From 4199ab01726f6f93af204a7353fad71fbfd5c4c9 Mon Sep 17 00:00:00 2001 From: Joe Grandja Date: Wed, 15 Jun 2022 09:24:42 -0400 Subject: [PATCH] Unsupported code_challenge_method parameter should return invalid_grant Issue gh-770 --- .../authentication/CodeVerifierAuthenticator.java | 3 ++- .../PublicClientAuthenticationProviderTests.java | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/CodeVerifierAuthenticator.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/CodeVerifierAuthenticator.java index 509885de..43dfa489 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/CodeVerifierAuthenticator.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/CodeVerifierAuthenticator.java @@ -122,9 +122,10 @@ final class CodeVerifierAuthenticator { } catch (NoSuchAlgorithmException ex) { // It is unlikely that SHA-256 is not available on the server. If it is not available, // there will likely be bigger issues as well. We default to SERVER_ERROR. + throw new OAuth2AuthenticationException(OAuth2ErrorCodes.SERVER_ERROR); } } - throw new OAuth2AuthenticationException(OAuth2ErrorCodes.SERVER_ERROR); + return false; } private static void throwInvalidGrant(String parameterName) { diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/PublicClientAuthenticationProviderTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/PublicClientAuthenticationProviderTests.java index bb603b61..7f569375 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/PublicClientAuthenticationProviderTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/PublicClientAuthenticationProviderTests.java @@ -275,7 +275,7 @@ public class PublicClientAuthenticationProviderTests { .isInstanceOf(OAuth2AuthenticationException.class) .extracting(ex -> ((OAuth2AuthenticationException) ex).getError()) .extracting("errorCode") - .isEqualTo(OAuth2ErrorCodes.SERVER_ERROR); + .isEqualTo(OAuth2ErrorCodes.INVALID_GRANT); } private static Map createAuthorizationCodeTokenParameters() {