okta / okta-sdk-java

A Java SDK for interacting with the Okta management API, enabling server-side code to manage Okta users, groups, applications, and more.
Apache License 2.0
147 stars 136 forks source link

Fix DPoPInterceptor thread-safety #1534

Closed clementdenis closed 2 months ago

clementdenis commented 2 months ago

Issue(s)

When ApiClient is used concurrently (either with a single or multiple instances) with DPoP enabled, it will eventually fail with an invalid ath DPoP claim error. This is caused by the static MessageDigest in DPoPInterceptor not being thread safe, and returning invalid token hashes if used from multiple threads.

=> wrap the static field in a ThreadLocal to get an instance per thread.

Description

Category

Signoff