Merge pull request #726 from overture-stack/fix/725-check_expired_apiKey

return 401 Unauthorized on expired apiKeys
overture-stack · Aug 11, 2023 · 30c3485 · 30c3485
2 parents 00d898f + b825425
commit 30c3485
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/main/java/bio/overture/ego/service/TokenService.java b/src/main/java/bio/overture/ego/service/TokenService.java
@@ -407,7 +407,7 @@ public ApiKeyScopeResponse checkApiKey(final String apiKey) {
     val aK =
         findByApiKeyString(apiKey).orElseThrow(() -> new InvalidTokenException("ApiKey not found"));
 
-    if (aK.isRevoked())
+    if (aK.isRevoked() || aK.getSecondsUntilExpiry() == 0)
       throw new InvalidTokenException(
           format("ApiKey \"%s\" has expired or is no longer valid. ", apiKey));