Spring/spring-authorization-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use OAuth2ParameterNames.REQUEST_URI

Browse Source 
Issue gh-1925

Closes gh-1991
This commit is contained in:
Joe Grandja
2025-04-22 06:06:31 -04:00
parent 834d405fee
commit 23179507d5
7 changed files with 39 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java
View File

@@ -124,22 +124,22 @@ public final class OAuth2AuthorizationCodeRequestAuthenticationProvider implemen
OAuth2Authorization pushedAuthorization = null;
String requestUri = (String) authorizationCodeRequestAuthentication.getAdditionalParameters()
.get("request_uri");
.get(OAuth2ParameterNames.REQUEST_URI);
if (StringUtils.hasText(requestUri)) {
OAuth2PushedAuthorizationRequestUri pushedAuthorizationRequestUri = null;
try {
pushedAuthorizationRequestUri = OAuth2PushedAuthorizationRequestUri.parse(requestUri);
}
catch (Exception ex) {
throwError(OAuth2ErrorCodes.INVALID_REQUEST, "request_uri", authorizationCodeRequestAuthentication,
null);
throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.REQUEST_URI,
authorizationCodeRequestAuthentication, null);
}
pushedAuthorization = this.authorizationService.findByToken(pushedAuthorizationRequestUri.getState(),
STATE_TOKEN_TYPE);
if (pushedAuthorization == null) {
throwError(OAuth2ErrorCodes.INVALID_REQUEST, "request_uri", authorizationCodeRequestAuthentication,
null);
throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.REQUEST_URI,
authorizationCodeRequestAuthentication, null);
}
if (this.logger.isTraceEnabled()) {
@@ -162,8 +162,8 @@ public final class OAuth2AuthorizationCodeRequestAuthenticationProvider implemen
.warn(LogMessage.format("Removed expired pushed authorization request for client id '%s'",
authorizationRequest.getClientId()));
}
throwError(OAuth2ErrorCodes.INVALID_REQUEST, "request_uri", authorizationCodeRequestAuthentication,
null);
throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.REQUEST_URI,
authorizationCodeRequestAuthentication, null);
}
authorizationCodeRequestAuthentication = new OAuth2AuthorizationCodeRequestAuthenticationToken(

3
oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2PushedAuthorizationRequestEndpointFilter.java
View File

@@ -208,7 +208,8 @@ public final class OAuth2PushedAuthorizationRequestEndpointFilter extends OncePe
OAuth2PushedAuthorizationRequestAuthenticationToken pushedAuthorizationRequestAuthentication = (OAuth2PushedAuthorizationRequestAuthenticationToken) authentication;
Map<String, Object> pushedAuthorizationResponse = new LinkedHashMap<>();
pushedAuthorizationResponse.put("request_uri", pushedAuthorizationRequestAuthentication.getRequestUri());
pushedAuthorizationResponse.put(OAuth2ParameterNames.REQUEST_URI,
pushedAuthorizationRequestAuthentication.getRequestUri());
long expiresIn = ChronoUnit.SECONDS.between(Instant.now(),
pushedAuthorizationRequestAuthentication.getRequestUriExpiresAt());
pushedAuthorizationResponse.put(OAuth2ParameterNames.EXPIRES_IN, expiresIn);

8
oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2AuthorizationCodeRequestAuthenticationConverter.java
View File

@@ -89,14 +89,14 @@ public final class OAuth2AuthorizationCodeRequestAuthenticationConverter impleme
// request_uri (OPTIONAL) - provided if an authorization request was previously
// pushed (RFC 9126 OAuth 2.0 Pushed Authorization Requests)
String requestUri = parameters.getFirst("request_uri");
String requestUri = parameters.getFirst(OAuth2ParameterNames.REQUEST_URI);
if (StringUtils.hasText(requestUri)) {
if (pushedAuthorizationRequest) {
throwError(OAuth2ErrorCodes.INVALID_REQUEST, "request_uri");
throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.REQUEST_URI);
}
else if (parameters.get("request_uri").size() != 1) {
else if (parameters.get(OAuth2ParameterNames.REQUEST_URI).size() != 1) {
// Authorization Request
throwError(OAuth2ErrorCodes.INVALID_REQUEST, "request_uri");
throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.REQUEST_URI);
}
}

