Skip to content

Commit ca2ffb0

Browse files
jgrandjajgrandja
committed
Remove support for "plain" code_challenge_method parameter
Closes gh-756
1 parent c4406cd commit ca2ffb0

File tree

9 files changed

+19
-122
lines changed

9 files changed

+19
-122
lines changed

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/CodeVerifierAuthenticator.java‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -113,8 +113,6 @@ private static boolean authorizationCodeGrant(Map<String, Object> parameters) {
113113
private static boolean codeVerifierValid(String codeVerifier, String codeChallenge, String codeChallengeMethod) {
114114
if (!StringUtils.hasText(codeVerifier)) {
115115
return false;
116-
} else if (!StringUtils.hasText(codeChallengeMethod) || "plain".equals(codeChallengeMethod)) {
117-
return codeVerifier.equals(codeChallenge);
118116
} else if ("S256".equals(codeChallengeMethod)) {
119117
try {
120118
MessageDigest md = MessageDigest.getInstance("SHA-256");

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -210,7 +210,7 @@ private Authentication authenticateAuthorizationRequest(Authentication authentic
210210
if (StringUtils.hasText(codeChallenge)) {
211211
String codeChallengeMethod = (String) authorizationCodeRequestAuthentication.getAdditionalParameters().get(PkceParameterNames.CODE_CHALLENGE_METHOD);
212212
if (StringUtils.hasText(codeChallengeMethod)) {
213-
if (!"S256".equals(codeChallengeMethod) && !"plain".equals(codeChallengeMethod)) {
213+
if (!"S256".equals(codeChallengeMethod)) {
214214
throwError(OAuth2ErrorCodes.INVALID_REQUEST, PkceParameterNames.CODE_CHALLENGE_METHOD, PKCE_ERROR_URI,
215215
authorizationCodeRequestAuthentication, registeredClient, null);
216216
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationServerMetadataEndpointFilter.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,6 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
9494
.tokenRevocationEndpointAuthenticationMethods(clientAuthenticationMethods())
9595
.tokenIntrospectionEndpoint(asUrl(issuer, this.providerSettings.getTokenIntrospectionEndpoint()))
9696
.tokenIntrospectionEndpointAuthenticationMethods(clientAuthenticationMethods())
97-
.codeChallengeMethod("plain")
9897
.codeChallengeMethod("S256")
9998
.build();
10099

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/core/OAuth2AuthorizationServerMetadataTests.java‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2021 the original author or authors.
2+
* Copyright 2020-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -59,7 +59,6 @@ public void buildWhenAllClaimsProvidedThenCreated() {
5959
.tokenRevocationEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue())
6060
.tokenIntrospectionEndpoint("https://example.com/issuer1/oauth2/introspect")
6161
.tokenIntrospectionEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue())
62-
.codeChallengeMethod("plain")
6362
.codeChallengeMethod("S256")
6463
.claim("a-claim", "a-value")
6564
.build();
@@ -76,7 +75,7 @@ public void buildWhenAllClaimsProvidedThenCreated() {
7675
assertThat(authorizationServerMetadata.getTokenRevocationEndpointAuthenticationMethods()).containsExactly(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue());
7776
assertThat(authorizationServerMetadata.getTokenIntrospectionEndpoint()).isEqualTo(url("https://example.com/issuer1/oauth2/introspect"));
7877
assertThat(authorizationServerMetadata.getTokenIntrospectionEndpointAuthenticationMethods()).containsExactly(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue());
79-
assertThat(authorizationServerMetadata.getCodeChallengeMethods()).containsExactlyInAnyOrder("plain", "S256");
78+
assertThat(authorizationServerMetadata.getCodeChallengeMethods()).containsExactly("S256");
8079
assertThat(authorizationServerMetadata.getClaimAsString("a-claim")).isEqualTo("a-value");
8180
}
8281

