diff --git a/hadoop-hdds/docs/content/design/ozone-sts.md b/hadoop-hdds/docs/content/design/ozone-sts.md
index ccca985ae571..f886d6b1fdca 100644
--- a/hadoop-hdds/docs/content/design/ozone-sts.md
+++ b/hadoop-hdds/docs/content/design/ozone-sts.md
@@ -3,7 +3,7 @@ title: AWS STS Design for Ozone S3
 summary: STS Support in Ozone
 date: 2025-10-30
 jira: HDDS-13323
-status: implementing
+status: implemented
 author: Madhan Neethiraj, Ren Koike, Fabian Morgan, Stephen O'Donnell, Istvan Fajth, Uma Maheswara Rao Gangumalla
 ---
 <!--
@@ -247,8 +247,9 @@ originalAccessKeyId in the session token and perform the following checks:
   - Ensure the sessionToken is not expired
   - Ensure the STS credentials are not revoked by looking up the revocation cutoff for the token's originalAccessKeyId
     and comparing it against the token's signed creationTime
+  - Ensure that the Kerberos identity associated with the originalAccessKeyId is not revoked
   - Validate the HMAC-SHA256 signature in the sessionToken
   - Decrypt the secretAccessKey from the sessionToken and validate the AWS signature
-  - Authorize the call with either RangerOzoneAuthorizer or OzoneNativeAuthorizer
+  - Authorize the call with RangerOzoneAuthorizer
 
 Assuming all these checks pass, the S3 API call will be invoked.
diff --git a/hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/om/helpers/S3STSUtils.java b/hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/om/helpers/S3STSUtils.java
index 17bf084f9b31..96627a1b9eaf 100644
--- a/hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/om/helpers/S3STSUtils.java
+++ b/hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/om/helpers/S3STSUtils.java
@@ -47,6 +47,10 @@ public final class S3STSUtils {
 
   public static final String OZONE_STATIC_ACCOUNT_ID = "123456789012";
 
+  public static final String DURATION_VALIDATION_ERROR_MESSAGE =
+      "Invalid Value: DurationSeconds must be a number between " + MIN_DURATION_SECONDS + " and " +
+          MAX_DURATION_SECONDS + " seconds";
+
   private S3STSUtils() {
   }
 
@@ -101,18 +105,32 @@ public static void addAssumeRoleAuditParams(Map<String, String> auditParams, Str
    * @return validated duration
    * @throws OMException if duration is invalid
    */
-  public static int validateDuration(Integer durationSeconds) throws OMException {
+  public static int validateDuration(int durationSeconds) throws OMException {
+    if (durationSeconds < MIN_DURATION_SECONDS || durationSeconds > MAX_DURATION_SECONDS) {
+      throw new OMException(DURATION_VALIDATION_ERROR_MESSAGE, INVALID_REQUEST);
+    }
+
+    return durationSeconds;
+  }
+
+  /**
+   * Validates the duration in seconds from a raw request value.
+   * @param durationSeconds duration in seconds as a string
+   * @return validated duration
+   * @throws OMException if duration is invalid
+   */
+  public static int validateDuration(String durationSeconds) throws OMException {
     if (durationSeconds == null) {
       return DEFAULT_DURATION_SECONDS;
     }
 
-    if (durationSeconds < MIN_DURATION_SECONDS || durationSeconds > MAX_DURATION_SECONDS) {
-      throw new OMException(
-          "Invalid Value: DurationSeconds must be between " + MIN_DURATION_SECONDS + " and " + MAX_DURATION_SECONDS +
-          " seconds", INVALID_REQUEST);
+    final int value;
+    try {
+      value = Integer.parseInt(durationSeconds);
+    } catch (NumberFormatException e) {
+      throw new OMException(DURATION_VALIDATION_ERROR_MESSAGE, INVALID_REQUEST);
     }
-
-    return durationSeconds;
+    return validateDuration(value);
   }
 