16
oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProviderTests.java
View File

@@ -617,7 +617,7 @@ public class OAuth2AuthorizationCodeRequestAuthenticationProviderTests {
OAuth2PushedAuthorizationRequestUri pushedAuthorizationRequestUri = OAuth2PushedAuthorizationRequestUri
.create();
Map<String, Object> additionalParameters = new HashMap<>();
additionalParameters.put("request_uri", pushedAuthorizationRequestUri.getRequestUri());
additionalParameters.put(OAuth2ParameterNames.REQUEST_URI, pushedAuthorizationRequestUri.getRequestUri());
OAuth2Authorization authorization = TestOAuth2Authorizations
.authorization(registeredClient, additionalParameters)
.build();
@@ -643,7 +643,7 @@ public class OAuth2AuthorizationCodeRequestAuthenticationProviderTests {
OAuth2PushedAuthorizationRequestUri pushedAuthorizationRequestUri = OAuth2PushedAuthorizationRequestUri
.create();
Map<String, Object> additionalParameters = new HashMap<>();
additionalParameters.put("request_uri", pushedAuthorizationRequestUri.getRequestUri());
additionalParameters.put(OAuth2ParameterNames.REQUEST_URI, pushedAuthorizationRequestUri.getRequestUri());
OAuth2Authorization authorization = TestOAuth2Authorizations
.authorization(registeredClient, additionalParameters)
.build();
@@ -652,12 +652,12 @@ public class OAuth2AuthorizationCodeRequestAuthenticationProviderTests {
OAuth2AuthorizationCodeRequestAuthenticationToken authentication = new OAuth2AuthorizationCodeRequestAuthenticationToken(
AUTHORIZATION_URI, registeredClient.getClientId(), this.principal, null, null, null,
Collections.singletonMap("request_uri", "invalid_request_uri"));
Collections.singletonMap(OAuth2ParameterNames.REQUEST_URI, "invalid_request_uri"));
assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication))
.isInstanceOf(OAuth2AuthorizationCodeRequestAuthenticationException.class)
.satisfies((ex) -> assertAuthenticationException((OAuth2AuthorizationCodeRequestAuthenticationException) ex,
OAuth2ErrorCodes.INVALID_REQUEST, "request_uri", null));
OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.REQUEST_URI, null));
}
@Test
@@ -668,7 +668,7 @@ public class OAuth2AuthorizationCodeRequestAuthenticationProviderTests {
OAuth2PushedAuthorizationRequestUri pushedAuthorizationRequestUri = OAuth2PushedAuthorizationRequestUri
.create();
Map<String, Object> additionalParameters = new HashMap<>();
additionalParameters.put("request_uri", pushedAuthorizationRequestUri.getRequestUri());
additionalParameters.put(OAuth2ParameterNames.REQUEST_URI, pushedAuthorizationRequestUri.getRequestUri());
OAuth2Authorization authorization = TestOAuth2Authorizations
.authorization(registeredClient, additionalParameters)
.build();
@@ -692,7 +692,7 @@ public class OAuth2AuthorizationCodeRequestAuthenticationProviderTests {
OAuth2PushedAuthorizationRequestUri pushedAuthorizationRequestUri = OAuth2PushedAuthorizationRequestUri
.create(Instant.now().minusSeconds(5));
Map<String, Object> additionalParameters = new HashMap<>();
additionalParameters.put("request_uri", pushedAuthorizationRequestUri.getRequestUri());
additionalParameters.put(OAuth2ParameterNames.REQUEST_URI, pushedAuthorizationRequestUri.getRequestUri());
OAuth2Authorization authorization = TestOAuth2Authorizations
.authorization(registeredClient, additionalParameters)
.build();
@@ -706,7 +706,7 @@ public class OAuth2AuthorizationCodeRequestAuthenticationProviderTests {
assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication))
.isInstanceOf(OAuth2AuthorizationCodeRequestAuthenticationException.class)
.satisfies((ex) -> assertAuthenticationException((OAuth2AuthorizationCodeRequestAuthenticationException) ex,
OAuth2ErrorCodes.INVALID_REQUEST, "request_uri", null));
OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.REQUEST_URI, null));
verify(this.authorizationService).remove(eq(authorization));
}
@@ -774,7 +774,7 @@ public class OAuth2AuthorizationCodeRequestAuthenticationProviderTests {
assertThat(authorizationRequest.getAuthorizationUri()).isEqualTo(authentication.getAuthorizationUri());
assertThat(authorizationRequest.getClientId()).isEqualTo(registeredClient.getClientId());
String requestUri = (String) authentication.getAdditionalParameters().get("request_uri");
String requestUri = (String) authentication.getAdditionalParameters().get(OAuth2ParameterNames.REQUEST_URI);
if (!StringUtils.hasText(requestUri)) {
assertThat(authorizationRequest.getRedirectUri()).isEqualTo(authentication.getRedirectUri());
assertThat(authorizationRequest.getScopes()).isEqualTo(authentication.getScopes());