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/core/http/converter/OAuth2AuthorizationServerMetadataHttpMessageConverterTests.java‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2021 the original author or authors.
2+
* Copyright 2020-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -103,7 +103,7 @@ public void readInternalWhenValidParametersThenSuccess() throws Exception {
103103
+ " \"revocation_endpoint_auth_methods_supported\": [\"client_secret_basic\"],\n"
104104
+ " \"introspection_endpoint\": \"https://example.com/issuer1/oauth2/introspect\",\n"
105105
+ " \"introspection_endpoint_auth_methods_supported\": [\"client_secret_basic\"],\n"
106-
+ " \"code_challenge_methods_supported\": [\"plain\",\"S256\"],\n"
106+
+ " \"code_challenge_methods_supported\": [\"S256\"],\n"
107107
+ " \"custom_claim\": \"value\",\n"
108108
+ " \"custom_collection_claim\": [\"value1\", \"value2\"]\n"
109109
+ "}\n";
@@ -125,7 +125,7 @@ public void readInternalWhenValidParametersThenSuccess() throws Exception {
125125
assertThat(authorizationServerMetadata.getTokenRevocationEndpointAuthenticationMethods()).containsExactly(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue());
126126
assertThat(authorizationServerMetadata.getTokenIntrospectionEndpoint()).isEqualTo(new URL("https://example.com/issuer1/oauth2/introspect"));
127127
assertThat(authorizationServerMetadata.getTokenIntrospectionEndpointAuthenticationMethods()).containsExactly(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue());
128-
assertThat(authorizationServerMetadata.getCodeChallengeMethods()).containsExactlyInAnyOrder("plain", "S256");
128+
assertThat(authorizationServerMetadata.getCodeChallengeMethods()).containsExactly("S256");
129129
assertThat(authorizationServerMetadata.getClaimAsString("custom_claim")).isEqualTo("value");
130130
assertThat(authorizationServerMetadata.getClaimAsStringList("custom_collection_claim")).containsExactlyInAnyOrder("value1", "value2");
131131
}
@@ -172,7 +172,6 @@ public void writeInternalWhenOAuth2AuthorizationServerMetadataThenSuccess() {
172172
.tokenRevocationEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue())
173173
.tokenIntrospectionEndpoint("https://example.com/issuer1/oauth2/introspect")
174174
.tokenIntrospectionEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue())
175-
.codeChallengeMethod("plain")
176175
.codeChallengeMethod("S256")
177176
.claim("custom_claim", "value")
178177
.claim("custom_collection_claim", Arrays.asList("value1", "value2"))
@@ -194,7 +193,7 @@ public void writeInternalWhenOAuth2AuthorizationServerMetadataThenSuccess() {
194193
assertThat(authorizationServerMetadataResponse).contains("\"revocation_endpoint_auth_methods_supported\":[\"client_secret_basic\"]");
195194
assertThat(authorizationServerMetadataResponse).contains("\"introspection_endpoint\":\"https://example.com/issuer1/oauth2/introspect\"");
196195
assertThat(authorizationServerMetadataResponse).contains("\"introspection_endpoint_auth_methods_supported\":[\"client_secret_basic\"]");
197-
assertThat(authorizationServerMetadataResponse).contains("\"code_challenge_methods_supported\":[\"plain\",\"S256\"]");
196+
assertThat(authorizationServerMetadataResponse).contains("\"code_challenge_methods_supported\":[\"S256\"]");
198197
assertThat(authorizationServerMetadataResponse).contains("\"custom_claim\":\"value\"");
199198
assertThat(authorizationServerMetadataResponse).contains("\"custom_collection_claim\":[\"value1\",\"value2\"]");
200199
}

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/ClientSecretAuthenticationProviderTests.java‎

