NGINX must be configured to expire cached authenticators after an organization-defined time period.

If cached authentication information is out of date, the validity of the authentication information may be questionable.

If a keyval store is not used to store tokens, this is not applicable. Determine path to NGINX config file: # nginx -qT | grep "# configuration" # configuration file /etc/nginx/nginx.conf: Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included. Determine if a keyval store is used and no timeout is specified: grep keyval <location of config> Example: keyval_zone zone=oidc_access_tokens:1M state=/var/lib/nginx/state/oidc_access_tokens.json timeout=1h; If a timeout is not specified to an organization defined timeout value, this is a finding.

Determine path to NGINX config file: # nginx -qT | grep "# configuration" # configuration file /etc/nginx/nginx.conf: Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included. Edit the config and set a timeout on any keyval storing credentials: keyval_zone zone=oidc_access_tokens:1M state=/var/lib/nginx/state/oidc_access_tokens.json timeout=1h; Restart NGINX: nginx -s reload