Data Sharing Framework is Missing Session Timeout for OIDC Sessions
OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired.
Advisories for Maven/Dev.dsf/Dsf-Fhir-Server package
2026
Data Sharing Framework is Missing Session Timeout for OIDC Sessions
OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired.