From 4cc5705ae5c3b9770d4b7409fd4bb49c61f4b53d Mon Sep 17 00:00:00 2001 From: Joe Grandja Date: Wed, 2 May 2018 11:07:26 -0400 Subject: [PATCH] HttpSessionOAuth2AuthorizationRequestRepository removes empty Map from session Fixes gh-5263 --- ...nOAuth2AuthorizationRequestRepository.java | 6 ++++- ...h2AuthorizationRequestRepositoryTests.java | 22 +++++++++++++++++++ 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/HttpSessionOAuth2AuthorizationRequestRepository.java b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/HttpSessionOAuth2AuthorizationRequestRepository.java index 2cc85b33cd..09e1b6bd71 100644 --- a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/HttpSessionOAuth2AuthorizationRequestRepository.java +++ b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/HttpSessionOAuth2AuthorizationRequestRepository.java @@ -77,7 +77,11 @@ public final class HttpSessionOAuth2AuthorizationRequestRepository implements Au } Map authorizationRequests = this.getAuthorizationRequests(request); OAuth2AuthorizationRequest originalRequest = authorizationRequests.remove(stateParameter); - request.getSession().setAttribute(this.sessionAttributeName, authorizationRequests); + if (!authorizationRequests.isEmpty()) { + request.getSession().setAttribute(this.sessionAttributeName, authorizationRequests); + } else { + request.getSession().removeAttribute(this.sessionAttributeName); + } return originalRequest; } diff --git a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/web/HttpSessionOAuth2AuthorizationRequestRepositoryTests.java b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/web/HttpSessionOAuth2AuthorizationRequestRepositoryTests.java index 081831eba8..3bb2ed3244 100644 --- a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/web/HttpSessionOAuth2AuthorizationRequestRepositoryTests.java +++ b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/web/HttpSessionOAuth2AuthorizationRequestRepositoryTests.java @@ -242,6 +242,28 @@ public class HttpSessionOAuth2AuthorizationRequestRepositoryTests { assertThat(loadedAuthorizationRequest).isNull(); } + // gh-5263 + @Test + public void removeAuthorizationRequestWhenSavedThenRemovedFromSession() { + MockHttpServletRequest request = new MockHttpServletRequest(); + MockHttpServletResponse response = new MockHttpServletResponse(); + + OAuth2AuthorizationRequest authorizationRequest = createAuthorizationRequest().build(); + + this.authorizationRequestRepository.saveAuthorizationRequest( + authorizationRequest, request, response); + + request.addParameter(OAuth2ParameterNames.STATE, authorizationRequest.getState()); + OAuth2AuthorizationRequest removedAuthorizationRequest = + this.authorizationRequestRepository.removeAuthorizationRequest(request); + + String sessionAttributeName = HttpSessionOAuth2AuthorizationRequestRepository.class.getName() + + ".AUTHORIZATION_REQUEST"; + + assertThat(removedAuthorizationRequest).isNotNull(); + assertThat(request.getSession().getAttribute(sessionAttributeName)).isNull(); + } + @Test public void removeAuthorizationRequestWhenNotSavedThenNotRemoved() { MockHttpServletRequest request = new MockHttpServletRequest();