Skip to content

Commit d915f0a

Browse files
jgrandjajgrandja
committed
Merge branch '1.0.x' into 1.1.x
Closes gh-1476
2 parents fb9a13b + c3e20e9 commit d915f0a

19 files changed

+168
-127
lines changed

‎docs/src/docs/asciidoc/examples/src/test/java/sample/AuthorizationCodeGrantFlow.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ public String authorize(RegisteredClient registeredClient, MultiValueMap<String,
110110

111111
// @formatter:off
112112
MvcResult mvcResult = this.mockMvc.perform(get("/oauth2/authorize")
113-
.params(parameters)
113+
.queryParams(parameters)
114114
.with(user(this.username).roles("USER")))
115115
.andExpect(status().isOk())
116116
.andExpect(header().string("content-type", containsString(MediaType.TEXT_HTML_VALUE)))

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/authentication/OidcClientRegistrationAuthenticationConverter.java‎

Lines changed: 23 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2022 the original author or authors.
2+
* Copyright 2020-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -15,6 +15,8 @@
1515
*/
1616
package org.springframework.security.oauth2.server.authorization.oidc.web.authentication;
1717

18+
import java.util.Map;
19+
1820
import jakarta.servlet.http.HttpServletRequest;
1921

2022
import org.springframework.http.converter.HttpMessageConverter;
@@ -30,6 +32,8 @@
3032
import org.springframework.security.oauth2.server.authorization.oidc.http.converter.OidcClientRegistrationHttpMessageConverter;
3133
import org.springframework.security.oauth2.server.authorization.oidc.web.OidcClientRegistrationEndpointFilter;
3234
import org.springframework.security.web.authentication.AuthenticationConverter;
35+
import org.springframework.util.LinkedMultiValueMap;
36+
import org.springframework.util.MultiValueMap;
3337
import org.springframework.util.StringUtils;
3438

3539
/**
@@ -65,14 +69,30 @@ public Authentication convert(HttpServletRequest request) {
6569
return new OidcClientRegistrationAuthenticationToken(principal, clientRegistration);
6670
}
6771

72+
MultiValueMap<String, String> parameters = getQueryParameters(request);
73+
6874
// client_id (REQUIRED)
69-
String clientId = request.getParameter(OAuth2ParameterNames.CLIENT_ID);
75+
String clientId = parameters.getFirst(OAuth2ParameterNames.CLIENT_ID);
7076
if (!StringUtils.hasText(clientId) ||
71-
request.getParameterValues(OAuth2ParameterNames.CLIENT_ID).length != 1) {
77+
parameters.get(OAuth2ParameterNames.CLIENT_ID).size() != 1) {
7278
throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
7379
}
7480

7581
return new OidcClientRegistrationAuthenticationToken(principal, clientId);
7682
}
7783

84+
private static MultiValueMap<String, String> getQueryParameters(HttpServletRequest request) {
85+
Map<String, String[]> parameterMap = request.getParameterMap();
86+
MultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
87+
parameterMap.forEach((key, values) -> {
88+
String queryString = StringUtils.hasText(request.getQueryString()) ? request.getQueryString() : "";
89+
if (queryString.contains(key) && values.length > 0) {
90+
for (String value : values) {
91+
parameters.add(key, value);
92+
}
93+
}
94+
});
95+
return parameters;
96+
}
97+
7898
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/ClientSecretPostAuthenticationConverter.java‎

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323
import org.springframework.security.core.Authentication;
2424
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
2525
import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
26-
import org.springframework.security.oauth2.core.OAuth2Error;
2726
import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
2827
import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
2928
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientAuthenticationToken;
@@ -48,7 +47,7 @@ public final class ClientSecretPostAuthenticationConverter implements Authentica
4847
@Nullable
4948
@Override
5049
public Authentication convert(HttpServletRequest request) {
51-
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);
50+
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getFormParameters(request);
5251

5352
// client_id (REQUIRED)
5453
String clientId = parameters.getFirst(OAuth2ParameterNames.CLIENT_ID);
@@ -70,17 +69,6 @@ public Authentication convert(HttpServletRequest request) {
7069
throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
7170
}
7271

