diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/endpoint/OAuth2ParameterNames2.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/endpoint/OAuth2ParameterNames2.java deleted file mode 100644 index e11a6a8e..00000000 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/endpoint/OAuth2ParameterNames2.java +++ /dev/null @@ -1,32 +0,0 @@ -/* - * Copyright 2020 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package org.springframework.security.oauth2.core.endpoint; - -/** - * TODO - * This class is temporary and will be removed after upgrading to Spring Security 5.5.0 GA. - * - * @author Joe Grandja - * @since 0.0.3 - * @see Issue gh-9183 - */ -public interface OAuth2ParameterNames2 extends OAuth2ParameterNames { - - String TOKEN = "token"; - - String TOKEN_TYPE_HINT = "token_type_hint"; - -} diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenIntrospectionEndpointFilter.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenIntrospectionEndpointFilter.java index 7ff3de19..53baae3c 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenIntrospectionEndpointFilter.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenIntrospectionEndpointFilter.java @@ -36,7 +36,7 @@ import org.springframework.security.oauth2.core.OAuth2AuthenticationException; import org.springframework.security.oauth2.core.OAuth2Error; import org.springframework.security.oauth2.core.OAuth2ErrorCodes; import org.springframework.security.oauth2.core.OAuth2TokenIntrospection; -import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames2; +import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames; import org.springframework.security.oauth2.core.http.converter.OAuth2ErrorHttpMessageConverter; import org.springframework.security.oauth2.core.http.converter.OAuth2TokenIntrospectionHttpMessageConverter; import org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenIntrospectionAuthenticationProvider; @@ -148,25 +148,25 @@ public final class OAuth2TokenIntrospectionEndpointFilter extends OncePerRequest MultiValueMap parameters = OAuth2EndpointUtils.getParameters(request); // token (REQUIRED) - String token = parameters.getFirst(OAuth2ParameterNames2.TOKEN); + String token = parameters.getFirst(OAuth2ParameterNames.TOKEN); if (!StringUtils.hasText(token) || - parameters.get(OAuth2ParameterNames2.TOKEN).size() != 1) { - throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames2.TOKEN); + parameters.get(OAuth2ParameterNames.TOKEN).size() != 1) { + throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.TOKEN); } // token_type_hint (OPTIONAL) - String tokenTypeHint = parameters.getFirst(OAuth2ParameterNames2.TOKEN_TYPE_HINT); + String tokenTypeHint = parameters.getFirst(OAuth2ParameterNames.TOKEN_TYPE_HINT); if (StringUtils.hasText(tokenTypeHint) && - parameters.get(OAuth2ParameterNames2.TOKEN_TYPE_HINT).size() != 1) { - throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames2.TOKEN_TYPE_HINT); + parameters.get(OAuth2ParameterNames.TOKEN_TYPE_HINT).size() != 1) { + throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.TOKEN_TYPE_HINT); } // @formatter:off Map additionalParameters = parameters .entrySet() .stream() - .filter(e -> !e.getKey().equals(OAuth2ParameterNames2.TOKEN) && - !e.getKey().equals(OAuth2ParameterNames2.TOKEN_TYPE_HINT)) + .filter(e -> !e.getKey().equals(OAuth2ParameterNames.TOKEN) && + !e.getKey().equals(OAuth2ParameterNames.TOKEN_TYPE_HINT)) .collect(Collectors.toMap(Map.Entry::getKey, e -> e.getValue().get(0))); // @formatter:on diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenRevocationEndpointFilter.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenRevocationEndpointFilter.java index df9a2399..cbf221a4 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenRevocationEndpointFilter.