[NIFI-6280] Re-evaluate handling of Authorization bearer token during JWT logout

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.9.2
• Fix Version/s: 1.10.0
• Component/s: Core Framework
• Labels: jwt logout security
• Assignee: Nathan Gough
• Reporter: Andy LoPresto
• Created: 09/May/19 00:35
• Updated: 23/May/19 00:42
• Resolved: 23/May/19 00:42

Description

The handling of the JWT for logging out can be improved (add unit tests, handle string slicing more strictly, etc.).

See AccessResource line 769 and JwtService line 178.

Issue Links

• is related to: NIFI-6085 Bearer Token isn't killed after user logs out
• links to: GitHub Pull Request #3482