73-
String queryString = request.getQueryString();
74-
if (StringUtils.hasText(queryString) &&
75-
(queryString.contains(OAuth2ParameterNames.CLIENT_ID) ||
76-
queryString.contains(OAuth2ParameterNames.CLIENT_SECRET))) {
77-
OAuth2Error error = new OAuth2Error(
78-
OAuth2ErrorCodes.INVALID_REQUEST,
79-
"Client credentials MUST NOT be included in the request URI.",
80-
null);
81-
throw new OAuth2AuthenticationException(error);
82-
}
83-
8472
Map<String, Object> additionalParameters = OAuth2EndpointUtils.getParametersIfMatchesAuthorizationCodeGrantRequest(request,
8573
OAuth2ParameterNames.CLIENT_ID,
8674
OAuth2ParameterNames.CLIENT_SECRET);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/JwtClientAssertionAuthenticationConverter.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2022 the original author or authors.
2+
* Copyright 2020-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -48,13 +48,13 @@ public final class JwtClientAssertionAuthenticationConverter implements Authenti
4848
@Nullable
4949
@Override
5050
public Authentication convert(HttpServletRequest request) {
51-
if (request.getParameter(OAuth2ParameterNames.CLIENT_ASSERTION_TYPE) == null ||
52-
request.getParameter(OAuth2ParameterNames.CLIENT_ASSERTION) == null) {
51+
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getFormParameters(request);
52+
53+
if (parameters.getFirst(OAuth2ParameterNames.CLIENT_ASSERTION_TYPE) == null ||
54+
parameters.getFirst(OAuth2ParameterNames.CLIENT_ASSERTION) == null) {
5355
return null;
5456
}
5557

56-
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);
57-
5858
// client_assertion_type (REQUIRED)
5959
String clientAssertionType = parameters.getFirst(OAuth2ParameterNames.CLIENT_ASSERTION_TYPE);
6060
if (parameters.get(OAuth2ParameterNames.CLIENT_ASSERTION_TYPE).size() != 1) {

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2AuthorizationCodeAuthenticationConverter.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,16 +47,16 @@ public final class OAuth2AuthorizationCodeAuthenticationConverter implements Aut
4747
@Nullable
4848
@Override
4949
public Authentication convert(HttpServletRequest request) {
50+
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getFormParameters(request);
51+
5052
// grant_type (REQUIRED)
51-
String grantType = request.getParameter(OAuth2ParameterNames.GRANT_TYPE);
53+
String grantType = parameters.getFirst(OAuth2ParameterNames.GRANT_TYPE);
5254
if (!AuthorizationGrantType.AUTHORIZATION_CODE.getValue().equals(grantType)) {
5355
return null;
5456
}
5557

5658
Authentication clientPrincipal = SecurityContextHolder.getContext().getAuthentication();
5759

58-
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);
59-
6060
// code (REQUIRED)
6161
String code = parameters.getFirst(OAuth2ParameterNames.CODE);
6262
if (!StringUtils.hasText(code) ||

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2AuthorizationCodeRequestAuthenticationConverter.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,10 +66,13 @@ public Authentication convert(HttpServletRequest request) {
6666
return null;
6767
}
6868

69-
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);
69+
MultiValueMap<String, String> parameters =
70+
"GET".equals(request.getMethod()) ?
71+
OAuth2EndpointUtils.getQueryParameters(request) :
72+
OAuth2EndpointUtils.getFormParameters(request);
7073

7174
// response_type (REQUIRED)
72-
String responseType = request.getParameter(OAuth2ParameterNames.RESPONSE_TYPE);
75+
String responseType = parameters.getFirst(OAuth2ParameterNames.RESPONSE_TYPE);
7376
if (!StringUtils.hasText(responseType) ||
7477
parameters.get(OAuth2ParameterNames.RESPONSE_TYPE).size() != 1) {
7578
throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.RESPONSE_TYPE);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2AuthorizationConsentAuthenticationConverter.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,13 +54,13 @@ public final class OAuth2AuthorizationConsentAuthenticationConverter implements
5454

5555
@Override
5656
public Authentication convert(HttpServletRequest request) {
57+
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getFormParameters(request);
58+
5759
if (!"POST".equals(request.getMethod()) ||
58-
request.getParameter(OAuth2ParameterNames.RESPONSE_TYPE) != null) {
60+
parameters.getFirst(OAuth2ParameterNames.RESPONSE_TYPE) != null) {
5961
return null;
6062
}
6163

62-
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);
63-
6464
String authorizationUri = request.getRequestURL().toString();
6565

6666
// client_id (REQUIRED)

