Fix OAuth2 client-secret encoding with Base64 padding #17674
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
spring-projects-issues
added
the
status: waiting-for-triage
When using CLIENT_SECRET_POST authentication method with a client secret
that ends with Base64 padding characters ('='), the padding was being
URL-encoded to '%3D'. This caused authentication failures with some
OAuth2 providers that expect the padding characters to remain unencoded.
This commit adds special handling for CLIENT_SECRET_POST authentication
to preserve Base64 padding characters in the client secret while still
properly encoding other form parameters.
Closes spring-projectsgh-17629
Signed-off-by: Hyunjoon Kim <[email protected]>
Signed-off-by: academey <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds compatibility support for OAuth2/OIDC providers that expect Base64 padding characters ('=') to remain unencoded in client secrets when using the CLIENT_SECRET_POST authentication method.
Context
As discussed in #17629, the current behavior of URL-encoding '=' to '%3D' is actually standards-compliant with:
application/x-www-form-urlencodedencodingHowever, some OIDC providers don't properly handle URL-encoded padding characters, causing authentication failures.
Details
AbstractRestClientOAuth2AccessTokenResponseClientOAuth2ClientCredentialsGrantRequestEntityUtilsto handle form parameter encoding while preserving Base64 paddingCompatibility Note
This change is a compatibility enhancement rather than a bug fix. It helps Spring Security work with OIDC providers that don't strictly follow the standards.
Test Plan
getTokenResponseWhenClientSecretPostWithBase64PaddingThenPaddingNotEncodedto verify the fixOpen Questions
Should this behavior be configurable to maintain strict standards compliance by default?
Closes gh-17629