   /**
diff --git a/hadoop-ozone/common/src/test/java/org/apache/hadoop/ozone/om/helpers/TestS3STSUtils.java b/hadoop-ozone/common/src/test/java/org/apache/hadoop/ozone/om/helpers/TestS3STSUtils.java
new file mode 100644
index 000000000000..9fb7b0eb3f1d
--- /dev/null
+++ b/hadoop-ozone/common/src/test/java/org/apache/hadoop/ozone/om/helpers/TestS3STSUtils.java
@@ -0,0 +1,98 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hadoop.ozone.om.helpers;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+import org.apache.hadoop.ozone.om.exceptions.OMException;
+import org.junit.jupiter.api.Test;
+
+/**
+ * Unit tests for S3STSUtils.
+ */
+public class TestS3STSUtils {
+
+  private static final String DURATION_VALIDATION_ERROR_MESSAGE =
+      "Invalid Value: DurationSeconds must be a number between 900 and 43200 seconds";
+
+  @Test
+  public void testValidateDurationStringNullUsesDefault() throws OMException {
+    assertEquals(S3STSUtils.DEFAULT_DURATION_SECONDS, S3STSUtils.validateDuration((String) null));
+  }
+
+  @Test
+  public void testValidateDurationStringBlankIsInvalid() {
+    final OMException empty = assertThrows(OMException.class, () -> S3STSUtils.validateDuration(""));
+    assertThat(empty.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+
+    final OMException whitespace = assertThrows(OMException.class, () -> S3STSUtils.validateDuration("   "));
+    assertThat(whitespace.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+  }
+
+  @Test
+  public void testValidateDurationStringValidValues() throws OMException {
+    assertEquals(900, S3STSUtils.validateDuration("900"));
+    assertEquals(3600, S3STSUtils.validateDuration("3600"));
+    assertEquals(43200, S3STSUtils.validateDuration("43200"));
+  }
+
+  @Test
+  public void testValidateDurationStringOutOfRange() {
+    final OMException tooShort = assertThrows(OMException.class, () -> S3STSUtils.validateDuration("899"));
+    assertThat(tooShort.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+
+    final OMException tooLong = assertThrows(OMException.class, () -> S3STSUtils.validateDuration("43201"));
+    assertThat(tooLong.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+  }
+
+  @Test
+  public void testValidateDurationStringOverflowsInt() {
+    final OMException ex = assertThrows(OMException.class, () -> S3STSUtils.validateDuration("4320010000"));
+    assertThat(ex.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+  }
+
+  @Test
+  public void testValidateDurationStringNonNumeric() {
+    final OMException abc = assertThrows(OMException.class, () -> S3STSUtils.validateDuration("abc"));
+    assertThat(abc.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+
+    final OMException decimal = assertThrows(OMException.class, () -> S3STSUtils.validateDuration("3.5"));
+    assertThat(decimal.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+
+    final OMException invalidSign = assertThrows(OMException.class, () -> S3STSUtils.validateDuration("+-3"));
+    assertThat(invalidSign.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+  }
+
+  @Test
+  public void testValidateDurationIntValidValues() throws OMException {
+    assertEquals(900, S3STSUtils.validateDuration(900));
+    assertEquals(3600, S3STSUtils.validateDuration(3600));
+    assertEquals(43200, S3STSUtils.validateDuration(43200));
+  }
+
+  @Test
+  public void testValidateDurationIntOutOfRange() {
+    final OMException tooShort = assertThrows(OMException.class, () -> S3STSUtils.validateDuration(899));
+    assertThat(tooShort.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+
+    final OMException tooLong = assertThrows(OMException.class, () -> S3STSUtils.validateDuration(43201));
+    assertThat(tooLong.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+  }
+}
diff --git a/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.resource b/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.resource
index 4ebf2ec1b3bd..e125e44e3e93 100644
--- a/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.resource
+++ b/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.resource
@@ -220,13 +220,14 @@ Assume Role Should Fail
 
 Assume Role Should Fail Using Curl
     # This keyword is needed to test boundary cases that the aws client prevents you from issuing, such as too short duration for token
-    [Arguments]                   ${perm_access_key_id}  ${perm_secret_key}  ${policy_json}=${EMPTY}  ${expected_error}=AccessDenied  ${expected_http_code}=400  ${role_arn}=${ROLE_ARN_OBS}  ${role_session_name}=${ROLE_SESSION_NAME}  ${duration_seconds}=900  ${extra_curl_params}=${EMPTY}
+    [Arguments]                   ${perm_access_key_id}  ${perm_secret_key}  ${policy_json}=${EMPTY}  ${expected_error}=AccessDenied  ${expected_http_code}=400  ${role_arn}=${ROLE_ARN_OBS}  ${role_session_name}=${ROLE_SESSION_NAME}  ${duration_seconds}=900  ${extra_curl_params}=${EMPTY}  ${expected_message}=${EMPTY}
     ${cmd} =                      Set Variable                  curl --silent --show-error --include --request POST --aws-sigv4 "aws:amz:us-east-1:sts" --user '${perm_access_key_id}:${perm_secret_key}' --header "Content-Type: application/x-www-form-urlencoded" --data-urlencode "Action=AssumeRole" --data-urlencode "Version=2011-06-15" --data-urlencode "RoleArn=${role_arn}" --data-urlencode "RoleSessionName=${role_session_name}" ${STS_ENDPOINT_URL}
     ${cmd} =                      Set Variable If               '${duration_seconds}' != '${EMPTY}'    ${cmd} --data-urlencode "DurationSeconds=${duration_seconds}"    ${cmd}
     ${cmd} =                      Set Variable If               '${policy_json}' != '${EMPTY}'    ${cmd} --data-urlencode "Policy=${policy_json}"    ${cmd}
     ${cmd} =                      Set Variable If               '${extra_curl_params}' != '${EMPTY}'    ${cmd} ${extra_curl_params}    ${cmd}
     ${output} =                   Execute And Ignore Error      ${cmd}
     Should Contain                ${output}                     ${expected_error}
+    Run Keyword If                '${expected_message}' != '${EMPTY}'        Should Contain    ${output}    ${expected_message}
     @{http_codes} =               Get Regexp Matches            ${output}    (?m)^HTTP/[0-9.]+ ([0-9]{3})    1
     ${code_count} =               Get Length                    ${http_codes}
     Should Be True                ${code_count} > 0             Expected to find an HTTP status code in curl output, but none was found.
diff --git a/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.robot b/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.robot
index 2368b1da68ec..407cf60f105d 100644
--- a/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.robot
+++ b/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.robot
@@ -735,6 +735,14 @@ Assume Role Should Fail For Too Short Role Arn
 Assume Role Should Fail For Too Short Role Session Name
     Assume Role Should Fail Using Curl  perm_access_key_id=${PERMANENT_ACCESS_KEY_ID}  perm_secret_key=${PERMANENT_SECRET_KEY}  expected_error=ValidationError  expected_http_code=400  role_arn=${ICEBERG_ALL_ACCESS_ROLE_OBS_ARN}  role_session_name=a
 
