Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove deprecated implicit authorization grant type

Browse Source 
Closes gh-11506
This commit is contained in:
Joe Grandja
2022-07-14 05:42:16 -04:00
parent 9608eaa138
commit a3326fc0ee
20 changed files with 31 additions and 457 deletions
Download Patch File Download Diff File Expand all files Collapse all files

105
config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/ImplicitGrantConfigurer.java
View File

@@ -1,105 +0,0 @@
/*
* Copyright 2002-2020 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.config.annotation.web.configurers.oauth2.client;
import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter;
import org.springframework.util.Assert;
/**
* An {@link AbstractHttpConfigurer} for the OAuth 2.0 Implicit Grant type.
*
* <h2>Security Filters</h2>
*
* The following {@code Filter}'s are populated:
*
* <ul>
* <li>{@link OAuth2AuthorizationRequestRedirectFilter}</li>
* </ul>
*
* <h2>Shared Objects Created</h2>
*
* The following shared objects are populated:
*
* <ul>
* <li>{@link ClientRegistrationRepository} (required)</li>
* </ul>
*
* <h2>Shared Objects Used</h2>
*
* The following shared objects are used:
*
* <ul>
* <li>{@link ClientRegistrationRepository}</li>
* </ul>
*
* @author Joe Grandja
* @since 5.0
* @see OAuth2AuthorizationRequestRedirectFilter
* @see ClientRegistrationRepository
* @deprecated It is not recommended to use the implicit flow due to the inherent risks of
* returning access tokens in an HTTP redirect without any confirmation that it has been
* received by the client. See reference
* <a target="_blank" href="https://oauth.net/2/grant-types/implicit/">OAuth 2.0 Implicit
* Grant</a>.
*/
@Deprecated
public final class ImplicitGrantConfigurer<B extends HttpSecurityBuilder<B>>
extends AbstractHttpConfigurer<ImplicitGrantConfigurer<B>, B> {
private String authorizationRequestBaseUri;
/**
* Sets the base {@code URI} used for authorization requests.
* @param authorizationRequestBaseUri the base {@code URI} used for authorization
* requests
* @return the {@link ImplicitGrantConfigurer} for further configuration
*/
public ImplicitGrantConfigurer<B> authorizationRequestBaseUri(String authorizationRequestBaseUri) {
Assert.hasText(authorizationRequestBaseUri, "authorizationRequestBaseUri cannot be empty");
this.authorizationRequestBaseUri = authorizationRequestBaseUri;
return this;
}
/**
* Sets the repository of client registrations.
* @param clientRegistrationRepository the repository of client registrations
* @return the {@link ImplicitGrantConfigurer} for further configuration
*/
public ImplicitGrantConfigurer<B> clientRegistrationRepository(
ClientRegistrationRepository clientRegistrationRepository) {
Assert.notNull(clientRegistrationRepository, "clientRegistrationRepository cannot be null");
this.getBuilder().setSharedObject(ClientRegistrationRepository.class, clientRegistrationRepository);
return this;
}
@Override
public void configure(B http) {
OAuth2AuthorizationRequestRedirectFilter authorizationRequestFilter = new OAuth2AuthorizationRequestRedirectFilter(
OAuth2ClientConfigurerUtils.getClientRegistrationRepository(this.getBuilder()),
this.getAuthorizationRequestBaseUri());
http.addFilter(this.postProcess(authorizationRequestFilter));
}
private String getAuthorizationRequestBaseUri() {
return (this.authorizationRequestBaseUri != null) ? this.authorizationRequestBaseUri
: OAuth2AuthorizationRequestRedirectFilter.DEFAULT_AUTHORIZATION_REQUEST_BASE_URI;
}
}

4
config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc
View File

@@ -569,8 +569,8 @@ client-registration.attlist &=
## The method used to authenticate the client with the provider. The supported values are client_secret_basic, client_secret_post and none (public clients).
attribute client-authentication-method {"client_secret_basic" | "basic" | "client_secret_post" | "post" | "none"}?
client-registration.attlist &=
## The OAuth 2.0 Authorization Framework defines four Authorization Grant types. The supported values are authorization_code, client_credentials, password and implicit.
attribute authorization-grant-type {"authorization_code" | "client_credentials" | "password" | "implicit"}?
## The OAuth 2.0 Authorization Framework defines four Authorization Grant types. The supported values are authorization_code, client_credentials and password.
attribute authorization-grant-type {"authorization_code" | "client_credentials" | "password"}?
client-registration.attlist &=
## The client’s registered redirect URI that the Authorization Server redirects the end-user’s user-agent to after the end-user has authenticated and authorized access to the client.
attribute redirect-uri {xsd:token}?

3
config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd
View File

@@ -1792,7 +1792,7 @@
<xs:attribute name="authorization-grant-type">
<xs:annotation>
<xs:documentation>The OAuth 2.0 Authorization Framework defines four Authorization Grant types. The
supported values are authorization_code, client_credentials, password and implicit.
supported values are authorization_code, client_credentials and password.
</xs:documentation>
</xs:annotation>
<xs:simpleType>
@@ -1800,7 +1800,6 @@
<xs:enumeration value="authorization_code"/>
<xs:enumeration value="client_credentials"/>
<xs:enumeration value="password"/>
<xs:enumeration value="implicit"/>
</xs:restriction>
</xs:simpleType>
</xs:attribute>