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -54,9 +54,6 @@
5454
* @author Daniel Garnier-Moiroux
5555
*/
5656
public class ClientSecretAuthenticationProviderTests {
57-
private static final String PLAIN_CODE_VERIFIER = "pkce-key";
58-
private static final String PLAIN_CODE_CHALLENGE = PLAIN_CODE_VERIFIER;
59-
6057
// See RFC 7636: Appendix B. Example for the S256 code_challenge_method
6158
// https://tools.ietf.org/html/rfc7636#appendix-B
6259
private static final String S256_CODE_VERIFIER = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
@@ -231,12 +228,12 @@ public void authenticateWhenPkceAndInvalidCodeThenThrowOAuth2AuthenticationExcep
231228
.thenReturn(registeredClient);
232229

233230
OAuth2Authorization authorization = TestOAuth2Authorizations
234-
.authorization(registeredClient, createPkceAuthorizationParametersPlain())
231+
.authorization(registeredClient, createPkceAuthorizationParametersS256())
235232
.build();
236233
when(this.authorizationService.findByToken(eq(AUTHORIZATION_CODE), eq(AUTHORIZATION_CODE_TOKEN_TYPE)))
237234
.thenReturn(authorization);
238235

239-
Map<String, Object> parameters = createPkceTokenParameters(PLAIN_CODE_VERIFIER);
236+
Map<String, Object> parameters = createPkceTokenParameters(S256_CODE_VERIFIER);
240237
parameters.put(OAuth2ParameterNames.CODE, "invalid-code");
241238

242239
OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken(
@@ -258,7 +255,7 @@ public void authenticateWhenPkceAndMissingCodeVerifierThenThrowOAuth2Authenticat
258255
.thenReturn(registeredClient);
259256

260257
OAuth2Authorization authorization = TestOAuth2Authorizations
261-
.authorization(registeredClient, createPkceAuthorizationParametersPlain())
258+
.authorization(registeredClient, createPkceAuthorizationParametersS256())
262259
.build();
263260
when(this.authorizationService.findByToken(eq(AUTHORIZATION_CODE), eq(AUTHORIZATION_CODE_TOKEN_TYPE)))
264261
.thenReturn(authorization);
@@ -317,13 +314,6 @@ private static Map<String, Object> createPkceTokenParameters(String codeVerifier
317314
return parameters;
318315
}
319316

320-
private static Map<String, Object> createPkceAuthorizationParametersPlain() {
321-
Map<String, Object> parameters = new HashMap<>();
322-
parameters.put(PkceParameterNames.CODE_CHALLENGE_METHOD, "plain");
323-
parameters.put(PkceParameterNames.CODE_CHALLENGE, PLAIN_CODE_CHALLENGE);
324-
return parameters;
325-
}
326-
327317
private static Map<String, Object> createPkceAuthorizationParametersS256() {
328318
Map<String, Object> parameters = new HashMap<>();
329319
parameters.put(PkceParameterNames.CODE_CHALLENGE_METHOD, "S256");

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/PublicClientAuthenticationProviderTests.java‎

Lines changed: 6 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,6 @@
4848
* @author Daniel Garnier-Moiroux
4949
*/
5050
public class PublicClientAuthenticationProviderTests {
51-
private static final String PLAIN_CODE_VERIFIER = "pkce-key";
52-
private static final String PLAIN_CODE_CHALLENGE = PLAIN_CODE_VERIFIER;
53-
5451
// See RFC 7636: Appendix B. Example for the S256 code_challenge_method
5552
// https://tools.ietf.org/html/rfc7636#appendix-B
5653
private static final String S256_CODE_VERIFIER = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
@@ -131,12 +128,12 @@ public void authenticateWhenInvalidCodeThenThrowOAuth2AuthenticationException()
131128
.thenReturn(registeredClient);
132129