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenRevocationEndpointFilter.java @@ -15,6 +15,13 @@ */ package org.springframework.security.oauth2.server.authorization.web; +import java.io.IOException; + +import javax.servlet.FilterChain; +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + import org.springframework.core.convert.converter.Converter; import org.springframework.http.HttpMethod; import org.springframework.http.HttpStatus; @@ -26,7 +33,7 @@ import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.oauth2.core.OAuth2AuthenticationException; import org.springframework.security.oauth2.core.OAuth2Error; import org.springframework.security.oauth2.core.OAuth2ErrorCodes; -import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames2; +import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames; import org.springframework.security.oauth2.core.http.converter.OAuth2ErrorHttpMessageConverter; import org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenRevocationAuthenticationProvider; import org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenRevocationAuthenticationToken; @@ -37,12 +44,6 @@ import org.springframework.util.MultiValueMap; import org.springframework.util.StringUtils; import org.springframework.web.filter.OncePerRequestFilter; -import javax.servlet.FilterChain; -import javax.servlet.ServletException; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import java.io.IOException; - /** * A {@code Filter} for the OAuth 2.0 Token Revocation endpoint. * @@ -131,17 +132,17 @@ public final class OAuth2TokenRevocationEndpointFilter extends OncePerRequestFil MultiValueMap parameters = OAuth2EndpointUtils.getParameters(request); // token (REQUIRED) - String token = parameters.getFirst(OAuth2ParameterNames2.TOKEN); + String token = parameters.getFirst(OAuth2ParameterNames.TOKEN); if (!StringUtils.hasText(token) || - parameters.get(OAuth2ParameterNames2.TOKEN).size() != 1) { - throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames2.TOKEN); + parameters.get(OAuth2ParameterNames.TOKEN).size() != 1) { + throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.TOKEN); } // token_type_hint (OPTIONAL) - String tokenTypeHint = parameters.getFirst(OAuth2ParameterNames2.TOKEN_TYPE_HINT); + String tokenTypeHint = parameters.getFirst(OAuth2ParameterNames.TOKEN_TYPE_HINT); if (StringUtils.hasText(tokenTypeHint) && - parameters.get(OAuth2ParameterNames2.TOKEN_TYPE_HINT).size() != 1) { - throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames2.TOKEN_TYPE_HINT); + parameters.get(OAuth2ParameterNames.TOKEN_TYPE_HINT).size() != 1) { + throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.TOKEN_TYPE_HINT); } return new OAuth2TokenRevocationAuthenticationToken(token, clientPrincipal, tokenTypeHint); diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2TokenIntrospectionTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2TokenIntrospectionTests.java index 330c43b7..d08df494 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2TokenIntrospectionTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2TokenIntrospectionTests.java @@ -52,7 +52,7 @@ import org.springframework.security.oauth2.core.OAuth2AccessToken; import org.springframework.security.oauth2.core.OAuth2RefreshToken; import org.springframework.security.oauth2.core.OAuth2TokenIntrospection; import org.springframework.security.oauth2.core.OAuth2TokenType; -import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames2; +import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames; import org.springframework.security.oauth2.core.http.converter.OAuth2TokenIntrospectionHttpMessageConverter; import org.springframework.security.oauth2.jose.TestJwks; import org.springframework.security.oauth2.jwt.JwtClaimsSet; @@ -219,8 +219,8 @@ public class OAuth2TokenIntrospectionTests { private static MultiValueMap getTokenIntrospectionRequestParameters(AbstractOAuth2Token token, OAuth2TokenType tokenType) { MultiValueMap parameters = new LinkedMultiValueMap<>(); - parameters.set(OAuth2ParameterNames2.TOKEN, token.getTokenValue()); - parameters.set(OAuth2ParameterNames2.TOKEN_TYPE_HINT, tokenType.getValue()); + parameters.set(OAuth2ParameterNames.TOKEN, token.getTokenValue()); + parameters.set(OAuth2ParameterNames.TOKEN_TYPE_HINT, tokenType.getValue()); return parameters; } diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2TokenRevocationTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2TokenRevocationTests.java index cebb9ccb..179426d2 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2TokenRevocationTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2TokenRevocationTests.java @@ -47,7 +47,7 @@ import org.springframework.security.oauth2.core.AbstractOAuth2Token; import org.springframework.security.oauth2.core.OAuth2AccessToken; import org.springframework.security.oauth2.core.OAuth2RefreshToken; import