Spring/spring-authorization-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix inconsistent state when authorization consent is denied

Browse Source 
Closes gh-595
This commit is contained in:
Joe Grandja
2022-01-26 10:23:06 -05:00
parent 58bac49f97
commit 4fbe06d121
2 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2020-2021 the original author or authors.
* Copyright 2020-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -577,8 +577,6 @@ public final class OAuth2AuthorizationCodeRequestAuthenticationProvider implemen
.scopes(authorizationCodeRequestAuthentication.getScopes())
.state(authorizationCodeRequestAuthentication.getState())
.additionalParameters(authorizationCodeRequestAuthentication.getAdditionalParameters())
.consentRequired(authorizationCodeRequestAuthentication.isConsentRequired())
.consent(authorizationCodeRequestAuthentication.isConsent())
.authorizationCode(authorizationCodeRequestAuthentication.getAuthorizationCode());
}

8
oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProviderTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2020-2021 the original author or authors.
* Copyright 2020-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -1013,6 +1013,12 @@ public class OAuth2AuthorizationCodeRequestAuthenticationProviderTests {
OAuth2AuthorizationCodeRequestAuthenticationToken authorizationCodeRequestAuthentication =
authenticationException.getAuthorizationCodeRequestAuthentication();
assertThat(authorizationCodeRequestAuthentication.getRedirectUri()).isEqualTo(redirectUri);
// gh-595
if (OAuth2ErrorCodes.ACCESS_DENIED.equals(errorCode)) {
assertThat(authorizationCodeRequestAuthentication.isConsent()).isFalse();
assertThat(authorizationCodeRequestAuthentication.isConsentRequired()).isFalse();
}
}
private static OAuth2AuthorizationCodeRequestAuthenticationToken.Builder authorizationCodeRequestAuthentication(