133130
OAuth2Authorization authorization = TestOAuth2Authorizations
134-
.authorization(registeredClient, createPkceAuthorizationParametersPlain())
131+
.authorization(registeredClient, createPkceAuthorizationParametersS256())
135132
.build();
136133
when(this.authorizationService.findByToken(eq(AUTHORIZATION_CODE), eq(AUTHORIZATION_CODE_TOKEN_TYPE)))
137134
.thenReturn(authorization);
138135

139-
Map<String, Object> parameters = createPkceTokenParameters(PLAIN_CODE_VERIFIER);
136+
Map<String, Object> parameters = createPkceTokenParameters(S256_CODE_VERIFIER);
140137
parameters.put(OAuth2ParameterNames.CODE, "invalid-code");
141138

142139
OAuth2ClientAuthenticationToken authentication =
@@ -163,7 +160,7 @@ public void authenticateWhenMissingCodeChallengeThenThrowOAuth2AuthenticationExc
163160
when(this.authorizationService.findByToken(eq(AUTHORIZATION_CODE), eq(AUTHORIZATION_CODE_TOKEN_TYPE)))
164161
.thenReturn(authorization);
165162

166-
Map<String, Object> parameters = createPkceTokenParameters(PLAIN_CODE_VERIFIER);
163+
Map<String, Object> parameters = createPkceTokenParameters(S256_CODE_VERIFIER);
167164

168165
OAuth2ClientAuthenticationToken authentication =
169166
new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), ClientAuthenticationMethod.NONE, null, parameters);
@@ -184,7 +181,7 @@ public void authenticateWhenMissingCodeVerifierThenThrowOAuth2AuthenticationExce
184181
.thenReturn(registeredClient);
185182

186183
OAuth2Authorization authorization = TestOAuth2Authorizations
187-
.authorization(registeredClient, createPkceAuthorizationParametersPlain())
184+
.authorization(registeredClient, createPkceAuthorizationParametersS256())
188185
.build();
189186
when(this.authorizationService.findByToken(eq(AUTHORIZATION_CODE), eq(AUTHORIZATION_CODE_TOKEN_TYPE)))
190187
.thenReturn(authorization);
@@ -203,32 +200,6 @@ public void authenticateWhenMissingCodeVerifierThenThrowOAuth2AuthenticationExce
203200
});
204201
}
205202

206-
@Test
207-
public void authenticateWhenPlainMethodAndInvalidCodeVerifierThenThrowOAuth2AuthenticationException() {
208-
RegisteredClient registeredClient = TestRegisteredClients.registeredPublicClient().build();
209-
when(this.registeredClientRepository.findByClientId(eq(registeredClient.getClientId())))
210-
.thenReturn(registeredClient);
211-
212-
OAuth2Authorization authorization = TestOAuth2Authorizations
213-
.authorization(registeredClient, createPkceAuthorizationParametersPlain())
214-
.build();
215-
when(this.authorizationService.findByToken(eq(AUTHORIZATION_CODE), eq(AUTHORIZATION_CODE_TOKEN_TYPE)))
216-
.thenReturn(authorization);
217-
218-
Map<String, Object> parameters = createPkceTokenParameters("invalid-code-verifier");
219-
220-
OAuth2ClientAuthenticationToken authentication =
221-
new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), ClientAuthenticationMethod.NONE, null, parameters);
222-
223-
assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication))
224-
.isInstanceOf(OAuth2AuthenticationException.class)
225-
.extracting(ex -> ((OAuth2AuthenticationException) ex).getError())
226-
.satisfies(error -> {
227-
assertThat(error.getErrorCode()).isEqualTo(OAuth2ErrorCodes.INVALID_GRANT);
228-
assertThat(error.getDescription()).contains(PkceParameterNames.CODE_VERIFIER);
229-
});
230-
}
231-
232203
@Test
233204
public void authenticateWhenS256MethodAndInvalidCodeVerifierThenThrowOAuth2AuthenticationException() {
234205
RegisteredClient registeredClient = TestRegisteredClients.registeredPublicClient().build();
@@ -255,58 +226,6 @@ public void authenticateWhenS256MethodAndInvalidCodeVerifierThenThrowOAuth2Authe
255226
});
256227
}
257228

