Skip to content

Commit 2317950

Browse files
jgrandjajgrandja
committed
Use OAuth2ParameterNames.REQUEST_URI
Issue gh-1925 Closes gh-1991
1 parent 834d405 commit 2317950

File tree

7 files changed

+39
-37
lines changed

7 files changed

+39
-37
lines changed

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -124,22 +124,22 @@ public Authentication authenticate(Authentication authentication) throws Authent
124124

125125
OAuth2Authorization pushedAuthorization = null;
126126
String requestUri = (String) authorizationCodeRequestAuthentication.getAdditionalParameters()
127-
.get("request_uri");
127+
.get(OAuth2ParameterNames.REQUEST_URI);
128128
if (StringUtils.hasText(requestUri)) {
129129
OAuth2PushedAuthorizationRequestUri pushedAuthorizationRequestUri = null;
130130
try {
131131
pushedAuthorizationRequestUri = OAuth2PushedAuthorizationRequestUri.parse(requestUri);
132132
}
133133
catch (Exception ex) {
134-
throwError(OAuth2ErrorCodes.INVALID_REQUEST, "request_uri", authorizationCodeRequestAuthentication,
135-
null);
134+
throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.REQUEST_URI,
135+
authorizationCodeRequestAuthentication, null);
136136
}
137137

138138
pushedAuthorization = this.authorizationService.findByToken(pushedAuthorizationRequestUri.getState(),
139139
STATE_TOKEN_TYPE);
140140
if (pushedAuthorization == null) {
141-
throwError(OAuth2ErrorCodes.INVALID_REQUEST, "request_uri", authorizationCodeRequestAuthentication,
142-
null);
141+
throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.REQUEST_URI,
142+
authorizationCodeRequestAuthentication, null);
143143
}
144144

145145
if (this.logger.isTraceEnabled()) {
@@ -162,8 +162,8 @@ public Authentication authenticate(Authentication authentication) throws Authent
162162
.warn(LogMessage.format("Removed expired pushed authorization request for client id '%s'",
163163
authorizationRequest.getClientId()));
164164
}
165-
throwError(OAuth2ErrorCodes.INVALID_REQUEST, "request_uri", authorizationCodeRequestAuthentication,
166-
null);
165+
throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.REQUEST_URI,
166+
authorizationCodeRequestAuthentication, null);
167167
}
168168

169169
authorizationCodeRequestAuthentication = new OAuth2AuthorizationCodeRequestAuthenticationToken(

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2PushedAuthorizationRequestEndpointFilter.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,8 @@ private void sendPushedAuthorizationResponse(HttpServletRequest request, HttpSer
208208
OAuth2PushedAuthorizationRequestAuthenticationToken pushedAuthorizationRequestAuthentication = (OAuth2PushedAuthorizationRequestAuthenticationToken) authentication;
209209

210210
Map<String, Object> pushedAuthorizationResponse = new LinkedHashMap<>();
211-
pushedAuthorizationResponse.put("request_uri", pushedAuthorizationRequestAuthentication.getRequestUri());
211+
pushedAuthorizationResponse.put(OAuth2ParameterNames.REQUEST_URI,
212+
pushedAuthorizationRequestAuthentication.getRequestUri());
212213
long expiresIn = ChronoUnit.SECONDS.between(Instant.now(),
213214
pushedAuthorizationRequestAuthentication.getRequestUriExpiresAt());
214215
pushedAuthorizationResponse.put(OAuth2ParameterNames.EXPIRES_IN, expiresIn);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2AuthorizationCodeRequestAuthenticationConverter.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -89,14 +89,14 @@ public Authentication convert(HttpServletRequest request) {
8989