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2ClientCredentialsAuthenticationConverter.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,16 +50,16 @@ public final class OAuth2ClientCredentialsAuthenticationConverter implements Aut
5050
@Nullable
5151
@Override
5252
public Authentication convert(HttpServletRequest request) {
53+
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getFormParameters(request);
54+
5355
// grant_type (REQUIRED)
54-
String grantType = request.getParameter(OAuth2ParameterNames.GRANT_TYPE);
56+
String grantType = parameters.getFirst(OAuth2ParameterNames.GRANT_TYPE);
5557
if (!AuthorizationGrantType.CLIENT_CREDENTIALS.getValue().equals(grantType)) {
5658
return null;
5759
}
5860

5961
Authentication clientPrincipal = SecurityContextHolder.getContext().getAuthentication();
6062

61-
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);
62-
6363
// scope (OPTIONAL)
6464
String scope = parameters.getFirst(OAuth2ParameterNames.SCOPE);
6565
if (StringUtils.hasText(scope) &&

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2EndpointUtils.java‎

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,13 @@
2929
import org.springframework.util.Assert;
3030
import org.springframework.util.LinkedMultiValueMap;
3131
import org.springframework.util.MultiValueMap;
32+
import org.springframework.util.StringUtils;
3233

3334
/**
3435
* Utility methods for the OAuth 2.0 Protocol Endpoints.
3536
*
3637
* @author Joe Grandja
38+
* @author Greg Li
3739
* @since 0.1.2
3840
*/
3941
final class OAuth2EndpointUtils {
@@ -42,11 +44,27 @@ final class OAuth2EndpointUtils {
4244
private OAuth2EndpointUtils() {
4345
}
4446

45-
static MultiValueMap<String, String> getParameters(HttpServletRequest request) {
47+
static MultiValueMap<String, String> getFormParameters(HttpServletRequest request) {
4648
Map<String, String[]> parameterMap = request.getParameterMap();
47-
MultiValueMap<String, String> parameters = new LinkedMultiValueMap<>(parameterMap.size());
49+
MultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
4850
parameterMap.forEach((key, values) -> {
49-
if (values.length > 0) {
51+
String queryString = StringUtils.hasText(request.getQueryString()) ? request.getQueryString() : "";
52+
// If not query parameter then it's a form parameter
53+
if (!queryString.contains(key) && values.length > 0) {
54+
for (String value : values) {
55+
parameters.add(key, value);
56+
}
57+
}
58+
});
59+
return parameters;
60+
}
61+
62+
static MultiValueMap<String, String> getQueryParameters(HttpServletRequest request) {
63+
Map<String, String[]> parameterMap = request.getParameterMap();
64+
MultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
65+
parameterMap.forEach((key, values) -> {
66+
String queryString = StringUtils.hasText(request.getQueryString()) ? request.getQueryString() : "";
67+
if (queryString.contains(key) && values.length > 0) {
5068
for (String value : values) {
5169
parameters.add(key, value);
5270
}
@@ -59,7 +77,10 @@ static Map<String, Object> getParametersIfMatchesAuthorizationCodeGrantRequest(H
5977
if (!matchesAuthorizationCodeGrantRequest(request)) {
6078
return Collections.emptyMap();
6179
}
62-
MultiValueMap<String, String> multiValueParameters = getParameters(request);
80+
MultiValueMap<String, String> multiValueParameters =
81+
"GET".equals(request.getMethod()) ?
82+
getQueryParameters(request) :
83+
getFormParameters(request);
6384
for (String exclusion : exclusions) {
6485
multiValueParameters.remove(exclusion);
6586
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2RefreshTokenAuthenticationConverter.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,16 +50,16 @@ public final class OAuth2RefreshTokenAuthenticationConverter implements Authenti
5050
@Nullable
5151
@Override
5252
public Authentication convert(HttpServletRequest request) {
53+
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getFormParameters(request);
54+
5355
// grant_type (REQUIRED)
54-
String grantType = request.getParameter(OAuth2ParameterNames.GRANT_TYPE);
56+
String grantType = parameters.getFirst(OAuth2ParameterNames.GRANT_TYPE);
5557
if (!AuthorizationGrantType.REFRESH_TOKEN.getValue().equals(grantType)) {
5658
return null;
5759
}
5860

5961
Authentication clientPrincipal = SecurityContextHolder.getContext().getAuthentication();
6062

61-
MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);
62-
6363
// refresh_token (REQUIRED)
6464
String refreshToken = parameters.getFirst(OAuth2ParameterNames.REFRESH_TOKEN);
6565
if (!StringUtils.hasText(refreshToken) ||

0 commit comments

Comments
 (0)