Spring/spring-authorization-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch '1.3.x'

Browse Source
This commit is contained in:
Joe Grandja
2024-10-04 06:16:39 -04:00
parent 2c7975485f 68300d4cf9
commit b1dcb87422
2 changed files with 42 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2DeviceAuthorizationEndpointFilter.java
View File

@@ -46,6 +46,7 @@ import org.springframework.security.web.authentication.AuthenticationConverter;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.security.web.util.RedirectUrlBuilder;
import org.springframework.security.web.util.UrlUtils;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher;
@@ -220,9 +221,7 @@ public final class OAuth2DeviceAuthorizationEndpointFilter extends OncePerReques
OAuth2UserCode userCode = deviceAuthorizationRequestAuthentication.getUserCode();
// Generate the fully-qualified verification URI
UriComponentsBuilder uriComponentsBuilder = UriComponentsBuilder
.fromHttpUrl(UrlUtils.buildFullRequestUrl(request))
.replacePath(this.verificationUri);
UriComponentsBuilder uriComponentsBuilder = UriComponentsBuilder.fromUriString(resolveVerificationUri(request));
String verificationUri = uriComponentsBuilder.build().toUriString();
// @formatter:off
String verificationUriComplete = uriComponentsBuilder
@@ -242,4 +241,17 @@ public final class OAuth2DeviceAuthorizationEndpointFilter extends OncePerReques
this.deviceAuthorizationHttpResponseConverter.write(deviceAuthorizationResponse, null, httpResponse);
}
private String resolveVerificationUri(HttpServletRequest request) {
if (UrlUtils.isAbsoluteUrl(this.verificationUri)) {
return this.verificationUri;
}
RedirectUrlBuilder urlBuilder = new RedirectUrlBuilder();
urlBuilder.setScheme(request.getScheme());
urlBuilder.setServerName(request.getServerName());
urlBuilder.setPort(request.getServerPort());
urlBuilder.setContextPath(request.getContextPath());
urlBuilder.setPathInfo(this.verificationUri);
return urlBuilder.getUrl();
}
}

27
oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2DeviceAuthorizationEndpointFilterTests.java
View File

@@ -241,6 +241,33 @@ public class OAuth2DeviceAuthorizationEndpointFilterTests {
assertThat(deviceCode.getExpiresAt()).isAfter(deviceCode.getIssuedAt());
}
// gh-1714
@Test
public void doFilterWhenDeviceAuthorizationRequestWithContextPathThenVerificationUriIncludesContextPath()
throws Exception {
Authentication authenticationResult = createAuthentication();
given(this.authenticationManager.authenticate(any(Authentication.class))).willReturn(authenticationResult);
Authentication clientPrincipal = (Authentication) authenticationResult.getPrincipal();
mockSecurityContext(clientPrincipal);
MockHttpServletRequest request = createRequest();
request.setContextPath("/contextPath");
MockHttpServletResponse response = new MockHttpServletResponse();
FilterChain filterChain = mock(FilterChain.class);
this.filter.doFilter(request, response, filterChain);
assertThat(response.getStatus()).isEqualTo(HttpStatus.OK.value());
verify(this.authenticationManager).authenticate(any(OAuth2DeviceAuthorizationRequestAuthenticationToken.class));
verifyNoInteractions(filterChain);
OAuth2DeviceAuthorizationResponse deviceAuthorizationResponse = readDeviceAuthorizationResponse(response);
String verificationUri = ISSUER_URI + "/contextPath" + VERIFICATION_URI;
assertThat(deviceAuthorizationResponse.getVerificationUri()).isEqualTo(verificationUri);
assertThat(deviceAuthorizationResponse.getVerificationUriComplete())
.isEqualTo("%s?%s=%s".formatted(verificationUri, OAuth2ParameterNames.USER_CODE, USER_CODE));
}
@Test
public void doFilterWhenInvalidRequestErrorThenBadRequest() throws Exception {
AuthenticationConverter authenticationConverter = mock(AuthenticationConverter.class);