2
oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2AuthorizationCodeGrantTests.java
View File

@@ -1037,7 +1037,7 @@ public class OAuth2AuthorizationCodeGrantTests {
mvcResult = this.mvc
.perform(get(DEFAULT_AUTHORIZATION_ENDPOINT_URI)
.queryParam(OAuth2ParameterNames.CLIENT_ID, registeredClient.getClientId())
.queryParam("request_uri", requestUri)
.queryParam(OAuth2ParameterNames.REQUEST_URI, requestUri)
.with(user("user")))
.andExpect(status().is3xxRedirection())
.andReturn();

6
oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationEndpointFilterTests.java
View File

@@ -190,9 +190,9 @@ public class OAuth2AuthorizationEndpointFilterTests {
@Test
public void doFilterWhenAuthorizationRequestMultipleRequestUriThenInvalidRequestError() throws Exception {
doFilterWhenAuthorizationRequestInvalidParameterThenError(TestRegisteredClients.registeredClient().build(),
"request_uri", OAuth2ErrorCodes.INVALID_REQUEST, (request) -> {
request.addParameter("request_uri", "request_uri");
request.addParameter("request_uri", "request_uri_2");
OAuth2ParameterNames.REQUEST_URI, OAuth2ErrorCodes.INVALID_REQUEST, (request) -> {
request.addParameter(OAuth2ParameterNames.REQUEST_URI, OAuth2ParameterNames.REQUEST_URI);
request.addParameter(OAuth2ParameterNames.REQUEST_URI, "request_uri_2");
updateQueryString(request);
});
}

27
oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2PushedAuthorizationRequestEndpointFilterTests.java
View File

