Skip to content

[ES-1943G] Removed method calls for nonce caching#2016

Open
KashiwalHarsh wants to merge 3 commits into
mosip:developfrom
Infosys:ES-1943G
Open

[ES-1943G] Removed method calls for nonce caching#2016
KashiwalHarsh wants to merge 3 commits into
mosip:developfrom
Infosys:ES-1943G

Conversation

@KashiwalHarsh

@KashiwalHarsh KashiwalHarsh commented Jun 18, 2026

Copy link
Copy Markdown
Collaborator

Summary by CodeRabbit

  • Refactor
    • Streamlined authorization request processing by removing redundant validation steps from the authentication workflow, improving system efficiency.

Signed-off-by: Harsh Kashiwal <harsh.kashiwal@infosys.com>
@coderabbitai

coderabbitai Bot commented Jun 18, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

@KashiwalHarsh, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 50 minutes and 7 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 20ca914b-f1a3-4b00-8cfa-06678d06a8dc

📥 Commits

Reviewing files that changed from the base of the PR and between fa5dcfa and 8c2ad8a.

📒 Files selected for processing (1)
  • oidc-service-impl/src/main/java/io/mosip/esignet/services/OAuthServiceImpl.java

Walkthrough

Two single-line deletions remove the authorizationHelperService.validateNonce(...) call from AuthorizationServiceImpl.validateRedirectURIAndNonce and from OAuthServiceImpl.authorize(...). Both methods retain nonce logging and redirect URI validation; only the nonce constraint check is dropped.

Changes

Nonce Validation Removal

Layer / File(s) Summary
Remove nonce validation from both authorization flows
oidc-service-impl/.../AuthorizationServiceImpl.java, oidc-service-impl/.../OAuthServiceImpl.java
Removes the authorizationHelperService.validateNonce(...) call in validateRedirectURIAndNonce and in authorize(...). Both methods still log the nonce and validate the redirect URI; only the explicit nonce enforcement step is deleted.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 Hop, hop, the nonce check goes away,
Two service flows trimmed on this fine day,
The redirect still stands, the log still rings,
But nonce validation? No longer a thing!
Less code to hop over — what a delight,
The rabbit approves this lean commit tonight. ✨

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: removal of nonce validation method calls from two service classes.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Signed-off-by: Harsh Kashiwal <harsh.kashiwal@infosys.com>
Signed-off-by: Harsh Kashiwal <harsh.kashiwal@infosys.com>
private void validateRedirectURIAndNonce(OAuthDetailRequest oAuthDetailRequest, ClientDetail clientDetail) {
log.info("nonce : {} Valid client id found, proceeding to validate redirect URI", oAuthDetailRequest.getNonce());
IdentityProviderUtil.validateRedirectURI(clientDetail.getRedirectUris(), oAuthDetailRequest.getRedirectUri());
authorizationHelperService.validateNonce(oAuthDetailRequest.getNonce());

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. what about removal of validateNonce method itself?
  2. Also why is method not renamed?
  3. No changes in the test cases?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants