diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java index 1632b318..b936de26 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java @@ -564,10 +564,8 @@ public final class OAuth2AuthorizationCodeRequestAuthenticationProvider implemen !OAuth2ParameterNames.CODE.equals(context.getTokenType().getValue())) { return null; } - RegisteredClient registeredClient = context.getRegisteredClient(); - Instant issuedAt = Instant.now(); - Instant expiresAt = issuedAt.plus(registeredClient.getTokenSettings().getAuthorizationCodeTimeToLive()); + Instant expiresAt = issuedAt.plus(context.getRegisteredClient().getTokenSettings().getAuthorizationCodeTimeToLive()); return new OAuth2AuthorizationCode(this.authorizationCodeGenerator.generateKey(), issuedAt, expiresAt); } diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/TokenSettings.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/TokenSettings.java index 45d710da..af86ab8e 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/TokenSettings.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/TokenSettings.java @@ -129,8 +129,8 @@ public final class TokenSettings extends AbstractSettings { } /** - * Set the time-to-live for an access token. Must be greater than {@code Duration.ZERO}. - * A maximum authorization code lifetime of 10 minutes is RECOMMENDED + * Set the time-to-live for an authorization code. Must be greater than {@code Duration.ZERO}. + * A maximum authorization code lifetime of 10 minutes is RECOMMENDED. * * @param authorizationCodeTimeToLive the time-to-live for an authorization code * @return the {@link Builder} for further configuration