org.springframework.security.oauth2.core.OAuth2TokenType; -import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames2; +import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames; import org.springframework.security.oauth2.jose.TestJwks; import org.springframework.security.oauth2.server.authorization.JdbcOAuth2AuthorizationService; import org.springframework.security.oauth2.server.authorization.OAuth2Authorization; @@ -181,8 +181,8 @@ public class OAuth2TokenRevocationTests { private static MultiValueMap getTokenRevocationRequestParameters(AbstractOAuth2Token token, OAuth2TokenType tokenType) { MultiValueMap parameters = new LinkedMultiValueMap<>(); - parameters.set(OAuth2ParameterNames2.TOKEN, token.getTokenValue()); - parameters.set(OAuth2ParameterNames2.TOKEN_TYPE_HINT, tokenType.getValue()); + parameters.set(OAuth2ParameterNames.TOKEN, token.getTokenValue()); + parameters.set(OAuth2ParameterNames.TOKEN_TYPE_HINT, tokenType.getValue()); return parameters; } diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenIntrospectionEndpointFilterTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenIntrospectionEndpointFilterTests.java index d76907c5..0b66bde1 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenIntrospectionEndpointFilterTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenIntrospectionEndpointFilterTests.java @@ -43,7 +43,7 @@ import org.springframework.security.oauth2.core.OAuth2Error; import org.springframework.security.oauth2.core.OAuth2ErrorCodes; import org.springframework.security.oauth2.core.OAuth2TokenIntrospection; import org.springframework.security.oauth2.core.OAuth2TokenType; -import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames2; +import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames; import org.springframework.security.oauth2.core.http.converter.OAuth2ErrorHttpMessageConverter; import org.springframework.security.oauth2.core.http.converter.OAuth2TokenIntrospectionHttpMessageConverter; import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientAuthenticationToken; @@ -130,30 +130,30 @@ public class OAuth2TokenIntrospectionEndpointFilterTests { public void doFilterWhenTokenIntrospectionRequestMissingTokenThenInvalidRequestError() throws Exception { MockHttpServletRequest request = createTokenIntrospectionRequest( "token", OAuth2TokenType.ACCESS_TOKEN.getValue()); - request.removeParameter(OAuth2ParameterNames2.TOKEN); + request.removeParameter(OAuth2ParameterNames.TOKEN); doFilterWhenTokenIntrospectionRequestInvalidParameterThenError( - OAuth2ParameterNames2.TOKEN, OAuth2ErrorCodes.INVALID_REQUEST, request); + OAuth2ParameterNames.TOKEN, OAuth2ErrorCodes.INVALID_REQUEST, request); } @Test public void doFilterWhenTokenIntrospectionRequestMultipleTokenThenInvalidRequestError() throws Exception { MockHttpServletRequest request = createTokenIntrospectionRequest( "token", OAuth2TokenType.ACCESS_TOKEN.getValue()); - request.addParameter(OAuth2ParameterNames2.TOKEN, "other-token"); + request.addParameter(OAuth2ParameterNames.TOKEN, "other-token"); doFilterWhenTokenIntrospectionRequestInvalidParameterThenError( - OAuth2ParameterNames2.TOKEN, OAuth2ErrorCodes.INVALID_REQUEST, request); + OAuth2ParameterNames.TOKEN, OAuth2ErrorCodes.INVALID_REQUEST, request); } @Test public void doFilterWhenTokenIntrospectionRequestMultipleTokenTypeHintThenInvalidRequestError() throws Exception { MockHttpServletRequest request = createTokenIntrospectionRequest( "token", OAuth2TokenType.ACCESS_TOKEN.getValue()); - request.addParameter(OAuth2ParameterNames2.TOKEN_TYPE_HINT, OAuth2TokenType.ACCESS_TOKEN.getValue()); + request.addParameter(OAuth2ParameterNames.TOKEN_TYPE_HINT, OAuth2TokenType.ACCESS_TOKEN.getValue()); doFilterWhenTokenIntrospectionRequestInvalidParameterThenError( - OAuth2ParameterNames2.TOKEN_TYPE_HINT, OAuth2ErrorCodes.INVALID_REQUEST, request); + OAuth2ParameterNames.TOKEN_TYPE_HINT, OAuth2ErrorCodes.INVALID_REQUEST, request); } @Test @@ -261,8 +261,8 @@ public class OAuth2TokenIntrospectionEndpointFilterTests { String requestUri = DEFAULT_TOKEN_INTROSPECTION_ENDPOINT_URI; MockHttpServletRequest request = new MockHttpServletRequest("POST", requestUri); request.setServletPath(requestUri); - request.addParameter(OAuth2ParameterNames2.TOKEN, token); - request.addParameter(OAuth2ParameterNames2.TOKEN_TYPE_HINT, tokenTypeHint); + request.addParameter(OAuth2ParameterNames.TOKEN, token); + request.addParameter(OAuth2ParameterNames.TOKEN_TYPE_HINT, tokenTypeHint); return request; } diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenRevocationEndpointFilterTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenRevocationEndpointFilterTests.java index 814b6666..00634e5f 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenRevocationEndpointFilterTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenRevocationEndpointFilterTests.java @@ -15,9 +15,20 @@ */ package org.springframework.security.oauth2.server.authorization.web; +import java.time.Duration; +import java.time.Instant; +import java.util.Arrays; +import java.util.HashSet; +import java.util.function.Consumer; + +import javax.servlet.FilterChain; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + import org.junit.After; import org.junit.Before; import org.junit.Test; + import org.springframework.http.HttpStatus; import org.springframework.http.converter.HttpMessageConverter; import org.springframework.mock.http.client.MockClientHttpResponse; @@ -30,23 +41,14 @@ import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.oauth2.core.OAuth2AccessToken; import org.springframework.security.oauth2.core.OAuth2Error; import org.springframework.security.oauth2.core.OAuth2ErrorCodes; -import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames2; -import org.springframework.security.oauth2.core.http.converter.OAuth2ErrorHttpMessageConverter; import org.springframework.security.oauth2.core.OAuth2TokenType; +import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames; +import org.springframework.security.oauth2.core.http.converter.OAuth2ErrorHttpMessageConverter; import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientAuthenticationToken; import org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenRevocationAuthenticationToken; import org.springframework.security.oauth2.server.authorization.client.RegisteredClient; import org.springframework.security.oauth2.server.authorization.client.TestRegisteredClients; -import javax.servlet.FilterChain; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import java.time.Duration; -import java.time.Instant; -import java.util.Arrays; -import java.util.HashSet; -import java.util.function.Consumer; - import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatThrownBy; import static org.mockito.ArgumentMatchers.any; @@ -122,25 +124,25 @@ public class OAuth2TokenRevocationEndpointFilterTests { @Test public void doFilterWhenTokenRevocationRequestMissingTokenThenInvalidRequestError() throws Exception { doFilterWhenTokenRevocationRequestInvalidParameterThenError( - OAuth2ParameterNames2.TOKEN, + OAuth2ParameterNames.TOKEN, OAuth2ErrorCodes.INVALID_REQUEST, - request -> request.removeParameter(OAuth2ParameterNames2.TOKEN)); + request -> request.removeParameter(OAuth2ParameterNames.TOKEN)); } @Test public void doFilterWhenTokenRevocationRequestMultipleTokenThenInvalidRequestError() throws Exception { doFilterWhenTokenRevocationRequestInvalidParameterThenError( - OAuth2ParameterNames2.TOKEN, + OAuth2ParameterNames.TOKEN, OAuth2ErrorCodes.INVALID_REQUEST, - request -> request.addParameter(OAuth2ParameterNames2.TOKEN, "token-2")); + request -> request.addParameter(OAuth2ParameterNames.TOKEN, "token-2")); } @Test public void doFilterWhenTokenRevocationRequestMultipleTokenTypeHintThenInvalidRequestError() throws Exception { doFilterWhenTokenRevocationRequestInvalidParameterThenError( - OAuth2ParameterNames2.TOKEN_TYPE_HINT, + OAuth2ParameterNames.TOKEN_TYPE_HINT, OAuth2ErrorCodes.INVALID_REQUEST, - request -> request.addParameter(OAuth2ParameterNames2.TOKEN_TYPE_HINT, OAuth2TokenType.ACCESS_TOKEN.getValue())); + request -> request.addParameter(OAuth2ParameterNames.TOKEN_TYPE_HINT, OAuth2TokenType.ACCESS_TOKEN.getValue())); } @Test @@ -202,8 +204,8 @@ public class OAuth2TokenRevocationEndpointFilterTests { MockHttpServletRequest request = new MockHttpServletRequest("POST", requestUri); request.setServletPath(requestUri); - request.addParameter(OAuth2ParameterNames2.TOKEN, "token"); - request.addParameter(OAuth2ParameterNames2.TOKEN_TYPE_HINT, OAuth2TokenType.ACCESS_TOKEN.getValue()); + request.addParameter(OAuth2ParameterNames.TOKEN, "token"); + request.addParameter(OAuth2ParameterNames.TOKEN_TYPE_HINT, OAuth2TokenType.ACCESS_TOKEN.getValue()); return request; }