quarkus smallrye.jwt.time-to-live=-1 not working for JWTParser

[sraturi]

Did adding smallrye.jwt.time-to-live=-1 to application properties work for folks? I added this in my application.properties and can initially see maxTimeToLiveSecs being set to -1 in the debugger. However, when jtwparser tries to verify , it copies over the JWTAuthContextInfo which has maxTimeToLiveSec set to null.

I am using quarkus 2.6.1.Final

reference issue #17622

[quarkus-bot[bot]]

/cc @Ladicek, @jmartisk, @phillip-kruger, @radcortez, @sberyozkin

[sraturi]

I have a simple Interceptor and it fails to verify the token

package com.example

import io.smallrye.jwt.auth.principal.JWTParser
import org.jose4j.keys.EcKeyUtil
import javax.inject.Inject
import javax.ws.rs.container.ContainerRequestContext
import javax.ws.rs.container.ContainerRequestFilter
import javax.ws.rs.container.PreMatching
import javax.ws.rs.ext.Provider

@Provider
@PreMatching
class JWTAuthInterceptor : ContainerRequestFilter {

    @Inject
    lateinit var parser: JWTParser

    override fun filter(requestContext: ContainerRequestContext) {
        parser.verify(
            "sampleTokenMissingIAT",
            EcKeyUtil().fromPemEncoded(
                "sample-publicKey"
            )
        )
    }
}

In application.properties, I have smallrye.jwt.time-to-live=-1

When running against a basic request I get

ERROR [io.qua.ver.htt.run.QuarkusErrorHandler] (executor-thread-0) HTTP Request to /hello failed, error id: 3eba099b-b93d-43ab-86cb-ce306833df03-1: org.jboss.resteasy.spi.UnhandledException: io.smallrye.jwt.auth.principal.ParseException: SRJWT07000: Failed to verify a token
	at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:368)
	at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:218)
	at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:169)
	at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:247)
	at io.quarkus.resteasy.runtime.standalone.RequestDispatcher.service(RequestDispatcher.java:73)
	at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.dispatch(VertxRequestHandler.java:151)
	at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler$1.run(VertxRequestHandler.java:91)
	at io.quarkus.vertx.core.runtime.VertxCoreRecorder$13.runWith(VertxCoreRecorder.java:543)
	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2449)
	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1478)
	at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
	at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
	at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: io.smallrye.jwt.auth.principal.ParseException: SRJWT07000: Failed to verify a token
	at io.smallrye.jwt.auth.principal.DefaultJWTTokenParser.parseClaims(DefaultJWTTokenParser.java:166)
	at io.smallrye.jwt.auth.principal.DefaultJWTTokenParser.parse(DefaultJWTTokenParser.java:56)
	at io.smallrye.jwt.auth.principal.DefaultJWTCallerPrincipalFactory.parse(DefaultJWTCallerPrincipalFactory.java:31)
	at io.smallrye.jwt.auth.principal.DefaultJWTParser.verify(DefaultJWTParser.java:77)
	at io.smallrye.jwt.auth.principal.DefaultJWTParser_Subclass.verify$$superforward1(Unknown Source)
	at io.smallrye.jwt.auth.principal.DefaultJWTParser_Subclass$$function$$9.apply(Unknown Source)
	at io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:54)
	at io.quarkus.arc.runtime.devconsole.InvocationInterceptor.proceed(InvocationInterceptor.java:62)
	at io.quarkus.arc.runtime.devconsole.InvocationInterceptor.monitor(InvocationInterceptor.java:49)
	at io.quarkus.arc.runtime.devconsole.InvocationInterceptor_Bean.intercept(Unknown Source)
	at io.quarkus.arc.impl.InterceptorInvocation.invoke(InterceptorInvocation.java:41)
	at io.quarkus.arc.impl.AroundInvokeInvocationContext.perform(AroundInvokeInvocationContext.java:41)
	at io.quarkus.arc.impl.InvocationContexts.performAroundInvoke(InvocationContexts.java:32)
	at io.smallrye.jwt.auth.principal.DefaultJWTParser_Subclass.verify(Unknown Source)
	at io.smallrye.jwt.auth.principal.DefaultJWTParser_ClientProxy.verify(Unknown Source)
	at com.example.JWTAuthInterceptor.filter(JWTAuthInterceptor.kt:20)
	at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:312)
	at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:164)
	... 11 more
Caused by: org.jose4j.jwt.consumer.InvalidJwtException: JWT (claims->{"sub":"xyz","name":"xyz zyz","locale":"zyz","preferred_username":"[email protected]","given_name":"asd","family_name":"asd","zoneinfo":"asd/asd","updated_at":dd99dd,"exp":1641507392,"iss":"https://xyz.com"}) rejected due to invalid claims or other invalid content. Additional details: [[3] No Issued At (iat) claim present.]
	at org.jose4j.jwt.consumer.JwtConsumer.validate(JwtConsumer.java:459)
	at org.jose4j.jwt.consumer.JwtConsumer.processContext(JwtConsumer.java:304)
	at org.jose4j.jwt.consumer.JwtConsumer.process(JwtConsumer.java:426)
	at io.smallrye.jwt.auth.principal.DefaultJWTTokenParser.parseClaims(DefaultJWTTokenParser.java:145)
	... 28 more

[sberyozkin]

Hey @gsmet thanks, and @sraturi yeah, I'm going to look at it asap, to fix the bug I'll have to release smallrye-jwt (with a few other issues to be addressed there) so unfortunately it is unlikely it will make by Wed evening; more likely for 2.6.4.Final or if 2.6.3.Final is the last one then it will be in 2.7.x :-)

[sraturi]

Thank you, that sounds good. Do the releases happen periodically or more ad-hoc? basically trying to figure out the earliest I can do the update 😅

[sberyozkin]

Hope the next version of smallrye-jwt will make it into 2.7.0.Final, but I'm not sure right now what is involved into fixing this particular problem

[sberyozkin]

@sraturi It might be related to smallrye/smallrye-jwt#540.

If you set the key in the properties:

mp.jwt.verify.publickey.location=/ecKey.pem
mp.jwt.verify.publickey.algorithm=ES256

and use JwtParser.parse(token) then it should work

[sberyozkin]

@sraturi Yes, addressing smallrye/smallrye-jwt#540 will support the case where JWTParser has to copy the injected context; but if possible, avoid passing the key directly

[sberyozkin]

Quarkus has been updated with smallrye-jwt 3.3.3 containing the fix: #23108

[sraturi]

will this fix make it to Quarkus 2.7.X?

[sberyozkin]

I proposed a backport, so if Guillaume agrees then it will make it

[sberyozkin]

It was backported a few mins ago :-)

[sraturi]

Thanks! will try it out once it makes the release!