+Assume Role Should Fail For Invalid Duration
+    # AWS CLI rejects out-of-range DurationSeconds before the request is sent, so use curl.
+    Assume Role Should Fail Using Curl  perm_access_key_id=${PERMANENT_ACCESS_KEY_ID}  perm_secret_key=${PERMANENT_SECRET_KEY}  expected_error=ValidationError  expected_http_code=400  role_arn=${ICEBERG_ALL_ACCESS_ROLE_OBS_ARN}  duration_seconds=43201  expected_message=must be a number between 900 and 43200 seconds
+    # Check duration that overflows integer as well
+    Assume Role Should Fail Using Curl  perm_access_key_id=${PERMANENT_ACCESS_KEY_ID}  perm_secret_key=${PERMANENT_SECRET_KEY}  expected_error=ValidationError  expected_http_code=400  role_arn=${ICEBERG_ALL_ACCESS_ROLE_OBS_ARN}  duration_seconds=43200100000  expected_message=must be a number between 900 and 43200 seconds
+    # Whitespace-only DurationSeconds must be rejected
+    Assume Role Should Fail Using Curl  perm_access_key_id=${PERMANENT_ACCESS_KEY_ID}  perm_secret_key=${PERMANENT_SECRET_KEY}  expected_error=ValidationError  expected_http_code=400  role_arn=${ICEBERG_ALL_ACCESS_ROLE_OBS_ARN}  duration_seconds=${SPACE}${SPACE}${SPACE}${SPACE}${SPACE}  expected_message=must be a number between 900 and 43200 seconds
+
 Assume Role With ExternalId Should Fail As UnsupportedOperation
     Assume Role Should Fail       perm_access_key_id=${PERMANENT_ACCESS_KEY_ID}  perm_secret_key=${PERMANENT_SECRET_KEY}  expected_error=UnsupportedOperation  expected_http_code=501  role_arn=${ICEBERG_ALL_ACCESS_ROLE_OBS_ARN}  extra_cli_args=--external-id test-external-id
 
diff --git a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/s3/security/TestS3AssumeRoleRequest.java b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/s3/security/TestS3AssumeRoleRequest.java
index f779a349d0fa..3d073c7b71e0 100644
--- a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/s3/security/TestS3AssumeRoleRequest.java
+++ b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/s3/security/TestS3AssumeRoleRequest.java
@@ -168,7 +168,7 @@ public void testInvalidDurationTooShort() {
 
     assertThat(exception.getResult()).isEqualTo(OMException.ResultCodes.INVALID_REQUEST);
     assertThat(exception.getMessage()).isEqualTo(
-        "Invalid Value: DurationSeconds must be between 900 and 43200 seconds");
+        "Invalid Value: DurationSeconds must be a number between 900 and 43200 seconds");
     assertMarkForAuditCalled(request);
   }
 