9090
// request_uri (OPTIONAL) - provided if an authorization request was previously
9191
// pushed (RFC 9126 OAuth 2.0 Pushed Authorization Requests)
92-
String requestUri = parameters.getFirst("request_uri");
92+
String requestUri = parameters.getFirst(OAuth2ParameterNames.REQUEST_URI);
9393
if (StringUtils.hasText(requestUri)) {
9494
if (pushedAuthorizationRequest) {
95-
throwError(OAuth2ErrorCodes.INVALID_REQUEST, "request_uri");
95+
throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.REQUEST_URI);
9696
}
97-
else if (parameters.get("request_uri").size() != 1) {
97+
else if (parameters.get(OAuth2ParameterNames.REQUEST_URI).size() != 1) {
9898
// Authorization Request
99-
throwError(OAuth2ErrorCodes.INVALID_REQUEST, "request_uri");
99+
throwError(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.REQUEST_URI);
100100
}
101101
}
102102

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProviderTests.java‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -617,7 +617,7 @@ public void authenticateWhenAuthorizationCodeRequestWithRequestUriThenReturnAuth
617617
OAuth2PushedAuthorizationRequestUri pushedAuthorizationRequestUri = OAuth2PushedAuthorizationRequestUri
618618
.create();
619619
Map<String, Object> additionalParameters = new HashMap<>();
620-
additionalParameters.put("request_uri", pushedAuthorizationRequestUri.getRequestUri());
620+
additionalParameters.put(OAuth2ParameterNames.REQUEST_URI, pushedAuthorizationRequestUri.getRequestUri());
621621
OAuth2Authorization authorization = TestOAuth2Authorizations
622622
.authorization(registeredClient, additionalParameters)
623623
.build();
@@ -643,7 +643,7 @@ public void authenticateWhenAuthorizationCodeRequestWithInvalidRequestUriThenThr
643643
OAuth2PushedAuthorizationRequestUri pushedAuthorizationRequestUri = OAuth2PushedAuthorizationRequestUri
644644
.create();
645645
Map<String, Object> additionalParameters = new HashMap<>();
646-
additionalParameters.put("request_uri", pushedAuthorizationRequestUri.getRequestUri());
646+
additionalParameters.put(OAuth2ParameterNames.REQUEST_URI, pushedAuthorizationRequestUri.getRequestUri());
647647
OAuth2Authorization authorization = TestOAuth2Authorizations
648648
.authorization(registeredClient, additionalParameters)
649649
.build();
@@ -652,12 +652,12 @@ public void authenticateWhenAuthorizationCodeRequestWithInvalidRequestUriThenThr
652652

653653
OAuth2AuthorizationCodeRequestAuthenticationToken authentication = new OAuth2AuthorizationCodeRequestAuthenticationToken(
654654
AUTHORIZATION_URI, registeredClient.getClientId(), this.principal, null, null, null,
655-
Collections.singletonMap("request_uri", "invalid_request_uri"));
655+
Collections.singletonMap(OAuth2ParameterNames.REQUEST_URI, "invalid_request_uri"));
656656

657657
assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication))
658658
.isInstanceOf(OAuth2AuthorizationCodeRequestAuthenticationException.class)
659659
.satisfies((ex) -> assertAuthenticationException((OAuth2AuthorizationCodeRequestAuthenticationException) ex,
660-
OAuth2ErrorCodes.INVALID_REQUEST, "request_uri", null));
660+
OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.REQUEST_URI, null));
661661
}
662662

663663
@Test
@@ -668,7 +668,7 @@ public void authenticateWhenAuthorizationCodeRequestWithRequestUriIssuedToAnothe
668668
OAuth2PushedAuthorizationRequestUri pushedAuthorizationRequestUri = OAuth2PushedAuthorizationRequestUri
669669
.create();
670670
Map<String, Object> additionalParameters = new HashMap<>();
671-
additionalParameters.put("request_uri", pushedAuthorizationRequestUri.getRequestUri());
671+
additionalParameters.put(OAuth2ParameterNames.REQUEST_URI, pushedAuthorizationRequestUri.getRequestUri());
672672
OAuth2Authorization authorization = TestOAuth2Authorizations
673673
.authorization(registeredClient, additionalParameters)
674674
.build();
@@ -692,7 +692,7 @@ public void authenticateWhenAuthorizationCodeRequestWithExpiredRequestUriThenThr
692692
OAuth2PushedAuthorizationRequestUri pushedAuthorizationRequestUri = OAuth2PushedAuthorizationRequestUri
693693
.create(Instant.now().minusSeconds(5));
694694
Map<String, Object> additionalParameters = new HashMap<>();
695-
additionalParameters.put("request_uri", pushedAuthorizationRequestUri.getRequestUri());
695+
additionalParameters.put(OAuth2ParameterNames.REQUEST_URI, pushedAuthorizationRequestUri.getRequestUri());
696696
OAuth2Authorization authorization = TestOAuth2Authorizations
697697
.authorization(registeredClient, additionalParameters)
698698
.build();
@@ -706,7 +706,7 @@ public void authenticateWhenAuthorizationCodeRequestWithExpiredRequestUriThenThr
706706
assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication))
707707
.isInstanceOf(OAuth2AuthorizationCodeRequestAuthenticationException.class)
708708
.satisfies((ex) -> assertAuthenticationException((OAuth2AuthorizationCodeRequestAuthenticationException) ex,
709-
OAuth2ErrorCodes.INVALID_REQUEST, "request_uri", null));
709+
OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.REQUEST_URI, null));
710710
verify(this.authorizationService).remove(eq(authorization));
711711
}
712712

