From 276c9382a7fd5f18dfc05f332340f7f9600b51ae Mon Sep 17 00:00:00 2001 From: Aaron McConnell Date: Tue, 25 Aug 2026 10:35:00 -0400 Subject: [PATCH] Set outgoing JWT expiration to 5 minutes to match other SDKs The Java SDK signed its authorization-request and client-assertion JWTs with a 1-hour expiration, while every other Duo Universal Prompt SDK (C#, Go, Node.js, PHP, Python) uses a 5-minute expiration. Python additionally caps the configurable value at 5 minutes and rejects anything longer. This aligns Java with the rest of the SDK family by changing the expiration from 3600000 ms (1 hour) to 300000 ms (5 minutes), reducing the validity window of these short-lived tokens by 12x. Co-Authored-By: Claude Opus 4.8 --- duo-universal-sdk/src/main/java/com/duosecurity/Utils.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/duo-universal-sdk/src/main/java/com/duosecurity/Utils.java b/duo-universal-sdk/src/main/java/com/duosecurity/Utils.java index 7e4d199..985c099 100644 --- a/duo-universal-sdk/src/main/java/com/duosecurity/Utils.java +++ b/duo-universal-sdk/src/main/java/com/duosecurity/Utils.java @@ -26,7 +26,7 @@ public class Utils { - private static final int ONE_HOUR_IN_MILLISECONDS = 3600000; + private static final int FIVE_MINUTES_IN_MILLISECONDS = 300000; private static final String HTTPS = "https"; @@ -34,7 +34,7 @@ public class Utils { static String createJwt(String clientId, String clientSecret, String aud) { Date expiration = new Date(); - expiration.setTime(expiration.getTime() + ONE_HOUR_IN_MILLISECONDS); + expiration.setTime(expiration.getTime() + FIVE_MINUTES_IN_MILLISECONDS); return JWT.create() .withHeader(HEADERS) .withIssuer(clientId) @@ -49,7 +49,7 @@ static String createJwtForAuthUrl(String clientId, String clientSecret, String r String state, String username, Boolean useDuoCodeAttribute) { Date expiration = new Date(); - expiration.setTime(expiration.getTime() + ONE_HOUR_IN_MILLISECONDS); + expiration.setTime(expiration.getTime() + FIVE_MINUTES_IN_MILLISECONDS); return JWT.create() .withHeader(HEADERS) .withExpiresAt(expiration)