@@ -188,7 +188,7 @@ public void testInvalidDurationTooLong() {
 
     assertThat(exception.getResult()).isEqualTo(OMException.ResultCodes.INVALID_REQUEST);
     assertThat(exception.getMessage()).isEqualTo(
-        "Invalid Value: DurationSeconds must be between 900 and 43200 seconds");
+        "Invalid Value: DurationSeconds must be a number between 900 and 43200 seconds");
     assertMarkForAuditCalled(request);
   }
 
diff --git a/hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3sts/S3STSConfigKeys.java b/hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3sts/S3STSConfigKeys.java
index aca0cbd470bd..3196c1bd078b 100644
--- a/hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3sts/S3STSConfigKeys.java
+++ b/hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3sts/S3STSConfigKeys.java
@@ -41,7 +41,8 @@ public final class S3STSConfigKeys {
   // Action=AssumeRole&RoleArn=...&RoleSessionName=...&DurationSeconds=...
   // where RoleArn max length is 2048 and max bytes per character in UTF-8 encoding is 12
   // (2048 * 12 = 24576) + other parameters and overheads, so setting to 32 KB
-  // this limit can be adjusted via configuration if needed.
+  // 12 is the worst-case percent-encoded wire size for one code point in application/x-www-form-urlencoded data:
+  // a 4-byte UTF-8 sequence can become four %XX triplets
   public static final int OZONE_S3G_STS_PAYLOAD_HASH_MAX_VALUE = 32768;
 
   /**
diff --git a/hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3sts/S3STSEndpoint.java b/hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3sts/S3STSEndpoint.java
index 2c6200d1e661..5d7d8785df8d 100644
--- a/hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3sts/S3STSEndpoint.java
+++ b/hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3sts/S3STSEndpoint.java
@@ -146,7 +146,7 @@ public Response get(
       @QueryParam("Action") String action,
       @QueryParam("RoleArn") String roleArn,
       @QueryParam("RoleSessionName") String roleSessionName,
-      @QueryParam("DurationSeconds") Integer durationSeconds,
+      @QueryParam("DurationSeconds") String durationSeconds,
       @QueryParam("Version") String version,
       @QueryParam("Policy") String awsIamSessionPolicy) throws OS3Exception {
 
@@ -173,7 +173,7 @@ public Response post(Form form) throws OS3Exception {
     final String action = formParams.getFirst("Action");
     final String roleArn = formParams.getFirst("RoleArn");
     final String roleSessionName = formParams.getFirst("RoleSessionName");
-    final Integer durationSeconds = parseIntegerOrNull(formParams.getFirst("DurationSeconds"));
+    final String durationSeconds = formParams.getFirst("DurationSeconds");
     final String version = formParams.getFirst("Version");
     final String awsIamSessionPolicy = formParams.getFirst("Policy");
 
@@ -182,7 +182,7 @@ public Response post(Form form) throws OS3Exception {
   }
 
   private Response handleSTSRequest(Set<String> paramNamesToValidate, String action, String roleArn,
-      String roleSessionName, Integer durationSeconds, String version, String awsIamSessionPolicy) throws OS3Exception {
+      String roleSessionName, String durationSeconds, String version, String awsIamSessionPolicy) throws OS3Exception {
     final String requestId = requestIdentifier.getRequestId();
     // NOTE: invalid, missing or unsupported actions are not added to the audit log
     try {
@@ -219,13 +219,18 @@ private Response handleSTSRequest(Set<String> paramNamesToValidate, String actio
   }
 
   private Response handleAssumeRole(Set<String> paramNamesToValidate, String roleArn, String roleSessionName,
-      Integer durationSeconds, String awsIamSessionPolicy, String version, String requestId) throws OSTSException {
+      String durationSeconds, String awsIamSessionPolicy, String version, String requestId) throws OSTSException {
     final String action = "AssumeRole";
     final Map<String, String> auditParams = getAuditParameters();
+    int duration = S3STSUtils.DEFAULT_DURATION_SECONDS;
+    String durationValidationError = null;
+    try {
+      duration = S3STSUtils.validateDuration(durationSeconds);
+    } catch (OMException e) {
+      durationValidationError = e.getMessage();
+    }
     S3STSUtils.addAssumeRoleAuditParams(
-        auditParams, roleArn, roleSessionName, awsIamSessionPolicy,
-        durationSeconds == null ? S3STSUtils.DEFAULT_DURATION_SECONDS : durationSeconds,
-        requestId);
+        auditParams, roleArn, roleSessionName, awsIamSessionPolicy, duration, requestId);
 
     // Validate parameters
     if (version == null || !version.equals(EXPECTED_VERSION)) {
@@ -247,11 +252,8 @@ private Response handleAssumeRole(Set<String> paramNamesToValidate, String roleA
     }
 
     final Set<String> validationErrors = new HashSet<>();
-    int duration = durationSeconds == null ? S3STSUtils.DEFAULT_DURATION_SECONDS : durationSeconds;
-    try {
-      duration = S3STSUtils.validateDuration(durationSeconds);
-    } catch (OMException e) {
-      validationErrors.add(e.getMessage());
+    if (durationValidationError != null) {
+      validationErrors.add(durationValidationError);
     }
 
     try {
@@ -429,18 +431,6 @@ private static boolean isAwsValidButNotImplementedAssumeRoleParameter(String par
         || Strings.CI.startsWith(paramName, TRANSITIVE_TAG_KEYS_MEMBER_PREFIX);
   }
 