@@ -170,8 +170,9 @@ public class OAuth2PushedAuthorizationRequestEndpointFilterTests {
@Test
public void doFilterWhenPushedAuthorizationRequestIncludesRequestUriThenInvalidRequestError() throws Exception {
doFilterWhenPushedAuthorizationRequestInvalidParameterThenError(
TestRegisteredClients.registeredClient().build(), "request_uri", OAuth2ErrorCodes.INVALID_REQUEST,
(request) -> request.addParameter("request_uri", "request_uri"));
TestRegisteredClients.registeredClient().build(), OAuth2ParameterNames.REQUEST_URI,
OAuth2ErrorCodes.INVALID_REQUEST,
(request) -> request.addParameter(OAuth2ParameterNames.REQUEST_URI, OAuth2ParameterNames.REQUEST_URI));
}
@Test
@@ -292,9 +293,9 @@ public class OAuth2PushedAuthorizationRequestEndpointFilterTests {
public void doFilterWhenCustomAuthenticationConverterThenUsed() throws Exception {
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
OAuth2PushedAuthorizationRequestAuthenticationToken pushedAuthorizationRequestAuthenticationResult = new OAuth2PushedAuthorizationRequestAuthenticationToken(
AUTHORIZATION_URI, registeredClient.getClientId(), this.clientPrincipal, "request_uri",
Instant.now().plusSeconds(30), registeredClient.getRedirectUris().iterator().next(), STATE,
registeredClient.getScopes());
AUTHORIZATION_URI, registeredClient.getClientId(), this.clientPrincipal,
OAuth2ParameterNames.REQUEST_URI, Instant.now().plusSeconds(30),
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes());
AuthenticationConverter authenticationConverter = mock(AuthenticationConverter.class);
given(authenticationConverter.convert(any())).willReturn(pushedAuthorizationRequestAuthenticationResult);
@@ -317,9 +318,9 @@ public class OAuth2PushedAuthorizationRequestEndpointFilterTests {
public void doFilterWhenCustomAuthenticationSuccessHandlerThenUsed() throws Exception {
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
OAuth2PushedAuthorizationRequestAuthenticationToken pushedAuthorizationRequestAuthenticationResult = new OAuth2PushedAuthorizationRequestAuthenticationToken(
AUTHORIZATION_URI, registeredClient.getClientId(), this.clientPrincipal, "request_uri",
Instant.now().plusSeconds(30), registeredClient.getRedirectUris().iterator().next(), STATE,
registeredClient.getScopes());
AUTHORIZATION_URI, registeredClient.getClientId(), this.clientPrincipal,
OAuth2ParameterNames.REQUEST_URI, Instant.now().plusSeconds(30),
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes());
given(this.authenticationManager.authenticate(any()))
.willReturn(pushedAuthorizationRequestAuthenticationResult);
@@ -371,9 +372,9 @@ public class OAuth2PushedAuthorizationRequestEndpointFilterTests {
this.filter.setAuthenticationDetailsSource(authenticationDetailsSource);
OAuth2PushedAuthorizationRequestAuthenticationToken pushedAuthorizationRequestAuthenticationResult = new OAuth2PushedAuthorizationRequestAuthenticationToken(
AUTHORIZATION_URI, registeredClient.getClientId(), this.clientPrincipal, "request_uri",
Instant.now().plusSeconds(30), registeredClient.getRedirectUris().iterator().next(), STATE,
registeredClient.getScopes());
AUTHORIZATION_URI, registeredClient.getClientId(), this.clientPrincipal,
OAuth2ParameterNames.REQUEST_URI, Instant.now().plusSeconds(30),
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes());
given(this.authenticationManager.authenticate(any()))
.willReturn(pushedAuthorizationRequestAuthenticationResult);
@@ -390,7 +391,7 @@ public class OAuth2PushedAuthorizationRequestEndpointFilterTests {
@Test
public void doFilterWhenPushedAuthorizationRequestAuthenticatedThenPushedAuthorizationResponse() throws Exception {
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
String requestUri = "request_uri";
String requestUri = OAuth2ParameterNames.REQUEST_URI;
Instant requestUriExpiresAt = Instant.now().plusSeconds(30);
OAuth2PushedAuthorizationRequestAuthenticationToken pushedAuthorizationRequestAuthenticationResult = new OAuth2PushedAuthorizationRequestAuthenticationToken(
AUTHORIZATION_URI, registeredClient.getClientId(), this.clientPrincipal, requestUri,
@@ -424,7 +425,7 @@ public class OAuth2PushedAuthorizationRequestEndpointFilterTests {
.isEqualTo(new String[] { "custom-value-1", "custom-value-2" });
assertThat(response.getStatus()).isEqualTo(HttpStatus.CREATED.value());
Map<String, Object> responseParameters = readPushedAuthorizationResponse(response);
assertThat(responseParameters.get("request_uri")).isEqualTo(requestUri);
assertThat(responseParameters.get(OAuth2ParameterNames.REQUEST_URI)).isEqualTo(requestUri);
Instant requestUriExpiry = Instant.now()
.plusSeconds(Long.parseLong(String.valueOf(responseParameters.get("expires_in"))));
assertThat(requestUriExpiry).isBetween(requestUriExpiresAt.minusSeconds(1), requestUriExpiresAt.plusSeconds(1));