Expired PK tokens should not fall back to legacy tokens

Fixes #11919

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

diff --git a/lib/private/Authentication/Token/Manager.php b/lib/private/Authentication/Token/Manager.php
index 254a1598943d287e3bce9fcbb269969e55f8684c..3cf48e868b6d045579b610e2f60bb65985aa111a 100644 (file)
--- a/lib/private/Authentication/Token/Manager.php
+++ b/lib/private/Authentication/Token/Manager.php
@@ -138,6 +138,8 @@ class Manager implements IProvider {
        public function getTokenById(int $tokenId): IToken {
                try {
                        return $this->publicKeyTokenProvider->getTokenById($tokenId);
+               } catch (ExpiredTokenException $e) {
+                       throw $e;
                } catch (InvalidTokenException $e) {
                        return $this->defaultTokenProvider->getTokenById($tokenId);
                }