Data Sharing Framework is Missing Session Timeout for OIDC Sessions
OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired.
Advisories for Maven/Dev.dsf/Dsf-Common-Jetty package
2026
Data Sharing Framework is Missing Session Timeout for OIDC Sessions
OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired.