Skip to content

Commit c3e20e9

Browse files
jgrandjajgrandja
committed
Merge branch '0.4.x' into 1.0.x
2 parents 042885c + f0a6a4c commit c3e20e9

19 files changed

+168
-127
lines changed

‎docs/src/docs/asciidoc/examples/src/test/java/sample/AuthorizationCodeGrantFlow.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2022 the original author or authors.
2+
* Copyright 2020-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -94,7 +94,7 @@ public String authorize(RegisteredClient registeredClient) throws Exception {
9494
parameters.set(OAuth2ParameterNames.STATE, "state");
9595

9696
MvcResult mvcResult = this.mockMvc.perform(get("/oauth2/authorize")
97-
.params(parameters)
97+
.queryParams(parameters)
9898
.with(user(this.username).roles("USER")))
9999
.andExpect(status().isOk())
100100
.andExpect(header().string("content-type", containsString(MediaType.TEXT_HTML_VALUE)))

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/authentication/OidcClientRegistrationAuthenticationConverter.java‎

Lines changed: 23 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2022 the original author or authors.
2+
* Copyright 2020-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -15,6 +15,8 @@
1515
*/
1616
package org.springframework.security.oauth2.server.authorization.oidc.web.authentication;
1717

18+
import java.util.Map;
19+
1820
import jakarta.servlet.http.HttpServletRequest;
1921

2022
import org.springframework.http.converter.HttpMessageConverter;
@@ -30,6 +32,8 @@
3032
import org.springframework.security.oauth2.server.authorization.oidc.http.converter.OidcClientRegistrationHttpMessageConverter;
3133
import org.springframework.security.oauth2.server.authorization.oidc.web.OidcClientRegistrationEndpointFilter;
3234
import org.springframework.security.web.authentication.AuthenticationConverter;
35+
import org.springframework.util.LinkedMultiValueMap;
36+
import org.springframework.util.MultiValueMap;
3337
import org.springframework.util.StringUtils;
3438

3539
/**
@@ -65,14 +69,30 @@ public Authentication convert(HttpServletRequest request) {
6569
return new OidcClientRegistrationAuthenticationToken(principal, clientRegistration);
6670
}
6771

72+
MultiValueMap<String, String> parameters = getQueryParameters(request);
73+
6874
// client_id (REQUIRED)
69-
String clientId = request.getParameter(OAuth2ParameterNames.CLIENT_ID);
75+
String clientId = parameters.getFirst(OAuth2ParameterNames.CLIENT_ID);
7076
if (!StringUtils.hasText(clientId) ||
71-
request.getParameterValues(OAuth2ParameterNames.CLIENT_ID).length != 1) {
77+
parameters.get(OAuth2ParameterNames.CLIENT_ID).size() != 1) {
7278
throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
7379
}
7480

7581
return new OidcClientRegistrationAuthenticationToken(principal, clientId);
7682
}
7783

84+
private static MultiValueMap<String, String> getQueryParameters(HttpServletRequest request) {
85+
Map<String, String[]> parameterMap = request.getParameterMap();
86+
MultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
87+
parameterMap.forEach((key, values) -> {
88+
String queryString = StringUtils.hasText(request.getQueryString()) ? request.getQueryString() : "";
89+
if (queryString.contains(key) && values.length > 0) {
90+
for (String value : values) {
91+
parameters.add(key, value);
92+
}
93+
}
94+
});
95+
return parameters;
96+
}
97+
7898
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/ClientSecretPostAuthenticationConverter.java‎

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323
import org.springframework.security.core.Authentication;
2424
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
2525
import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
26-
import org.springframework.security.oauth2.core.OAuth2Error;
2726
import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
2827
import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
2928
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientAuthenticationToken;
@@ -48,7 +47,7 @@ public final class ClientSecretPostAuthenticationConverter implements Authentica
4847
@Nullable
4948
@Override
5049
public Authentication convert(HttpServletRequest request) {
51-
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);
50+
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getFormParameters(request);
5251

5352
// client_id (REQUIRED)
5453
String clientId = parameters.getFirst(OAuth2ParameterNames.CLIENT_ID);
@@ -70,17 +69,6 @@ public Authentication convert(HttpServletRequest request) {
7069
throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
7170
}
7271

