Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polish gh-17080

Browse Source
This commit is contained in:
Joe Grandja
2025-05-13 08:15:00 -04:00
parent 462e38c0e3
commit 44303d2c80
3 changed files with 14 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/authentication/DPoPAuthenticationProvider.java
View File

@@ -18,13 +18,11 @@ package org.springframework.security.oauth2.server.resource.authentication;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.PublicKey;
import java.time.Instant;
import java.util.Base64;
import java.util.Map;
import java.util.function.Function;
import com.nimbusds.jose.jwk.AsymmetricJWK;
import com.nimbusds.jose.jwk.JWK;
import org.springframework.security.authentication.AuthenticationManager;
@@ -243,12 +241,6 @@ public final class DPoPAuthenticationProvider implements AuthenticationProvider
return new OAuth2Error(OAuth2ErrorCodes.INVALID_DPOP_PROOF, reason, null);
}
private static String computeSHA256(PublicKey publicKey) throws Exception {
MessageDigest md = MessageDigest.getInstance("SHA-256");
byte[] digest = md.digest(publicKey.getEncoded());
return Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
}
}
private static final class OAuth2AccessTokenClaims implements OAuth2Token, ClaimAccessor {

5
oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/authentication/DPoPAuthenticationProviderTests.java
View File

@@ -18,7 +18,6 @@ package org.springframework.security.oauth2.server.resource.authentication;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.PublicKey;
import java.time.Instant;
import java.time.temporal.ChronoUnit;
import java.util.Base64;
@@ -37,7 +36,6 @@ import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
import org.springframework.security.oauth2.jose.TestJwks;
import org.springframework.security.oauth2.jose.TestKeys;
import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
import org.springframework.security.oauth2.jwt.JwsHeader;
import org.springframework.security.oauth2.jwt.Jwt;
@@ -293,7 +291,7 @@ public class DPoPAuthenticationProviderTests {
Map<String, Object> jktClaim = null;
if (clientJwk != null) {
try {
String sha256Thumbprint = clientJwk.computeThumbprint().toString();
String sha256Thumbprint = clientJwk.toPublicJWK().computeThumbprint().toString();
jktClaim = new HashMap<>();
jktClaim.put("jkt", sha256Thumbprint);
}
@@ -322,4 +320,5 @@ public class DPoPAuthenticationProviderTests {
byte[] digest = md.digest(value.getBytes(StandardCharsets.UTF_8));
return Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
}
}