Skip to content

Commit 97c5133

Browse files
Mert-ZMert-Z
committed
Issue#5 - Unable to request access token using refresh token, internal
server error
1 parent c09dff1 commit 97c5133

File tree

2 files changed

+101
-0
lines changed

2 files changed

+101
-0
lines changed

‎src/main/java/mertz/security/oauth2/provider/token/store/cassandra/CassandraTokenStore.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -312,6 +312,10 @@ public void removeAccessTokenUsingRefreshToken(OAuth2RefreshToken refreshToken)
312312
if (refreshTokenToAccessToken != null) {
313313
String accessTokenKey = refreshTokenToAccessToken.getAccessTokenKey();
314314
AccessToken accessToken = accessTokenRepository.findOne(accessTokenKey);
315+
if (accessToken == null) {
316+
// access token removed already or expired.
317+
return;
318+
}
315319
String jsonOAuth2AccessToken = accessToken.getoAuth2AccessToken();
316320
OAuth2AccessToken oAuth2AccessToken = OAuthUtil.deserializeOAuth2AccessToken(jsonOAuth2AccessToken);
317321
// Delete access token from all related tables

‎src/test/java/mertz/security/oauth2/provider/token/store/cassandra/CassandraTokenStoreTests.java‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,29 @@
11
package mertz.security.oauth2.provider.token.store.cassandra;
22

3+
import static org.junit.Assert.*;
4+
5+
import java.util.Collection;
6+
import java.util.Date;
7+
import java.util.UUID;
8+
39
import org.junit.Before;
10+
import org.junit.Test;
411
import org.junit.runner.RunWith;
512
import org.springframework.beans.factory.annotation.Autowired;
613
import org.springframework.boot.test.context.ConfigFileApplicationContextInitializer;
714
import org.springframework.context.annotation.ComponentScan;
815
import org.springframework.context.annotation.Configuration;
916
import org.springframework.data.cassandra.core.CassandraOperations;
1017
import org.springframework.data.cassandra.mapping.CassandraMappingContext;
18+
import org.springframework.security.authentication.TestingAuthenticationToken;
19+
import org.springframework.security.oauth2.common.DefaultExpiringOAuth2RefreshToken;
20+
import org.springframework.security.oauth2.common.DefaultOAuth2AccessToken;
21+
import org.springframework.security.oauth2.common.DefaultOAuth2RefreshToken;
22+
import org.springframework.security.oauth2.common.OAuth2AccessToken;
23+
import org.springframework.security.oauth2.common.OAuth2RefreshToken;
24+
import org.springframework.security.oauth2.provider.OAuth2Authentication;
25+
import org.springframework.security.oauth2.provider.OAuth2Request;
26+
import org.springframework.security.oauth2.provider.RequestTokenFactory;
1127
import org.springframework.security.oauth2.provider.token.TokenStore;
1228
import org.springframework.security.oauth2.provider.token.store.TokenStoreBaseTests;
1329
import org.springframework.test.context.ActiveProfiles;
@@ -44,4 +60,85 @@ public static class SpringConfig {
4460

