From b870e8ec7b8b2b5cb5fdef4e243a73432d2dcdd2 Mon Sep 17 00:00:00 2001 From: Trong Huu Nguyen Date: Thu, 6 Aug 2026 12:57:36 +0200 Subject: [PATCH] fix(openid/client): cap client assertion lifetime to 5 seconds --- pkg/openid/client/client.go | 2 +- pkg/openid/client/client_test.go | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/openid/client/client.go b/pkg/openid/client/client.go index 78dab51..c82eb6d 100644 --- a/pkg/openid/client/client.go +++ b/pkg/openid/client/client.go @@ -35,7 +35,7 @@ var ( ) const ( - DefaultClientAssertionLifetime = 30 * time.Second + DefaultClientAssertionLifetime = 5 * time.Second ) type JwksProvider interface { diff --git a/pkg/openid/client/client_test.go b/pkg/openid/client/client_test.go index 2792489..d9b1ea7 100644 --- a/pkg/openid/client/client_test.go +++ b/pkg/openid/client/client_test.go @@ -24,7 +24,7 @@ func TestClientAuthenticationAssertion(t *testing.T) { openidConfig.TestProvider.SetIssuer("some-issuer") c := newTestClientWithConfig(openidConfig) - expiry := 30 * time.Second + expiry := client.DefaultClientAssertionLifetime jwtAssertion, err := c.ClientAuthenticationAssertion(expiry) assert.NoError(t, err) @@ -102,7 +102,7 @@ func TestClientAuthenticationAssertionHeader(t *testing.T) { openidConfig.TestProvider.SetIssuer("some-issuer") c := newTestClientWithConfig(openidConfig) - expiry := 30 * time.Second + expiry := client.DefaultClientAssertionLifetime jwtAssertion, err := c.ClientAuthenticationAssertion(expiry) assert.NoError(t, err)