258-
@Test
259-
public void authenticateWhenPlainMethodAndValidCodeVerifierThenAuthenticated() {
260-
RegisteredClient registeredClient = TestRegisteredClients.registeredPublicClient().build();
261-
when(this.registeredClientRepository.findByClientId(eq(registeredClient.getClientId())))
262-
.thenReturn(registeredClient);
263-
264-
OAuth2Authorization authorization = TestOAuth2Authorizations
265-
.authorization(registeredClient, createPkceAuthorizationParametersPlain())
266-
.build();
267-
when(this.authorizationService.findByToken(eq(AUTHORIZATION_CODE), eq(AUTHORIZATION_CODE_TOKEN_TYPE)))
268-
.thenReturn(authorization);
269-
270-
Map<String, Object> parameters = createPkceTokenParameters(PLAIN_CODE_VERIFIER);
271-
272-
OAuth2ClientAuthenticationToken authentication =
273-
new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), ClientAuthenticationMethod.NONE, null, parameters);
274-
275-
OAuth2ClientAuthenticationToken authenticationResult =
276-
(OAuth2ClientAuthenticationToken) this.authenticationProvider.authenticate(authentication);
277-
assertThat(authenticationResult.isAuthenticated()).isTrue();
278-
assertThat(authenticationResult.getPrincipal().toString()).isEqualTo(registeredClient.getClientId());
279-
assertThat(authenticationResult.getCredentials()).isNull();
280-
assertThat(authenticationResult.getRegisteredClient()).isEqualTo(registeredClient);
281-
}
282-
283-
@Test
284-
public void authenticateWhenMissingMethodThenDefaultPlainMethodAndAuthenticated() {
285-
RegisteredClient registeredClient = TestRegisteredClients.registeredPublicClient().build();
286-
when(this.registeredClientRepository.findByClientId(eq(registeredClient.getClientId())))
287-
.thenReturn(registeredClient);
288-
289-
Map<String, Object> authorizationRequestAdditionalParameters = createPkceAuthorizationParametersPlain();
290-
authorizationRequestAdditionalParameters.remove(PkceParameterNames.CODE_CHALLENGE_METHOD);
291-
OAuth2Authorization authorization = TestOAuth2Authorizations
292-
.authorization(registeredClient, authorizationRequestAdditionalParameters)
293-
.build();
294-
when(this.authorizationService.findByToken(eq(AUTHORIZATION_CODE), eq(AUTHORIZATION_CODE_TOKEN_TYPE)))
295-
.thenReturn(authorization);
296-
297-
Map<String, Object> parameters = createPkceTokenParameters(PLAIN_CODE_VERIFIER);
298-
299-
OAuth2ClientAuthenticationToken authentication =
300-
new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), ClientAuthenticationMethod.NONE, null, parameters);
301-
302-
OAuth2ClientAuthenticationToken authenticationResult =
303-
(OAuth2ClientAuthenticationToken) this.authenticationProvider.authenticate(authentication);
304-
assertThat(authenticationResult.isAuthenticated()).isTrue();
305-
assertThat(authenticationResult.getPrincipal().toString()).isEqualTo(registeredClient.getClientId());
306-
assertThat(authenticationResult.getCredentials()).isNull();
307-
assertThat(authenticationResult.getRegisteredClient()).isEqualTo(registeredClient);
308-
}
309-
310229
@Test
311230
public void authenticateWhenS256MethodAndValidCodeVerifierThenAuthenticated() {
312231
RegisteredClient registeredClient = TestRegisteredClients.registeredPublicClient().build();
@@ -338,7 +257,7 @@ public void authenticateWhenUnsupportedCodeChallengeMethodThenThrowOAuth2Authent
338257
when(this.registeredClientRepository.findByClientId(eq(registeredClient.getClientId())))
339258
.thenReturn(registeredClient);
340259

