Remove deprecated implicit authorization grant type

Closes gh-11506

oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/AuthorizationGrantType.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2021 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -28,8 +28,8 @@ import org.springframework.util.Assert;
  *
  * <p>
  * The OAuth 2.0 Authorization Framework defines four standard grant types: authorization
- * code, implicit, resource owner password credentials, and client credentials. It also
- * provides an extensibility mechanism for defining additional grant types.
+ * code, resource owner password credentials, and client credentials. It also provides an
+ * extensibility mechanism for defining additional grant types.
  *
  * @author Joe Grandja
  * @since 5.0
@@ -42,17 +42,6 @@ public final class AuthorizationGrantType implements Serializable {
 
 	public static final AuthorizationGrantType AUTHORIZATION_CODE = new AuthorizationGrantType("authorization_code");
 
-	/**
-	 * It is not recommended to use the implicit flow due to the inherent risks of
-	 * returning access tokens in an HTTP redirect without any confirmation that it has
-	 * been received by the client.
-	 *
-	 * @see <a target="_blank" href="https://oauth.net/2/grant-types/implicit/">OAuth 2.0
-	 * Implicit Grant</a>
-	 */
-	@Deprecated
-	public static final AuthorizationGrantType IMPLICIT = new AuthorizationGrantType("implicit");
-
 	public static final AuthorizationGrantType REFRESH_TOKEN = new AuthorizationGrantType("refresh_token");
 
 	public static final AuthorizationGrantType CLIENT_CREDENTIALS = new AuthorizationGrantType("client_credentials");

oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/endpoint/OAuth2AuthorizationRequest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -41,7 +41,7 @@ import org.springframework.web.util.UriUtils;
 
 /**
  * A representation of an OAuth 2.0 Authorization Request for the authorization code grant
- * type or implicit grant type.
+ * type.
  *
  * @author Joe Grandja
  * @since 5.0
@@ -50,9 +50,6 @@ import org.springframework.web.util.UriUtils;
  * @see <a target="_blank" href=
  * "https://tools.ietf.org/html/rfc6749#section-4.1.1">Section 4.1.1 Authorization Code
  * Grant Request</a>
- * @see <a target="_blank" href=
- * "https://tools.ietf.org/html/rfc6749#section-4.2.1">Section 4.2.1 Implicit Grant
- * Request</a>
  */
 public final class OAuth2AuthorizationRequest implements Serializable {
 
@@ -191,20 +188,6 @@ public final class OAuth2AuthorizationRequest implements Serializable {
 		return new Builder(AuthorizationGrantType.AUTHORIZATION_CODE);
 	}
 
-	/**
-	 * Returns a new {@link Builder}, initialized with the implicit grant type.
-	 * @return the {@link Builder}
-	 * @deprecated It is not recommended to use the implicit flow due to the inherent
-	 * risks of returning access tokens in an HTTP redirect without any confirmation that
-	 * it has been received by the client.
-	 * @see <a target="_blank" href="https://oauth.net/2/grant-types/implicit/">OAuth 2.0
-	 * Implicit Grant</a>
-	 */
-	@Deprecated
-	public static Builder implicit() {
-		return new Builder(AuthorizationGrantType.IMPLICIT);
-	}
-
 	/**
 	 * Returns a new {@link Builder}, initialized with the values from the provided
 	 * {@code authorizationRequest}.
@@ -265,9 +248,6 @@ public final class OAuth2AuthorizationRequest implements Serializable {
 			if (AuthorizationGrantType.AUTHORIZATION_CODE.equals(authorizationGrantType)) {
 				this.responseType = OAuth2AuthorizationResponseType.CODE;
 			}
-			else if (AuthorizationGrantType.IMPLICIT.equals(authorizationGrantType)) {
-				this.responseType = OAuth2AuthorizationResponseType.TOKEN;
-			}
 			this.uriBuilderFactory = new DefaultUriBuilderFactory();
 			// The supplied authorizationUri may contain encoded parameters
 			// so disable encoding in UriBuilder and instead apply encoding within this
@@ -440,9 +420,6 @@ public final class OAuth2AuthorizationRequest implements Serializable {
 		public OAuth2AuthorizationRequest build() {
 			Assert.hasText(this.authorizationUri, "authorizationUri cannot be empty");
 			Assert.hasText(this.clientId, "clientId cannot be empty");
-			if (AuthorizationGrantType.IMPLICIT.equals(this.authorizationGrantType)) {
-				Assert.hasText(this.redirectUri, "redirectUri cannot be empty");
-			}
 			OAuth2AuthorizationRequest authorizationRequest = new OAuth2AuthorizationRequest();
 			authorizationRequest.authorizationUri = this.authorizationUri;
 			authorizationRequest.authorizationGrantType = this.authorizationGrantType;

oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/endpoint/OAuth2AuthorizationResponseType.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2021 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,14 +23,12 @@ import org.springframework.util.Assert;
 
 /**
  * The {@code response_type} parameter is consumed by the authorization endpoint which is
- * used by the authorization code grant type and implicit grant type. The client sets the
- * {@code response_type} parameter with the desired grant type before initiating the
- * authorization request.
+ * used by the authorization code grant type. The client sets the {@code response_type}
+ * parameter with the desired grant type before initiating the authorization request.
  *
  * <p>
- * The {@code response_type} parameter value may be one of &quot;code&quot; for requesting
- * an authorization code or &quot;token&quot; for requesting an access token (implicit
- * grant).
+ * The {@code response_type} parameter value may be &quot;code&quot; for requesting an
+ * authorization code.
  *
  * @author Joe Grandja
  * @since 5.0
@@ -43,17 +41,6 @@ public final class OAuth2AuthorizationResponseType implements Serializable {
 
 	public static final OAuth2AuthorizationResponseType CODE = new OAuth2AuthorizationResponseType("code");
 