4561
}
4662

63+
@Test
64+
public void testExpiringRefreshToken() throws InterruptedException {
65+
String refreshToken = UUID.randomUUID().toString();
66+
DefaultOAuth2RefreshToken expectedExpiringRefreshToken = new DefaultExpiringOAuth2RefreshToken(refreshToken, new Date(System.currentTimeMillis() + 1500));
67+
OAuth2Authentication expectedAuthentication = new OAuth2Authentication(RequestTokenFactory.createOAuth2Request("id", false), new TestAuthentication("test2", false));
68+
getTokenStore().storeRefreshToken(expectedExpiringRefreshToken, expectedAuthentication);
69+
OAuth2RefreshToken actualExpiringRefreshToken = getTokenStore().readRefreshToken(refreshToken);
70+
assertEquals(expectedExpiringRefreshToken, actualExpiringRefreshToken);
71+
assertEquals(expectedAuthentication, getTokenStore().readAuthenticationForRefreshToken(expectedExpiringRefreshToken));
72+
// let the token expire
73+
Thread.sleep(1500);
74+
// now it should be gone
75+
assertNull(getTokenStore().readRefreshToken(refreshToken));
76+
assertNull(getTokenStore().readAuthenticationForRefreshToken(expectedExpiringRefreshToken));
77+
}
78+
79+
@Test
80+
public void testExpiringAccessToken() throws InterruptedException {
81+
String accessToken = UUID.randomUUID().toString();
82+
OAuth2Authentication expectedAuthentication = new OAuth2Authentication(RequestTokenFactory.createOAuth2Request("id", false), new TestAuthentication("test2", false));
83+
DefaultOAuth2AccessToken expectedOAuth2AccessToken = new DefaultOAuth2AccessToken(accessToken);
84+
expectedOAuth2AccessToken.setExpiration(new Date(System.currentTimeMillis() + 1500));
85+
getTokenStore().storeAccessToken(expectedOAuth2AccessToken, expectedAuthentication);
86+
OAuth2AccessToken actualOAuth2AccessToken = getTokenStore().readAccessToken(accessToken);
87+
assertEquals(expectedOAuth2AccessToken, actualOAuth2AccessToken);
88+
assertEquals(expectedAuthentication, getTokenStore().readAuthentication(expectedOAuth2AccessToken));
89+
// let the token expire
90+
Thread.sleep(1500);
91+
// now it should be gone
92+
assertNull(getTokenStore().readAccessToken(accessToken));
93+
assertNull(getTokenStore().readAuthentication(expectedOAuth2AccessToken));
94+
}
95+
96+
@Test
97+
public void storeAccessTokenWithoutRefreshTokenRemoveAccessTokenVerifyTokenRemoved() {
98+
OAuth2Request request = RequestTokenFactory.createOAuth2Request("clientId", false);
99+
TestingAuthenticationToken authentication = new TestingAuthenticationToken("user", "password");
100+
OAuth2AccessToken oauth2AccessToken = new DefaultOAuth2AccessToken("access-token-" + UUID.randomUUID());
101+
OAuth2Authentication oauth2Authentication = new OAuth2Authentication(request, authentication);
102+
getTokenStore().storeAccessToken(oauth2AccessToken, oauth2Authentication);
103+
getTokenStore().removeAccessToken(oauth2AccessToken);
104+
Collection<OAuth2AccessToken> oauth2AccessTokens = getTokenStore().findTokensByClientId(request.getClientId());
105+
assertTrue(oauth2AccessTokens.isEmpty());
106+
}
107+
108+
@Test
109+
public void storeExpiringAccessTokenWithRefreshToken_RemoveExpiredAccessTokenUsingRefreshToken() throws InterruptedException {
110+
String accessToken = "accessToken-" + UUID.randomUUID();
111+
OAuth2Authentication expectedAuthentication = new OAuth2Authentication(RequestTokenFactory.createOAuth2Request("id", false), new TestAuthentication("test2", false));
112+
DefaultOAuth2AccessToken expectedOAuth2AccessToken = new DefaultOAuth2AccessToken(accessToken);
113+
expectedOAuth2AccessToken.setExpiration(new Date(System.currentTimeMillis() + 1500));
114+
String refreshToken = "testToken-" + UUID.randomUUID();
115+
DefaultOAuth2RefreshToken expectedRefreshToken = new DefaultOAuth2RefreshToken(refreshToken);
116+
expectedOAuth2AccessToken.setRefreshToken(expectedRefreshToken);
117+
getTokenStore().storeAccessToken(expectedOAuth2AccessToken, expectedAuthentication);
118+
// let the access token expire
119+
Thread.sleep(1500);
120+
// now it should be gone
121+
assertNull(getTokenStore().readAccessToken(accessToken));
122+
// use refresh token to remove already expired access token, expect no issues since access token has already been removed.
123+
getTokenStore().removeAccessTokenUsingRefreshToken(expectedRefreshToken);
124+
}
125+
126+
@Test
127+
public void storeAccessTokenWithRefreshToken_RemoveAccessTokenUsingRefreshToken() throws InterruptedException {
128+
String accessToken = "accessToken-" + UUID.randomUUID();
129+
OAuth2Authentication expectedAuthentication = new OAuth2Authentication(RequestTokenFactory.createOAuth2Request("id", false), new TestAuthentication("test2", false));
130+
DefaultOAuth2AccessToken expectedOAuth2AccessToken = new DefaultOAuth2AccessToken(accessToken);
131+
String refreshToken = "testToken-" + UUID.randomUUID();
132+
DefaultOAuth2RefreshToken expectedRefreshToken = new DefaultOAuth2RefreshToken(refreshToken);
133+
expectedOAuth2AccessToken.setRefreshToken(expectedRefreshToken);
134+
getTokenStore().storeAccessToken(expectedOAuth2AccessToken, expectedAuthentication);
135+
// make sure access token is in the repository
136+
OAuth2AccessToken actualOAuth2AccessToken = getTokenStore().readAccessToken(accessToken);
137+
assertEquals(expectedOAuth2AccessToken, actualOAuth2AccessToken);
138+
// use refresh token to remove access token
139+
getTokenStore().removeAccessTokenUsingRefreshToken(expectedRefreshToken);
140+
// now it should be gone
141+
assertNull(getTokenStore().readAccessToken(accessToken));
142+
}
143+
47144
}

0 commit comments

Comments
 (0)