Hi @Salesforce Identity, why is the digital certificate's validity ignored in an #OAuth enabled Connected App?
More than two hours after its lifespan should have ended, I am still able to swap a freshly generated and signed JWT for an access token.
The fact that it's not checked is also the reason why there's no notification built in about certificates soon to expire? ;-)
9 comments
Is there any update on this matter? I don't find any recent documentation mention this so I assume the behavior doesn't change yet, is that correct?
