UID2-7641: Remove support for V2 refresh tokens - #2718
Merged
samin-ttd merged 6 commits intoSep 3, 2026
Conversation
samin-ttd
force-pushed
the
sra-UID2-7641-fix-refresh-padding-oracle-vulnerability
branch
from
September 2, 2026 05:50
0690322 to
b220bdf
Compare
…[no-jira - reason: automated release] Automated release (PR #2719).
samin-ttd
force-pushed
the
sra-UID2-7641-fix-refresh-padding-oracle-vulnerability
branch
from
September 2, 2026 23:01
c82fcee to
7cfb5b1
Compare
…[no-jira - reason: automated release] Automated release (PR #2721).
samin-ttd
changed the title
mcollins-ttd
reviewed
Sep 3, 2026
mcollins-ttd
previously approved these changes
Sep 3, 2026
mcollins-ttd
approved these changes
Sep 3, 2026
samin-ttd
deleted the
sra-UID2-7641-fix-refresh-padding-oracle-vulnerability
branch
September 3, 2026 23:45
There was a problem hiding this comment.
🟡 Changes recommended
Malformed refresh tokens can still escape as exceptions and return HTTP 500 instead of the intended 400 response.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Removes legacy AES-CBC V2 refresh-token support, leaving authenticated V3 refresh tokens as the supported format.
Changes:
- Rejects V2 refresh-token decoding.
- Removes V2 refresh-token encoding.
File summaries
| File | Description |
|---|---|
src/main/java/com/uid2/operator/service/EncryptedTokenEncoder.java |
Removes V2 refresh-token encode/decode paths. |
Review details
Suppressed comments (1)
src/main/java/com/uid2/operator/service/EncryptedTokenEncoder.java:91
- The newly unsupported V2 decode path has no automated regression coverage.
TokenEncodingTest.testRefreshTokenEncodingonly covers V3/V4, while the endpoint's invalid-token cases use generic strings that do not represent a V2 token. Add a fixed V2-formatted token (including the padding-oracle-style malformed variants from the manual test) and assert decoding throwsClientInputValidationExceptionand the refresh endpoint returns 400.
if (b.getByte(1) == TokenVersion.V3.rawVersion) {
return decodeRefreshTokenV3(b, bytes);
}
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
V2 refresh tokens are AES-CBC encrypted, which is what makes this class of padding oracle possible in the first place. All refresh tokens issued today are V3 (AES-GCM, an authenticated mode with no padding-oracle equivalent), so V2 refresh token decoding is dead weight kept only for backward compatibility. Removing it eliminates the vulnerable code path entirely rather than just papering over its error handling.
Change
Exceptionhandler around refresh token decoding.decodeRefreshTokenV2and the V2 branch indecodeRefreshToken— any V2-formatted refresh token now fails the same generic version check as other malformed input.encodeV2(RefreshToken, ...)and itscase V2inencode(RefreshToken, ...)(refresh tokens have only ever been issued as V3 sinceUIDOperatorService.refreshTokenVersionis hardcoded toTokenVersion.V3).Testing
mvn test): 761 tests, 0 failures, 0 errors.decodeRefreshTokenV2/encodeV2(RefreshToken...)anywhere in the codebase.