-  private static Integer parseIntegerOrNull(String value) throws OSTSException {
-    if (StringUtils.isBlank(value)) {
-      return null;
-    }
-    try {
-      return Integer.parseInt(value);
-    } catch (NumberFormatException e) {
-      throw new OSTSException(STS_VALIDATION_ERROR)
-          .withMessage("1 validation error detected: Invalid Value: DurationSeconds must be a number");
-    }
-  }
-
   private static final class AssumeRoleParamValidationResult {
     private static final AssumeRoleParamValidationResult EMPTY = new AssumeRoleParamValidationResult(
         Collections.emptyList(), Collections.emptyList());
diff --git a/hadoop-ozone/s3gateway/src/test/java/org/apache/hadoop/ozone/s3sts/TestS3STSEndpoint.java b/hadoop-ozone/s3gateway/src/test/java/org/apache/hadoop/ozone/s3sts/TestS3STSEndpoint.java
index 379bd27eb981..6eea1c06594d 100644
--- a/hadoop-ozone/s3gateway/src/test/java/org/apache/hadoop/ozone/s3sts/TestS3STSEndpoint.java
+++ b/hadoop-ozone/s3gateway/src/test/java/org/apache/hadoop/ozone/s3sts/TestS3STSEndpoint.java
@@ -78,6 +78,8 @@ public class TestS3STSEndpoint {
   private static final String STS_NS = "https://sts.amazonaws.com/doc/2011-06-15/";
   private static final String AWS_FAULT_NS = "http://webservices.amazon.com/AWSFault/2005-15-09";
   private static final String REQUEST_ID = "test-request-id";
+  private static final String DURATION_VALIDATION_ERROR_MESSAGE =
+      "Invalid Value: DurationSeconds must be a number between 900 and 43200 seconds";
 
   @BeforeEach
   public void setup() throws Exception {
@@ -133,7 +135,7 @@ public void testStsAssumeRoleRejectsUnsupportedParameterForGetMethod() throws Ex
     setAssumeRoleQueryParameters("PolicyArns.member.1", "arn:aws:iam::123456789012:policy/test-policy");
 
     final OSTSException ex = assertThrows(
-        OSTSException.class, () -> endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+        OSTSException.class, () -> endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", null));
 
     assertEquals(501, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -173,7 +175,7 @@ public void testStsAssumeRoleAllowsSupportedParametersForGetMethod() {
         "DurationSeconds", "3600",
         "Version", "2011-06-15");
 
-    final Response response = endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", null);
+    final Response response = endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", null);
 
     assertEquals(200, response.getStatus());
     verify(auditLogger).logWriteSuccess(any(AuditMessage.class));
@@ -195,7 +197,7 @@ public void testStsAssumeRoleAllowsSignatureParametersForGetMethod() {
         "X-Amz-SignedHeaders", "host",
         "X-Amz-Signature", "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef");
 
-    final Response response = endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", null);
+    final Response response = endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", null);
 
     assertEquals(200, response.getStatus());
     verify(auditLogger).logWriteSuccess(any(AuditMessage.class));
@@ -207,7 +209,7 @@ public void testStsAssumeRoleRejectsUnknownParameterForGetMethod() throws Except
     setAssumeRoleQueryParameters("TotallyUnknownParam", "x");
 
     final OSTSException ex = assertThrows(
-        OSTSException.class, () -> endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+        OSTSException.class, () -> endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", null));
 
     assertEquals(400, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -242,7 +244,7 @@ public void testStsAssumeRoleRejectsBlankParameterNameForGetMethod() throws Exce
     setAssumeRoleQueryParameters("", "x");
 
     final OSTSException ex = assertThrows(
-        OSTSException.class, () -> endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+        OSTSException.class, () -> endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", null));
 
     assertEquals(400, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -308,7 +310,7 @@ public void testStsAssumeRoleRejectsUnsupportedSigningParametersForPostMethod()
 
   @Test
   public void testStsAssumeRoleValidForGetMethod() throws Exception {
-    final Response response = endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", null);
+    final Response response = endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", null);
 
     assertEquals(200, response.getStatus());
     verify(auditLogger).logWriteSuccess(any(AuditMessage.class));
@@ -383,7 +385,7 @@ public void testStsAssumeRoleValidForPostMethod() throws Exception {
 
