Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add PKCE OAuth2 client support

Browse Source 
- Support has been added for "RFC7636: Proof Key for Code Exchange by OAuth Public Clients" (PKCE, pronounced "pixy") to mitigate against attacks targeting the interception of the authorization code
 - PkceParameterNames was added for the 3 additional parameters used by PKCE (i.e. code_verifier, code_challenge, and code_challenge_method)
 - Default code_verifier length has been set to 128 characters--the maximum allowed by RFC7636
 - ClientAuthenticationMethod.NONE was added to allow clients to request tokens without providing a client secret

Fixes gh-6446
This commit is contained in:
Stephen Doxsee
2019-02-08 10:49:41 -05:00
committed by Joe Grandja
parent 2b960b074b
commit 7739a0e91a
15 changed files with 445 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/ClientAuthenticationMethod.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2018 the original author or authors.
* Copyright 2002-2019 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -31,6 +31,12 @@ public final class ClientAuthenticationMethod implements Serializable {
private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
public static final ClientAuthenticationMethod BASIC = new ClientAuthenticationMethod("basic");
public static final ClientAuthenticationMethod POST = new ClientAuthenticationMethod("post");
/**
* @since 5.2
*/
public static final ClientAuthenticationMethod NONE = new ClientAuthenticationMethod("none");
private final String value;
/**

43
oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/endpoint/PkceParameterNames.java Normal file
View File

@@ -0,0 +1,43 @@
/*
* Copyright 2002-2019 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.oauth2.core.endpoint;
/**
* Standard parameter names defined in the OAuth Parameters Registry
* and used by the authorization endpoint and token endpoint.
*
* @author Stephen Doxsee
* @author Kevin Bolduc
* @since 5.2
* @see <a target="_blank" href="https://tools.ietf.org/html/rfc7636#section-6.1">6.1 OAuth Parameters Registry</a>
*/
public interface PkceParameterNames {
/**
* {@code code_challenge} - used in Authorization Request.
*/
String CODE_CHALLENGE = "code_challenge";
/**
* {@code code_challenge_method} - used in Authorization Request.
*/
String CODE_CHALLENGE_METHOD = "code_challenge_method";
/**
* {@code code_verifier} - used in Token Request.
*/
String CODE_VERIFIER = "code_verifier";
}

7
oauth2/oauth2-core/src/test/java/org/springframework/security/oauth2/core/ClientAuthenticationMethodTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2017 the original author or authors.
* Copyright 2002-2019 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -40,4 +40,9 @@ public class ClientAuthenticationMethodTests {
public void getValueWhenAuthenticationMethodPostThenReturnPost() {
assertThat(ClientAuthenticationMethod.POST.getValue()).isEqualTo("post");
}
@Test
public void getValueWhenAuthenticationMethodNoneThenReturnNone() {
assertThat(ClientAuthenticationMethod.NONE.getValue()).isEqualTo("none");
}
}