Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use param matching for Authorization Response

Browse Source 
Fixes gh-4576
This commit is contained in:
Joe Grandja
2017-09-26 15:24:08 -04:00
parent d191bcc8ac
commit 9a8ddebc94
7 changed files with 58 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/endpoint/AuthorizationRequestAttributes.java
View File

@@ -21,7 +21,9 @@ import org.springframework.util.CollectionUtils;
import java.io.Serializable;
import java.util.Collections;
import java.util.LinkedHashMap;
import java.util.LinkedHashSet;
import java.util.Map;
import java.util.Set;
/**
@@ -43,6 +45,7 @@ public final class AuthorizationRequestAttributes implements Serializable {
private String redirectUri;
private Set<String> scope;
private String state;
private Map<String,Object> additionalParameters;
private AuthorizationRequestAttributes() {
}
@@ -75,6 +78,10 @@ public final class AuthorizationRequestAttributes implements Serializable {
return this.state;
}
public Map<String, Object> getAdditionalParameters() {
return this.additionalParameters;
}
public static Builder withAuthorizationCode() {
return new Builder(AuthorizationGrantType.AUTHORIZATION_CODE);
}
@@ -107,8 +114,7 @@ public final class AuthorizationRequestAttributes implements Serializable {
}
public Builder scope(Set<String> scope) {
this.authorizationRequest.scope = Collections.unmodifiableSet(
CollectionUtils.isEmpty(scope) ? Collections.emptySet() : new LinkedHashSet<>(scope));
this.authorizationRequest.scope = scope;
return this;
}
@@ -117,9 +123,20 @@ public final class AuthorizationRequestAttributes implements Serializable {
return this;
}
public Builder additionalParameters(Map<String,Object> additionalParameters) {
this.authorizationRequest.additionalParameters = additionalParameters;
return this;
}
public AuthorizationRequestAttributes build() {
Assert.hasText(this.authorizationRequest.clientId, "clientId cannot be empty");
Assert.hasText(this.authorizationRequest.authorizeUri, "authorizeUri cannot be empty");
this.authorizationRequest.scope = Collections.unmodifiableSet(
CollectionUtils.isEmpty(this.authorizationRequest.scope) ?
Collections.emptySet() : new LinkedHashSet<>(this.authorizationRequest.scope));
this.authorizationRequest.additionalParameters = Collections.unmodifiableMap(
CollectionUtils.isEmpty(this.authorizationRequest.additionalParameters) ?
Collections.emptyMap() : new LinkedHashMap<>(this.authorizationRequest.additionalParameters));
return this.authorizationRequest;
}
}

4
oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/endpoint/OAuth2Parameter.java
View File

@@ -16,7 +16,7 @@
package org.springframework.security.oauth2.core.endpoint;
/**
* Standard parameters defined in the OAuth Parameters Registry
* Standard and additional (custom) parameters defined in the OAuth Parameters Registry
* and used by the authorization endpoint and token endpoint.
*
* @author Joe Grandja
@@ -43,4 +43,6 @@ public interface OAuth2Parameter {
String ERROR_URI = "error_uri";
String REGISTRATION_ID = "registration_id"; // Non-standard additional parameter
}