@@ -774,7 +774,7 @@ private void assertAuthorizationCodeRequestWithAuthorizationCodeResult(Registere
774774
assertThat(authorizationRequest.getAuthorizationUri()).isEqualTo(authentication.getAuthorizationUri());
775775
assertThat(authorizationRequest.getClientId()).isEqualTo(registeredClient.getClientId());
776776

777-
String requestUri = (String) authentication.getAdditionalParameters().get("request_uri");
777+
String requestUri = (String) authentication.getAdditionalParameters().get(OAuth2ParameterNames.REQUEST_URI);
778778
if (!StringUtils.hasText(requestUri)) {
779779
assertThat(authorizationRequest.getRedirectUri()).isEqualTo(authentication.getRedirectUri());
780780
assertThat(authorizationRequest.getScopes()).isEqualTo(authentication.getScopes());

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2AuthorizationCodeGrantTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1037,7 +1037,7 @@ public void requestWhenPushedAuthorizationRequestThenReturnAccessTokenResponse()
10371037
mvcResult = this.mvc
10381038
.perform(get(DEFAULT_AUTHORIZATION_ENDPOINT_URI)
10391039
.queryParam(OAuth2ParameterNames.CLIENT_ID, registeredClient.getClientId())
1040-
.queryParam("request_uri", requestUri)
1040+
.queryParam(OAuth2ParameterNames.REQUEST_URI, requestUri)
10411041
.with(user("user")))
10421042
.andExpect(status().is3xxRedirection())
10431043
.andReturn();

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationEndpointFilterTests.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -190,9 +190,9 @@ public void doFilterWhenNotAuthorizationRequestThenNotProcessed() throws Excepti
190190
@Test
191191
public void doFilterWhenAuthorizationRequestMultipleRequestUriThenInvalidRequestError() throws Exception {
192192
doFilterWhenAuthorizationRequestInvalidParameterThenError(TestRegisteredClients.registeredClient().build(),
193-
"request_uri", OAuth2ErrorCodes.INVALID_REQUEST, (request) -> {
194-
request.addParameter("request_uri", "request_uri");
195-
request.addParameter("request_uri", "request_uri_2");
193+
OAuth2ParameterNames.REQUEST_URI, OAuth2ErrorCodes.INVALID_REQUEST, (request) -> {
194+
request.addParameter(OAuth2ParameterNames.REQUEST_URI, OAuth2ParameterNames.REQUEST_URI);
195+
request.addParameter(OAuth2ParameterNames.REQUEST_URI, "request_uri_2");
196196
updateQueryString(request);
197197
});
198198
}

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2PushedAuthorizationRequestEndpointFilterTests.java‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -170,8 +170,9 @@ public void doFilterWhenNotPushedAuthorizationRequestThenNotProcessed() throws E
170170
@Test
171171
public void doFilterWhenPushedAuthorizationRequestIncludesRequestUriThenInvalidRequestError() throws Exception {
172172
doFilterWhenPushedAuthorizationRequestInvalidParameterThenError(
173-
TestRegisteredClients.registeredClient().build(), "request_uri", OAuth2ErrorCodes.INVALID_REQUEST,
174-
(request) -> request.addParameter("request_uri", "request_uri"));
173+
TestRegisteredClients.registeredClient().build(), OAuth2ParameterNames.REQUEST_URI,
174+
OAuth2ErrorCodes.INVALID_REQUEST,
175+
(request) -> request.addParameter(OAuth2ParameterNames.REQUEST_URI, OAuth2ParameterNames.REQUEST_URI));
175176
}
176177

