{"record":{"id":"6bd2740d6b337cd8","repo":"apereo/cas","slug":"security-token-linked-to-ticket-has-expired","errorCode":null,"errorMessage":"Security token linked to ticket [{}] has expired","messagePattern":"Security token linked to ticket \\[(.+?)\\] has expired","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-ws-idp/src/main/java/org/apereo/cas/ws/idp/web/BaseWSFederationRequestController.java","lineNumber":89,"sourceCode":"     * @return the security token from request\n     */\n    protected SecurityToken getSecurityTokenFromRequest(final HttpServletRequest request) {\n        val cookieValue = configContext.getTicketGrantingTicketCookieGenerator().retrieveCookieValue(request);\n        if (StringUtils.isNotBlank(cookieValue)) {\n            val tgt = configContext.getTicketRegistry().getTicket(cookieValue, TicketGrantingTicket.class);\n            if (tgt != null) {\n                val sts = tgt.getDescendantTickets().stream()\n                    .filter(t -> t.startsWith(SecurityTokenTicket.PREFIX))\n                    .findFirst()\n                    .orElse(null);\n                if (StringUtils.isNotBlank(sts)) {\n                    val stt = configContext.getTicketRegistry().getTicket(sts, SecurityTokenTicket.class);\n                    if (stt == null || stt.isExpired()) {\n                        LOGGER.warn(\"Security token ticket [{}] is not found or has expired\", sts);\n                        return null;\n                    }\n                    if (stt.getSecurityToken() == null || stt.getSecurityToken().isExpired()) {\n                        LOGGER.warn(\"Security token linked to ticket [{}] has expired\", sts);\n                        return null;\n                    }\n                    return stt.getSecurityToken();\n                }\n            }\n        }\n        return null;\n    }\n\n\n    protected boolean shouldRenewAuthentication(final WSFederationRequest fedRequest,\n                                                final HttpServletRequest request) {\n        if (StringUtils.isBlank(fedRequest.wfresh()) || !NumberUtils.isCreatable(fedRequest.wfresh())) {\n            return false;\n        }\n        val ttl = Long.parseLong(fedRequest.wfresh().trim());\n        if (ttl == 0) {\n            return false;","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-ws-idp/src/main/java/org/apereo/cas/ws/idp/web/BaseWSFederationRequestController.java#L71-L107","documentation":"The security-token ticket was found and valid, but the SecurityToken object it carries is null or itself expired, so the controller cannot return a usable token and logs this warning before returning null.","triggerScenarios":"getSecurityTokenFromRequest(): stt.getSecurityToken() is null, or stt.getSecurityToken().isExpired() is true after successful ticket lookup.","commonSituations":"Token TTL shorter than the ticket TTL, so the ticket outlives its token; STS issued token with very short lifetime; deserialization issue in a clustered registry returning a token object that cannot be reconstructed (null); long-paused browser flow.","solutions":["Increase the STS-issued token lifetime to exceed the security-token ticket TTL","Decrease the ticket TTL to match token lifetime so they expire together","Force the user to restart the federation flow to get a fresh token","Check registry serialization if tokens come back null on clustered deployments"],"exampleFix":"// before: token lifetime shorter than ticket TTL\ncas.authn.wsfed-idp.security-token-tickets.time-to-kill-in-seconds=600\n// after: align TTLs\ncas.authn.wsfed-idp.security-token-tickets.time-to-kill-in-seconds=300","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if (token == null) { /* redirect user to restart the sign-in flow for a fresh token */ }","preventionTips":["Align security-token and ticket TTLs so the ticket never outlives the token","Keep token payload small and serializable in clustered registries","Monitor STS issuance latency to avoid long pauses mid-flow"],"tags":["ws-federation","token-expired","security-token"],"backgroundTag":"jwt-token-expired","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}