   @Test
   public void testStsNullAction() throws Exception {
-    final Response response = endpoint.get(null, ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", null);
+    final Response response = endpoint.get(null, ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", null);
 
     assertEquals(400, response.getStatus());
     verifyNoInteractions(auditLogger);
@@ -414,7 +416,7 @@ public void testStsNullFormForPostMethod() throws Exception {
   @Test
   public void testStsUnsupportedActionWithVersionSupplied() throws Exception {
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("UnsupportedAction", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+        endpoint.get("UnsupportedAction", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", null));
 
     assertEquals(400, ex.getHttpCode());
     verifyNoInteractions(auditLogger);
@@ -427,7 +429,7 @@ public void testStsUnsupportedActionWithVersionSupplied() throws Exception {
   @Test
   public void testStsUnsupportedActionWithVersionNotSupplied() throws Exception {
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("UnsupportedAction", ROLE_ARN, ROLE_SESSION_NAME, 3600, null, null));
+        endpoint.get("UnsupportedAction", ROLE_ARN, ROLE_SESSION_NAME, "3600", null, null));
 
     assertEquals(400, ex.getHttpCode());
     verifyNoInteractions(auditLogger);
@@ -440,7 +442,7 @@ public void testStsUnsupportedActionWithVersionNotSupplied() throws Exception {
   @Test
   public void testStsAssumeRoleWithInvalidVersion() throws Exception {
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2000-01-01", null));
+        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2000-01-01", null));
 
     assertEquals(400, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -454,7 +456,7 @@ public void testStsAssumeRoleWithInvalidVersion() throws Exception {
   @Test
   public void testStsInvalidDuration() throws Exception {
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, -1, "2011-06-15", null));
+        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "-1", "2011-06-15", null));
 
     assertEquals(400, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -464,6 +466,102 @@ public void testStsInvalidDuration() throws Exception {
     assertStsErrorXml(ex.toXml(), STS_NS, "Sender", "ValidationError", "Invalid Value: DurationSeconds");
   }
 
+  @Test
+  public void testStsDurationOverflowForGetMethod() throws Exception {
+    final OSTSException ex = assertThrows(
+        OSTSException.class, () -> endpoint.get(
+            "AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "4320010000", "2011-06-15", null));
+
+    assertEquals(400, ex.getHttpCode());
+    verify(auditLogger).logWriteFailure(any(AuditMessage.class));
+    verify(auditLogger, never()).logWriteSuccess(any(AuditMessage.class));
+    verify(objectStore, never()).assumeRole(anyString(), anyString(), anyInt(), any(), anyString());
+
+    ex.setRequestId(REQUEST_ID);
+    assertStsErrorXml(ex.toXml(), STS_NS, "Sender", "ValidationError", DURATION_VALIDATION_ERROR_MESSAGE);
+  }
+
+  @Test
+  public void testStsDurationOverflowForPostMethod() throws Exception {
+    setAssumeRoleFormParameters(
+        "Action", "AssumeRole", "RoleArn", ROLE_ARN, "RoleSessionName", ROLE_SESSION_NAME,
+        "DurationSeconds", "4320010000", "Version", "2011-06-15");
+
+    final OSTSException ex = assertThrows(OSTSException.class, () -> endpoint.post(formParameters).close());
+
+    assertEquals(400, ex.getHttpCode());
+    verify(auditLogger).logWriteFailure(any(AuditMessage.class));
+    verify(auditLogger, never()).logWriteSuccess(any(AuditMessage.class));
+    verify(objectStore, never()).assumeRole(anyString(), anyString(), anyInt(), any(), anyString());
+
+    ex.setRequestId(REQUEST_ID);
+    assertStsErrorXml(ex.toXml(), STS_NS, "Sender", "ValidationError", DURATION_VALIDATION_ERROR_MESSAGE);
+  }
+
+  @Test
+  public void testStsNonNumericDurationForGetMethod() throws Exception {
+    final OSTSException ex = assertThrows(
+        OSTSException.class, () -> endpoint.get(
+            "AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "abc", "2011-06-15", null));
+
+    assertEquals(400, ex.getHttpCode());
+    verify(auditLogger).logWriteFailure(any(AuditMessage.class));
+    verify(auditLogger, never()).logWriteSuccess(any(AuditMessage.class));
+    verify(objectStore, never()).assumeRole(anyString(), anyString(), anyInt(), any(), anyString());
+
+    ex.setRequestId(REQUEST_ID);
+    assertStsErrorXml(ex.toXml(), STS_NS, "Sender", "ValidationError", DURATION_VALIDATION_ERROR_MESSAGE);
+  }
+
+  @Test
+  public void testStsNonNumericDurationForPostMethod() throws Exception {
+    setAssumeRoleFormParameters(
+        "Action", "AssumeRole", "RoleArn", ROLE_ARN, "RoleSessionName", ROLE_SESSION_NAME, "DurationSeconds", "abc",
+        "Version", "2011-06-15");
+
+    final OSTSException ex = assertThrows(OSTSException.class, () -> endpoint.post(formParameters).close());
+
+    assertEquals(400, ex.getHttpCode());
+    verify(auditLogger).logWriteFailure(any(AuditMessage.class));
+    verify(auditLogger, never()).logWriteSuccess(any(AuditMessage.class));
+    verify(objectStore, never()).assumeRole(anyString(), anyString(), anyInt(), any(), anyString());
+
+    ex.setRequestId(REQUEST_ID);
+    assertStsErrorXml(ex.toXml(), STS_NS, "Sender", "ValidationError", DURATION_VALIDATION_ERROR_MESSAGE);
+  }
+
+  @Test
+  public void testStsBlankDurationForGetMethod() throws Exception {
+    final OSTSException ex = assertThrows(
+        OSTSException.class, () -> endpoint.get(
+            "AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "     ", "2011-06-15", null));
+
+    assertEquals(400, ex.getHttpCode());
+    verify(auditLogger).logWriteFailure(any(AuditMessage.class));
+    verify(auditLogger, never()).logWriteSuccess(any(AuditMessage.class));
+    verify(objectStore, never()).assumeRole(anyString(), anyString(), anyInt(), any(), anyString());
+
+    ex.setRequestId(REQUEST_ID);
+    assertStsErrorXml(ex.toXml(), STS_NS, "Sender", "ValidationError", DURATION_VALIDATION_ERROR_MESSAGE);
+  }
+
+  @Test
+  public void testStsBlankDurationForPostMethod() throws Exception {
+    setAssumeRoleFormParameters(
+        "Action", "AssumeRole", "RoleArn", ROLE_ARN, "RoleSessionName", ROLE_SESSION_NAME, "DurationSeconds", "     ",
+        "Version", "2011-06-15");
+
+    final OSTSException ex = assertThrows(OSTSException.class, () -> endpoint.post(formParameters).close());
+
+    assertEquals(400, ex.getHttpCode());
+    verify(auditLogger).logWriteFailure(any(AuditMessage.class));
+    verify(auditLogger, never()).logWriteSuccess(any(AuditMessage.class));
+    verify(objectStore, never()).assumeRole(anyString(), anyString(), anyInt(), any(), anyString());
+
+    ex.setRequestId(REQUEST_ID);
+    assertStsErrorXml(ex.toXml(), STS_NS, "Sender", "ValidationError", DURATION_VALIDATION_ERROR_MESSAGE);
+  }
+
   @Test
   public void testStsNullDurationUsesDefault3600() throws Exception {
     final Response response = endpoint.get(
@@ -482,7 +580,7 @@ public void testStsPolicyTooLarge() throws Exception {
     final String tooLargePolicy = RandomStringUtils.insecure().nextAlphanumeric(2049);
 
