Leaks in HTTP response handling

Description

The RP uses the same logic as https://shibboleth.atlassian.net/browse/JDUO-74 for performing the Token Exchange and UserInfo Endpoint lookup; and therefore is not explicitly releasing connections.

Environment

None

Activity

Philip Smart September 8, 2023 at 9:10 AM

As the leaks should be fixed, I added a seperate issue to address moving to ResponseHandlers (JOIDCRP-46).

Philip Smart August 29, 2023 at 5:17 PM

These should probably be changed to proper Http Client Response Handlers not long after V2 is released.

Philip Smart August 29, 2023 at 5:15 PM

The Response decoder functions already closed (try-with-resources) the input streams, but there was some redundant checks in at least one of them, so I will clean those up.

Philip Smart August 28, 2023 at 10:00 PM
Edited

Done on main for V2. Will look to backport to the 1.X branch.

Philip Smart August 28, 2023 at 8:42 PM

Solved by using a try-with-resources block for now. The response handling logic should possibly be switched to a proper ResponseHandler in future versions.

Fixed

Details

Assignee

Reporter

Components

Fix versions

Affects versions

Created August 28, 2023 at 7:01 PM
Updated September 29, 2023 at 4:00 PM
Resolved September 8, 2023 at 9:11 AM