Increase request_uri expiry for OAuth2 Pushed Authorization Request

jgrandja · jgrandja · commit 76ae518d5627 · 2025-06-04T06:10:20.000-04:00
Closes gh-2024
diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2PushedAuthorizationRequestUri.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2PushedAuthorizationRequestUri.java
@@ -44,7 +44,7 @@ final class OAuth2PushedAuthorizationRequestUri {
 	private Instant expiresAt;
 
 	static OAuth2PushedAuthorizationRequestUri create() {
-		return create(Instant.now().plusSeconds(30));
+		return create(Instant.now().plusSeconds(300));
 	}
 
 	static OAuth2PushedAuthorizationRequestUri create(Instant expiresAt) {

Original file line number	Diff line number	Diff line change
`@@ -44,7 +44,7 @@ final class OAuth2PushedAuthorizationRequestUri {`
`44`	`44`	`private Instant expiresAt;`
`45`	`45`
`46`	`46`	`static OAuth2PushedAuthorizationRequestUri create() {`
`47`		`- return create(Instant.now().plusSeconds(30));`
	`47`	`+ return create(Instant.now().plusSeconds(300));`
`48`	`48`	`}`
`49`	`49`
`50`	`50`	`static OAuth2PushedAuthorizationRequestUri create(Instant expiresAt) {`