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", tooLargePolicy));
+        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", tooLargePolicy));
 
     assertEquals(400, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -498,7 +596,7 @@ public void testStsPolicyTooLarge() throws Exception {
   public void testStsInvalidRoleArn() throws Exception {
     final String invalidRoleArn = "arn:awsNotValid::123456789012:role/test-role";
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", invalidRoleArn, ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+        endpoint.get("AssumeRole", invalidRoleArn, ROLE_SESSION_NAME, "3600", "2011-06-15", null));
 
     assertEquals(400, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -512,7 +610,7 @@ public void testStsInvalidRoleArn() throws Exception {
   @Test
   public void testStsMissingRoleArn() throws Exception {
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", null, ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+        endpoint.get("AssumeRole", null, ROLE_SESSION_NAME, "3600", "2011-06-15", null));
 
     assertEquals(400, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -526,7 +624,7 @@ public void testStsMissingRoleArn() throws Exception {
   public void testStsInvalidRoleArnMissingRoleName() throws Exception {
     final String invalidRoleArn = "arn:aws:iam::123456789012:role/";
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", invalidRoleArn, ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+        endpoint.get("AssumeRole", invalidRoleArn, ROLE_SESSION_NAME, "3600", "2011-06-15", null));
 
     assertEquals(400, ex.getHttpCode());
     assertEquals("ValidationError", ex.getCode());
@@ -541,7 +639,7 @@ public void testStsInvalidRoleArnMissingRoleName() throws Exception {
   public void testStsInvalidRoleArnMissingAccountId() throws Exception {
     final String invalidRoleArn = "arn:aws:iam:::role/test-role";
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", invalidRoleArn, ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+        endpoint.get("AssumeRole", invalidRoleArn, ROLE_SESSION_NAME, "3600", "2011-06-15", null));
 
     assertEquals(400, ex.getHttpCode());
     assertEquals("ValidationError", ex.getCode());
@@ -556,7 +654,7 @@ public void testStsInvalidRoleArnMissingAccountId() throws Exception {
   @Test
   public void testStsWhenActionNotImplemented() throws Exception {
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("GetSessionToken", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+        endpoint.get("GetSessionToken", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", null));
 
     assertEquals(501, ex.getHttpCode());
     verifyNoInteractions(auditLogger);
@@ -588,7 +686,8 @@ public void testStsGetCallerIdentitySuccessForGetMethod() throws Exception {
 
