Skip to content

Commit 9a92ff2

Browse files
FerencKemenyFerencKemeny
committed
setAllowEmpty method created
Signed-off-by: Ferenc Kemeny <ferenc.kemeny79+oss@gmail.com>
1 parent 0d3089f commit 9a92ff2

6 files changed

Lines changed: 105 additions & 232 deletions

File tree

‎oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/JwtAudienceValidator.java‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -32,25 +32,25 @@ public final class JwtAudienceValidator implements OAuth2TokenValidator<Jwt> {
3232

3333
private final JwtClaimValidator<Collection<String>> validator;
3434

35+
private boolean allowEmpty;
36+
3537
/**
36-
* Constructs a {@link JwtAudienceValidator} using the provided parameters with
37-
* {@link JwtClaimNames#ISS "iss"} claim is REQUIRED
38+
* Constructs a {@link JwtAudienceValidator} using the provided parameters
3839
* @param audience - The audience that each {@link Jwt} should have.
3940
*/
4041
public JwtAudienceValidator(String audience) {
41-
this(audience, true);
42+
Assert.notNull(audience, "audience cannot be null");
43+
this.allowEmpty = false;
44+
this.validator = new JwtClaimValidator<>(JwtClaimNames.AUD,
45+
(claimValue) -> (claimValue != null) ? claimValue.contains(audience) : allowEmpty);
4246
}
4347

4448
/**
45-
* Constructs a {@link JwtIssuerValidator} using the provided parameters
46-
* @param audience - The audience that each {@link Jwt} should have.
47-
* @param required -{@code true} if the {@link JwtClaimNames#AUD "aud"} claim is
48-
* REQUIRED in the {@link Jwt}, {@code false} otherwise
49+
* Whether to allow the {@code aud} claim to be empty. The default value is
50+
* {@code false}
4951
*/
50-
public JwtAudienceValidator(String audience, boolean required) {
51-
Assert.notNull(audience, "audience cannot be null");
52-
this.validator = new JwtClaimValidator<>(JwtClaimNames.AUD,
53-
(claimValue) -> (claimValue != null) ? claimValue.contains(audience) : !required);
52+
public void setAllowEmpty(boolean allowEmpty) {
53+
this.allowEmpty = allowEmpty;
5454
}
5555

5656
@Override

‎oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/JwtIssuerValidator.java‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -30,25 +30,25 @@ public final class JwtIssuerValidator implements OAuth2TokenValidator<Jwt> {
3030

3131
private final JwtClaimValidator<Object> validator;
3232

33+
private boolean allowEmpty;
34+
3335
/**
34-
* Constructs a {@link JwtIssuerValidator} using the provided parameters with
35-
* {@link JwtClaimNames#ISS "iss"} claim is REQUIRED
36+
* Constructs a {@link JwtIssuerValidator} using the provided parameters
3637
* @param issuer - The issuer that each {@link Jwt} should have.
3738
*/
3839
public JwtIssuerValidator(String issuer) {
39-
this(issuer, true);
40+
Assert.notNull(issuer, "issuer cannot be null");
41+
this.allowEmpty = true;
42+
this.validator = new JwtClaimValidator<>(JwtClaimNames.ISS,
43+
(claimValue) -> (claimValue != null) ? issuer.equals(claimValue.toString()) : allowEmpty);
4044
}
4145

4246
/**
43-
* Constructs a {@link JwtIssuerValidator} using the provided parameters
44-
* @param issuer - The issuer that each {@link Jwt} should have.
45-
* @param required -{@code true} if the {@link JwtClaimNames#ISS "iss"} claim is
46-
* REQUIRED in the {@link Jwt}, {@code false} otherwise
47+
* Whether to allow the {@code iss} claim to be empty. The default value is
48+
* {@code false}
4749
*/
48-
public JwtIssuerValidator(String issuer, boolean required) {
49-
Assert.notNull(issuer, "issuer cannot be null");
50-
this.validator = new JwtClaimValidator<>(JwtClaimNames.ISS,
51-
(claimValue) -> (claimValue != null) ? issuer.equals(claimValue.toString()) : !required);
50+
public void setAllowEmpty(boolean allowEmpty) {
51+
this.allowEmpty = allowEmpty;
5252
}
5353