73-
String queryString = request.getQueryString();
74-
if (StringUtils.hasText(queryString) &&
75-
(queryString.contains(OAuth2ParameterNames.CLIENT_ID) ||
76-
queryString.contains(OAuth2ParameterNames.CLIENT_SECRET))) {
77-
OAuth2Error error = new OAuth2Error(
78-
OAuth2ErrorCodes.INVALID_REQUEST,
79-
"Client credentials MUST NOT be included in the request URI.",
80-
null);
81-
throw new OAuth2AuthenticationException(error);
82-
}
83-
8472
Map<String, Object> additionalParameters = OAuth2EndpointUtils.getParametersIfMatchesAuthorizationCodeGrantRequest(request,
8573
OAuth2ParameterNames.CLIENT_ID,
8674
OAuth2ParameterNames.CLIENT_SECRET);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/JwtClientAssertionAuthenticationConverter.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2022 the original author or authors.
2+
* Copyright 2020-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -48,13 +48,13 @@ public final class JwtClientAssertionAuthenticationConverter implements Authenti
4848
@Nullable
4949
@Override
5050
public Authentication convert(HttpServletRequest request) {
51-
if (request.getParameter(OAuth2ParameterNames.CLIENT_ASSERTION_TYPE) == null ||
52-
request.getParameter(OAuth2ParameterNames.CLIENT_ASSERTION) == null) {
51+
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getFormParameters(request);
52+
53+
if (parameters.getFirst(OAuth2ParameterNames.CLIENT_ASSERTION_TYPE) == null ||
54+
parameters.getFirst(OAuth2ParameterNames.CLIENT_ASSERTION) == null) {
5355
return null;
5456
}
5557

56-
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);
57-
5858
// client_assertion_type (REQUIRED)
5959
String clientAssertionType = parameters.getFirst(OAuth2ParameterNames.CLIENT_ASSERTION_TYPE);
6060
if (parameters.get(OAuth2ParameterNames.CLIENT_ASSERTION_TYPE).size() != 1) {

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2AuthorizationCodeAuthenticationConverter.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,16 +47,16 @@ public final class OAuth2AuthorizationCodeAuthenticationConverter implements Aut
4747
@Nullable
4848
@Override
4949
public Authentication convert(HttpServletRequest request) {
50+
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getFormParameters(request);
51+
5052
// grant_type (REQUIRED)
51-
String grantType = request.getParameter(OAuth2ParameterNames.GRANT_TYPE);
53+
String grantType = parameters.getFirst(OAuth2ParameterNames.GRANT_TYPE);
5254
if (!AuthorizationGrantType.AUTHORIZATION_CODE.getValue().equals(grantType)) {
5355
return null;
5456
}
5557

5658
Authentication clientPrincipal = SecurityContextHolder.getContext().getAuthentication();
5759

58-
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);
59-
6060
// code (REQUIRED)
6161
String code = parameters.getFirst(OAuth2ParameterNames.CODE);
6262
if (!StringUtils.hasText(code) ||

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2AuthorizationCodeRequestAuthenticationConverter.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,10 +66,13 @@ public Authentication convert(HttpServletRequest request) {
6666
return null;
6767
}
6868

69-
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);
69+
MultiValueMap<String, String> parameters =
70+
"GET".equals(request.getMethod()) ?
71+
OAuth2EndpointUtils.getQueryParameters(request) :
72+
OAuth2EndpointUtils.getFormParameters(request);
7073

7174
// response_type (REQUIRED)
72-
String responseType = request.getParameter(OAuth2ParameterNames.RESPONSE_TYPE);
75+
String responseType = parameters.getFirst(OAuth2ParameterNames.RESPONSE_TYPE);
7376
if (!StringUtils.hasText(responseType) ||
7477
parameters.get(OAuth2ParameterNames.RESPONSE_TYPE).size() != 1) {
7578
throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.RESPONSE_TYPE);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2AuthorizationConsentAuthenticationConverter.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,13 +54,13 @@ public final class OAuth2AuthorizationConsentAuthenticationConverter implements
5454

5555
@Override
5656
public Authentication convert(HttpServletRequest request) {
57+
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getFormParameters(request);
58+
5759
if (!"POST".equals(request.getMethod()) ||
58-
request.getParameter(OAuth2ParameterNames.RESPONSE_TYPE) != null) {
60+
parameters.getFirst(OAuth2ParameterNames.RESPONSE_TYPE) != null) {
5961
return null;
6062
}
6163

62-
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);
63-
6464
String authorizationUri = request.getRequestURL().toString();
6565

6666
// client_id (REQUIRED)