341-
Map<String, Object> authorizationRequestAdditionalParameters = createPkceAuthorizationParametersPlain();
260+
Map<String, Object> authorizationRequestAdditionalParameters = createPkceAuthorizationParametersS256();
342261
// This should never happen: the Authorization endpoint should not allow it
343262
authorizationRequestAdditionalParameters.put(PkceParameterNames.CODE_CHALLENGE_METHOD, "unsupported-challenge-method");
344263
OAuth2Authorization authorization = TestOAuth2Authorizations
@@ -347,7 +266,7 @@ public void authenticateWhenUnsupportedCodeChallengeMethodThenThrowOAuth2Authent
347266
when(this.authorizationService.findByToken(eq(AUTHORIZATION_CODE), eq(AUTHORIZATION_CODE_TOKEN_TYPE)))
348267
.thenReturn(authorization);
349268

350-
Map<String, Object> parameters = createPkceTokenParameters(PLAIN_CODE_VERIFIER);
269+
Map<String, Object> parameters = createPkceTokenParameters(S256_CODE_VERIFIER);
351270

352271
OAuth2ClientAuthenticationToken authentication =
353272
new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), ClientAuthenticationMethod.NONE, null, parameters);
@@ -372,13 +291,6 @@ private static Map<String, Object> createPkceTokenParameters(String codeVerifier
372291
return parameters;
373292
}
374293

375-
private static Map<String, Object> createPkceAuthorizationParametersPlain() {
376-
Map<String, Object> parameters = new HashMap<>();
377-
parameters.put(PkceParameterNames.CODE_CHALLENGE_METHOD, "plain");
378-
parameters.put(PkceParameterNames.CODE_CHALLENGE, PLAIN_CODE_CHALLENGE);
379-
return parameters;
380-
}
381-
382294
private static Map<String, Object> createPkceAuthorizationParametersS256() {
383295
Map<String, Object> parameters = new HashMap<>();
384296
parameters.put(PkceParameterNames.CODE_CHALLENGE_METHOD, "S256");

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationEndpointFilterTests.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2021 the original author or authors.
2+
* Copyright 2020-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -260,7 +260,7 @@ public void doFilterWhenAuthorizationRequestMultipleCodeChallengeMethodThenInval
260260
OAuth2ErrorCodes.INVALID_REQUEST,
261261
request -> {
262262
request.addParameter(PkceParameterNames.CODE_CHALLENGE_METHOD, "S256");
263-
request.addParameter(PkceParameterNames.CODE_CHALLENGE_METHOD, "plain");
263+
request.addParameter(PkceParameterNames.CODE_CHALLENGE_METHOD, "S256");
264264
});
265265
}
266266

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationServerMetadataEndpointFilterTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ public void doFilterWhenAuthorizationServerMetadataRequestThenMetadataResponse()
132132
assertThat(authorizationServerMetadataResponse).contains("\"revocation_endpoint_auth_methods_supported\":[\"client_secret_basic\",\"client_secret_post\",\"client_secret_jwt\",\"private_key_jwt\"]");
133133
assertThat(authorizationServerMetadataResponse).contains("\"introspection_endpoint\":\"https://example.com/issuer1/oauth2/v1/introspect\"");
134134
assertThat(authorizationServerMetadataResponse).contains("\"introspection_endpoint_auth_methods_supported\":[\"client_secret_basic\",\"client_secret_post\",\"client_secret_jwt\",\"private_key_jwt\"]");
135-
assertThat(authorizationServerMetadataResponse).contains("\"code_challenge_methods_supported\":[\"plain\",\"S256\"]");
135+
assertThat(authorizationServerMetadataResponse).contains("\"code_challenge_methods_supported\":[\"S256\"]");
136136
}
137137

138138
@Test

0 commit comments

Comments
 (0)