OAuth2AuthorizationCodeAuthenticationProvider should check if the code has expired

[AlekseyMishanin]

Hi guys! Glad to see you all.
When a client exchanges an authorization code for an access token, we forget to check the expiration date of the authorization code. Perhaps
if (authorizationCode.isInvalidated()) { throw new OAuth2AuthenticationException(new OAuth2Error(OAuth2ErrorCodes.INVALID_GRANT)); } you can replace like this if (authorizationCode.isInvalidated() || authorizationCode.isExpired()) { throw new OAuth2AuthenticationException(new OAuth2Error(OAuth2ErrorCodes.INVALID_GRANT)); }.

[jgrandja]

Thank you for reporting this @AlekseyMishanin. This is a bug and should be !authorizationCode.isActive().