   @Test
   public void testStsGetCallerIdentityIgnoresExtraParameters() throws Exception {
-    final Response response = endpoint.get("GetCallerIdentity", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", null);
+    final Response response = endpoint.get(
+        "GetCallerIdentity", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", null);
 
     assertEquals(200, response.getStatus());
     verify(objectStore).getCallerIdentity();
@@ -642,7 +741,7 @@ public void testStsGetCallerIdentityRejectsInvalidVersion() throws Exception {
   @Test
   public void testStsMissingRoleSessionName() throws Exception {
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", ROLE_ARN, null, 3600, "2011-06-15", null));
+        endpoint.get("AssumeRole", ROLE_ARN, null, "3600", "2011-06-15", null));
 
     assertEquals(400, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -656,7 +755,7 @@ public void testStsMissingRoleSessionName() throws Exception {
   public void testStsInvalidRoleSessionNameWithInvalidCharacter() throws Exception {
     final String invalidSession = "test/session";
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", ROLE_ARN, invalidSession, 3600, "2011-06-15", null));
+        endpoint.get("AssumeRole", ROLE_ARN, invalidSession, "3600", "2011-06-15", null));
 
     assertEquals(400, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -673,7 +772,7 @@ public void testStsInvalidRoleSessionNameWithInvalidCharacter() throws Exception
   public void testStsInvalidRoleSessionNameTooShort() throws Exception {
     final String invalidSession = "a";
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", ROLE_ARN, invalidSession, 3600, "2011-06-15", null));
+        endpoint.get("AssumeRole", ROLE_ARN, invalidSession, "3600", "2011-06-15", null));
 
     assertEquals(400, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -690,7 +789,7 @@ public void testStsInvalidRoleArnResourceType() throws Exception {
     // Resource type must be role, not user
     final String invalidRoleArn = "arn:aws:iam::123456789012:user/test-user";
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", invalidRoleArn, ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+        endpoint.get("AssumeRole", invalidRoleArn, ROLE_SESSION_NAME, "3600", "2011-06-15", null));
 
     assertEquals(400, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -706,7 +805,7 @@ public void testStsInternalFailureWhenBackendThrows() throws Exception {
         .thenThrow(new RuntimeException("some unexpected error"));
 
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", null));
 
     assertEquals(500, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -722,7 +821,7 @@ public void testStsAccessDenied() throws Exception {
         .thenThrow(new OMException("Permission denied", OMException.ResultCodes.ACCESS_DENIED));
 
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", null));
 
     assertEquals(403, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -739,7 +838,7 @@ public void testStsUnsupportedOperationWhenBackendThrowsNotSupportedOperation()
         .thenThrow(new OMException("Operation is not supported", OMException.ResultCodes.NOT_SUPPORTED_OPERATION));
 
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", null));
 
     assertEquals(501, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -755,7 +854,7 @@ public void testStsUnsupportedOperationWhenBackendThrowsFeatureNotEnabled() thro
         .thenThrow(new OMException("Feature is not enabled", OMException.ResultCodes.FEATURE_NOT_ENABLED));
 
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", null));
 
     assertEquals(501, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -771,7 +870,7 @@ public void testStsValidationErrorWhenBackendThrowsInvalidRequest() throws Excep
         .thenThrow(new OMException("Invalid request parameter", OMException.ResultCodes.INVALID_REQUEST));
 
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", null));
 
     assertEquals(400, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -787,7 +886,7 @@ public void testStsMalformedPolicyDocumentWhenBackendThrowsMalformedPolicyDocume
         .thenThrow(new OMException("Malformed session policy", OMException.ResultCodes.MALFORMED_POLICY_DOCUMENT));
 
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", null));
 
     assertEquals(400, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -804,7 +903,7 @@ public void testStsIOExceptionWrappedAsInternalFailure() throws Exception {
         .thenThrow(new IOException("An IO error occurred"));
 
     final OSTSException ex = assertThrows(OSTSException.class, () ->
-        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+        endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600", "2011-06-15", null));
 
     assertEquals(500, ex.getHttpCode());
     verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -818,7 +917,7 @@ public void testStsIOExceptionWrappedAsInternalFailure() throws Exception {
   public void testStsMultipleValidationErrors() throws Exception {
     final String invalidRoleSessionName = "test/session";
     final String tooLargePolicy = RandomStringUtils.insecure().nextAlphanumeric(2049);
-    final int invalidDurationSeconds = -1;
+    final String invalidDurationSeconds = "-1";
 
     final OSTSException ex = assertThrows(OSTSException.class, () ->
         endpoint.get("AssumeRole", ROLE_ARN, invalidRoleSessionName, invalidDurationSeconds, "2011-06-15",