars 56 forks source link

Wrong handling of token expiration #7

Closed mjattiot closed 5 years ago

mjattiot commented 5 years ago

Hello @ma1uta, First thank you for your contribution and your fork ! While testing your recent commits I came across the following error when requesting the /_matrix/identity/v2/hash_details endpoint: [XNIO-1 I/O-2] ERROR io.kamax.mxisd.http.undertow.handler.AuthorizationHandler - Account for '@mjattiot:agoria.dev.opensense.io' from: agoria.dev.opensense.io [XNIO-1 I/O-2] ERROR io.undertow.request - UT005071: Undertow request failed HttpServerExchange{ GET /_matrix/identity/v2/hash_details} io.kamax.mxisd.exception.InvalidCredentialsException: Supplied credentials are invalid

To my understanding, it comes from and error in the following code and line: https://github.com/ma1uta/ma1sd/blob/0b81de3cd04d0da34874e403d4ebd20447874ff4/src/main/java/io/kamax/mxisd/http/undertow/handler/AuthorizationHandler.java#L61

You are comparing the "expires_in" key coming from the /openid/request_token endpoint (which default to 3600 sec) to System.currentTimeMillis() (which is a timestamp). As such account.getExpiresIn() is always lesser than System.currentTimeMillis() at line 61 and always response with invalid credentials.

Could you patch this up ?

Thank you !

ma1uta commented 5 years ago

Thanks for support!

I have fixed this issue at the https://github.com/ma1uta/ma1sd/commit/9e4cabb69bc287dad769d3e90c6c1b717da55667 commit.