5454
@Override

‎oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/JwtTimestampValidator.java‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ public final class JwtTimestampValidator implements OAuth2TokenValidator<Jwt> {
5252

5353
private static final Duration DEFAULT_MAX_CLOCK_SKEW = Duration.of(60, ChronoUnit.SECONDS);
5454

55-
private final boolean required;
55+
private boolean allowEmpty;
5656

5757
private final Duration clockSkew;
5858

@@ -62,29 +62,29 @@ public final class JwtTimestampValidator implements OAuth2TokenValidator<Jwt> {
6262
* A basic instance with no custom verification and the default max clock skew
6363
*/
6464
public JwtTimestampValidator() {
65-
this(DEFAULT_MAX_CLOCK_SKEW, false);
66-
}
67-
68-
public JwtTimestampValidator(boolean required) {
69-
this(DEFAULT_MAX_CLOCK_SKEW, required);
65+
this(DEFAULT_MAX_CLOCK_SKEW);
7066
}
7167

7268
public JwtTimestampValidator(Duration clockSkew) {
73-
this(clockSkew, false);
74-
}
75-
76-
public JwtTimestampValidator(Duration clockSkew, boolean required) {
7769
Assert.notNull(clockSkew, "clockSkew cannot be null");
78-
this.required = required;
70+
this.allowEmpty = true;
7971
this.clockSkew = clockSkew;
8072
}
8173

74+
/**
75+
* Whether to allow the {@code exp} or {@code nbf} header to be empty. The default value is
76+
* {@code true}
77+
*/
78+
public void setAllowEmpty(boolean allowEmpty) {
79+
this.allowEmpty = allowEmpty;
80+
}
81+
8282
@Override
8383
public OAuth2TokenValidatorResult validate(Jwt jwt) {
8484
Assert.notNull(jwt, "jwt cannot be null");
8585
Instant expiry = jwt.getExpiresAt();
8686
Instant notBefore = jwt.getNotBefore();
87-
if (this.required && !(expiry != null || notBefore != null)) {
87+
if (!this.allowEmpty && !(expiry != null || notBefore != null)) {
8888
OAuth2Error oAuth2Error = createOAuth2Error("exp and nbf are required");
8989
return OAuth2TokenValidatorResult.failure(oAuth2Error);
9090
}

‎oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/JwtAudienceValidatorTests.java‎

Lines changed: 16 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -31,72 +31,50 @@
3131
*/
3232
class JwtAudienceValidatorTests {
3333

34-
private final JwtAudienceValidator validatorDefault = new JwtAudienceValidator("audience");
35-
36-
private final JwtAudienceValidator validatorRequiredTrue = new JwtAudienceValidator("audience", true);
37-
38-
private final JwtAudienceValidator validatorRequiredFalse = new JwtAudienceValidator("audience", false);
34+
private final JwtAudienceValidator validator = new JwtAudienceValidator("audience");
3935

4036
@Test
41-
void givenRequiredDefaultJwtWithMatchingAudienceThenShouldValidate() {
37+
void givenAllowEmptyDefaultJwtWithMatchingAudienceThenShouldValidate() {
4238
Jwt jwt = TestJwts.jwt().audience(List.of("audience")).build();
43-
OAuth2TokenValidatorResult result = this.validatorDefault.validate(jwt);
39+
OAuth2TokenValidatorResult result = this.validator.validate(jwt);
4440
assertThat(result).isEqualTo(OAuth2TokenValidatorResult.success());
4541
}
4642

