[JUDDI-559] Authentication Tokens do not expire

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.1.4
• Fix Version/s: 3.1.5
• Labels: authentication security
• Assignee: Kurt Stam
• Reporter: Alex O'Ree
• Created: 01/Mar/13 01:14
• Updated: 04/Mar/13 20:16
• Resolved: 04/Mar/13 19:21

Description

This is a potential security vulnerability. Tokens issued by the Security API do not expire. This increases the chances if a token could be obtained through a man in the middle attack or through session hijacking that the stolen token could be used to impersonate the user.

Suggestion, assign expiration timestamps to tokens that is administrator configurable. Default setting should be about 15 minutes.