-	/**
-	 * It is not recommended to use the implicit flow due to the inherent risks of
-	 * returning access tokens in an HTTP redirect without any confirmation that it has
-	 * been received by the client.
-	 *
-	 * @see <a target="_blank" href="https://oauth.net/2/grant-types/implicit/">OAuth 2.0
-	 * Implicit Grant</a>
-	 */
-	@Deprecated
-	public static final OAuth2AuthorizationResponseType TOKEN = new OAuth2AuthorizationResponseType("token");
-
 	private final String value;
 
 	public OAuth2AuthorizationResponseType(String value) {

oauth2/oauth2-core/src/test/java/org/springframework/security/oauth2/core/AuthorizationGrantTypeTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2021 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -38,11 +38,6 @@ public class AuthorizationGrantTypeTests {
 		assertThat(AuthorizationGrantType.AUTHORIZATION_CODE.getValue()).isEqualTo("authorization_code");
 	}
 
-	@Test
-	public void getValueWhenImplicitGrantTypeThenReturnImplicit() {
-		assertThat(AuthorizationGrantType.IMPLICIT.getValue()).isEqualTo("implicit");
-	}
-
 	@Test
 	public void getValueWhenRefreshTokenGrantTypeThenReturnRefreshToken() {
 		assertThat(AuthorizationGrantType.REFRESH_TOKEN.getValue()).isEqualTo("refresh_token");

oauth2/oauth2-core/src/test/java/org/springframework/security/oauth2/core/endpoint/OAuth2AuthorizationRequestTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -79,20 +79,6 @@ public class OAuth2AuthorizationRequestTests {
 		// @formatter:on
 	}
 
-	@Test
-	public void buildWhenRedirectUriIsNullForImplicitThenThrowIllegalArgumentException() {
-		// @formatter:off
-		assertThatIllegalArgumentException()
-				.isThrownBy(() -> OAuth2AuthorizationRequest.implicit()
-						.authorizationUri(AUTHORIZATION_URI)
-						.clientId(CLIENT_ID)
-						.redirectUri(null)
-						.scopes(SCOPES)
-						.state(STATE).build()
-				);
-		// @formatter:on
-	}
-
 	@Test
 	public void buildWhenRedirectUriIsNullForAuthorizationCodeThenDoesNotThrowAnyException() {
 		// @formatter:off
@@ -146,21 +132,6 @@ public class OAuth2AuthorizationRequestTests {
 		// @formatter:on
 	}
 
-	@Test
-	public void buildWhenImplicitThenGrantTypeResponseTypeIsSet() {
-		// @formatter:off
-		OAuth2AuthorizationRequest authorizationRequest = OAuth2AuthorizationRequest.implicit()
-				.authorizationUri(AUTHORIZATION_URI)
-				.clientId(CLIENT_ID)
-				.redirectUri(REDIRECT_URI)
-				.scopes(SCOPES)
-				.state(STATE)
-				.build();
-		// @formatter:on
-		assertThat(authorizationRequest.getGrantType()).isEqualTo(AuthorizationGrantType.IMPLICIT);
-		assertThat(authorizationRequest.getResponseType()).isEqualTo(OAuth2AuthorizationResponseType.TOKEN);
-	}
-
 	@Test
 	public void buildWhenAuthorizationCodeThenGrantTypeResponseTypeIsSet() {
 		// @formatter:off
@@ -208,22 +179,6 @@ public class OAuth2AuthorizationRequestTests {
 		assertThat(authorizationRequest.getAuthorizationRequestUri()).isEqualTo(AUTHORIZATION_URI);
 	}
 
-	@Test
-	public void buildWhenScopesMultiThenSeparatedByEncodedSpace() {
-		// @formatter:off
-		OAuth2AuthorizationRequest authorizationRequest = OAuth2AuthorizationRequest.implicit()
-				.authorizationUri(AUTHORIZATION_URI)
-				.clientId(CLIENT_ID)
-				.redirectUri(REDIRECT_URI)
-				.scopes(SCOPES)
-				.state(STATE)
-				.build();
-		// @formatter:on
-		assertThat(authorizationRequest.getAuthorizationRequestUri())
-				.isEqualTo("https://provider.com/oauth2/authorize?" + "response_type=token&client_id=client-id&"
-						+ "scope=scope1%20scope2&state=state&" + "redirect_uri=https://example.com");
-	}
-
 	@Test
 	public void buildWhenAuthorizationRequestUriSetThenOverridesDefault() {
 		// @formatter:off

oauth2/oauth2-core/src/test/java/org/springframework/security/oauth2/core/endpoint/OAuth2AuthorizationResponseTypeTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2017 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -32,9 +32,4 @@ public class OAuth2AuthorizationResponseTypeTests {
 		assertThat(OAuth2AuthorizationResponseType.CODE.getValue()).isEqualTo("code");
 	}
 
-	@Test
-	public void getValueWhenResponseTypeTokenThenReturnToken() {
-		assertThat(OAuth2AuthorizationResponseType.TOKEN.getValue()).isEqualTo("token");
-	}
-
 }