4743
@Test
48-
void givenRequiredJwtWithMatchingAudienceThenShouldValidate() {
44+
void givenAllowEmptyTrueJwtWithMatchingAudienceThenShouldValidate() {
4945
Jwt jwt = TestJwts.jwt().audience(List.of("audience")).build();
50-
OAuth2TokenValidatorResult result = this.validatorRequiredTrue.validate(jwt);
46+
this.validator.setAllowEmpty(true);
47+
OAuth2TokenValidatorResult result = this.validator.validate(jwt);
5148
assertThat(result).isEqualTo(OAuth2TokenValidatorResult.success());
5249
}
5350

5451
@Test
55-
void givenNotRequiredJwtWithMatchingAudienceThenShouldValidate() {
56-
Jwt jwt = TestJwts.jwt().audience(List.of("audience")).build();
57-
OAuth2TokenValidatorResult result = this.validatorRequiredFalse.validate(jwt);
58-
assertThat(result).isEqualTo(OAuth2TokenValidatorResult.success());
59-
}
60-
61-
@Test
62-
void givenRequiredDefaultJwtWithoutMatchingAudienceThenShouldValidate() {
52+
void givenAllowEmptyDefaultJwtWithoutMatchingAudienceThenShouldValidate() {
6353
Jwt jwt = TestJwts.jwt().audience(List.of("other")).build();
64-
OAuth2TokenValidatorResult result = this.validatorDefault.validate(jwt);
54+
OAuth2TokenValidatorResult result = this.validator.validate(jwt);
6555
assertThat(result.hasErrors()).isTrue();
6656
}
6757

6858
@Test
69-
void givenRequiredJwtWithoutMatchingAudienceThenShouldValidate() {
59+
void givenAllowEmptyJwtWithoutMatchingAudienceThenShouldValidate() {
7060
Jwt jwt = TestJwts.jwt().audience(List.of("other")).build();
71-
OAuth2TokenValidatorResult result = this.validatorRequiredTrue.validate(jwt);
72-
assertThat(result.hasErrors()).isTrue();
73-
}
74-
75-
@Test
76-
void givenNotRequiredJwtWithoutMatchingAudienceThenShouldValidate() {
77-
Jwt jwt = TestJwts.jwt().audience(List.of("other")).build();
78-
OAuth2TokenValidatorResult result = this.validatorRequiredFalse.validate(jwt);
79-
assertThat(result.hasErrors()).isTrue();
80-
}
81-
82-
@Test
83-
void givenRequiredDefaultJwtWithoutAudienceThenShouldValidate() {
84-
Jwt jwt = TestJwts.jwt().audience(null).build();
85-
OAuth2TokenValidatorResult result = this.validatorDefault.validate(jwt);
61+
this.validator.setAllowEmpty(true);
62+
OAuth2TokenValidatorResult result = this.validator.validate(jwt);
8663
assertThat(result.hasErrors()).isTrue();
8764
}
8865

8966
@Test
90-
void givenRequiredJwtWithoutAudienceThenShouldValidate() {
67+
void givenAllowEmptyDefaultJwtWithoutAudienceThenShouldValidate() {
9168
Jwt jwt = TestJwts.jwt().audience(null).build();
92-
OAuth2TokenValidatorResult result = this.validatorRequiredTrue.validate(jwt);
69+
OAuth2TokenValidatorResult result = this.validator.validate(jwt);
9370
assertThat(result.hasErrors()).isTrue();
9471
}
9572

9673
@Test
97-
void givenNotRequiredJwtWithoutAudienceThenShouldValidate() {
74+
void givenAllowEmptyTrueJwtWithoutAudienceThenShouldValidate() {
9875
Jwt jwt = TestJwts.jwt().audience(null).build();
99-
OAuth2TokenValidatorResult result = this.validatorRequiredFalse.validate(jwt);
76+
this.validator.setAllowEmpty(true);
77+
OAuth2TokenValidatorResult result = this.validator.validate(jwt);
10078
assertThat(result.hasErrors()).isFalse();
10179
}
10280

0 commit comments

Comments
 (0)