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2ClientCredentialsAuthenticationConverter.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,16 +50,16 @@ public final class OAuth2ClientCredentialsAuthenticationConverter implements Aut
5050
@Nullable
5151
@Override
5252
public Authentication convert(HttpServletRequest request) {
53+
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getFormParameters(request);
54+
5355
// grant_type (REQUIRED)
54-
String grantType = request.getParameter(OAuth2ParameterNames.GRANT_TYPE);
56+
String grantType = parameters.getFirst(OAuth2ParameterNames.GRANT_TYPE);
5557
if (!AuthorizationGrantType.CLIENT_CREDENTIALS.getValue().equals(grantType)) {
5658
return null;
5759
}
5860

5961
Authentication clientPrincipal = SecurityContextHolder.getContext().getAuthentication();
6062

61-
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);
62-
6363
// scope (OPTIONAL)
6464
String scope = parameters.getFirst(OAuth2ParameterNames.SCOPE);
6565
if (StringUtils.hasText(scope) &&

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2EndpointUtils.java‎

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,13 @@
2828
import org.springframework.security.oauth2.core.endpoint.PkceParameterNames;
2929
import org.springframework.util.LinkedMultiValueMap;
3030
import org.springframework.util.MultiValueMap;
31+
import org.springframework.util.StringUtils;
3132

3233
/**
3334
* Utility methods for the OAuth 2.0 Protocol Endpoints.
3435
*
3536
* @author Joe Grandja
37+
* @author Greg Li
3638
* @since 0.1.2
3739
*/
3840
final class OAuth2EndpointUtils {
@@ -41,11 +43,27 @@ final class OAuth2EndpointUtils {
4143
private OAuth2EndpointUtils() {
4244
}
4345

44-
static MultiValueMap<String, String> getParameters(HttpServletRequest request) {
46+
static MultiValueMap<String, String> getFormParameters(HttpServletRequest request) {
4547
Map<String, String[]> parameterMap = request.getParameterMap();
46-
MultiValueMap<String, String> parameters = new LinkedMultiValueMap<>(parameterMap.size());
48+
MultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
4749
parameterMap.forEach((key, values) -> {
48-
if (values.length > 0) {
50+
String queryString = StringUtils.hasText(request.getQueryString()) ? request.getQueryString() : "";
51+
// If not query parameter then it's a form parameter
52+
if (!queryString.contains(key) && values.length > 0) {
53+
for (String value : values) {
54+
parameters.add(key, value);
55+
}
56+
}
57+
});
58+
return parameters;
59+
}
60+
61+
static MultiValueMap<String, String> getQueryParameters(HttpServletRequest request) {
62+
Map<String, String[]> parameterMap = request.getParameterMap();
63+
MultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
64+
parameterMap.forEach((key, values) -> {
65+
String queryString = StringUtils.hasText(request.getQueryString()) ? request.getQueryString() : "";
66+
if (queryString.contains(key) && values.length > 0) {
4967
for (String value : values) {
5068
parameters.add(key, value);
5169
}
@@ -58,7 +76,10 @@ static Map<String, Object> getParametersIfMatchesAuthorizationCodeGrantRequest(H
5876
if (!matchesAuthorizationCodeGrantRequest(request)) {
5977
return Collections.emptyMap();
6078
}
61-
MultiValueMap<String, String> multiValueParameters = getParameters(request);
79+
MultiValueMap<String, String> multiValueParameters =
80+
"GET".equals(request.getMethod()) ?
81+
getQueryParameters(request) :
82+
getFormParameters(request);
6283
for (String exclusion : exclusions) {
6384
multiValueParameters.remove(exclusion);
6485
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2RefreshTokenAuthenticationConverter.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,16 +50,16 @@ public final class OAuth2RefreshTokenAuthenticationConverter implements Authenti
5050
@Nullable
5151
@Override
5252
public Authentication convert(HttpServletRequest request) {
53+
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getFormParameters(request);
54+
5355
// grant_type (REQUIRED)
54-
String grantType = request.getParameter(OAuth2ParameterNames.GRANT_TYPE);
56+
String grantType = parameters.getFirst(OAuth2ParameterNames.GRANT_TYPE);
5557
if (!AuthorizationGrantType.REFRESH_TOKEN.getValue().equals(grantType)) {
5658
return null;
5759
}
5860

5961
Authentication clientPrincipal = SecurityContextHolder.getContext().getAuthentication();
6062

61-
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);
62-
6363
// refresh_token (REQUIRED)
6464
String refreshToken = parameters.getFirst(OAuth2ParameterNames.REFRESH_TOKEN);
6565
if (!StringUtils.hasText(refreshToken) ||

0 commit comments

Comments
 (0)