177178
@Test
@@ -292,9 +293,9 @@ public void doFilterWhenPushedAuthorizationRequestAuthenticationExceptionThenErr
292293
public void doFilterWhenCustomAuthenticationConverterThenUsed() throws Exception {
293294
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
294295
OAuth2PushedAuthorizationRequestAuthenticationToken pushedAuthorizationRequestAuthenticationResult = new OAuth2PushedAuthorizationRequestAuthenticationToken(
295-
AUTHORIZATION_URI, registeredClient.getClientId(), this.clientPrincipal, "request_uri",
296-
Instant.now().plusSeconds(30), registeredClient.getRedirectUris().iterator().next(), STATE,
297-
registeredClient.getScopes());
296+
AUTHORIZATION_URI, registeredClient.getClientId(), this.clientPrincipal,
297+
OAuth2ParameterNames.REQUEST_URI, Instant.now().plusSeconds(30),
298+
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes());
298299

299300
AuthenticationConverter authenticationConverter = mock(AuthenticationConverter.class);
300301
given(authenticationConverter.convert(any())).willReturn(pushedAuthorizationRequestAuthenticationResult);
@@ -317,9 +318,9 @@ public void doFilterWhenCustomAuthenticationConverterThenUsed() throws Exception
317318
public void doFilterWhenCustomAuthenticationSuccessHandlerThenUsed() throws Exception {
318319
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
319320
OAuth2PushedAuthorizationRequestAuthenticationToken pushedAuthorizationRequestAuthenticationResult = new OAuth2PushedAuthorizationRequestAuthenticationToken(
320-
AUTHORIZATION_URI, registeredClient.getClientId(), this.clientPrincipal, "request_uri",
321-
Instant.now().plusSeconds(30), registeredClient.getRedirectUris().iterator().next(), STATE,
322-
registeredClient.getScopes());
321+
AUTHORIZATION_URI, registeredClient.getClientId(), this.clientPrincipal,
322+
OAuth2ParameterNames.REQUEST_URI, Instant.now().plusSeconds(30),
323+
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes());
323324
given(this.authenticationManager.authenticate(any()))
324325
.willReturn(pushedAuthorizationRequestAuthenticationResult);
325326

@@ -371,9 +372,9 @@ public void doFilterWhenCustomAuthenticationDetailsSourceThenUsed() throws Excep
371372
this.filter.setAuthenticationDetailsSource(authenticationDetailsSource);
372373

373374
OAuth2PushedAuthorizationRequestAuthenticationToken pushedAuthorizationRequestAuthenticationResult = new OAuth2PushedAuthorizationRequestAuthenticationToken(
374-
AUTHORIZATION_URI, registeredClient.getClientId(), this.clientPrincipal, "request_uri",
375-
Instant.now().plusSeconds(30), registeredClient.getRedirectUris().iterator().next(), STATE,
376-
registeredClient.getScopes());
375+
AUTHORIZATION_URI, registeredClient.getClientId(), this.clientPrincipal,
376+
OAuth2ParameterNames.REQUEST_URI, Instant.now().plusSeconds(30),
377+
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes());
377378

378379
given(this.authenticationManager.authenticate(any()))
379380
.willReturn(pushedAuthorizationRequestAuthenticationResult);
@@ -390,7 +391,7 @@ public void doFilterWhenCustomAuthenticationDetailsSourceThenUsed() throws Excep
390391
@Test
391392
public void doFilterWhenPushedAuthorizationRequestAuthenticatedThenPushedAuthorizationResponse() throws Exception {
392393
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
393-
String requestUri = "request_uri";
394+
String requestUri = OAuth2ParameterNames.REQUEST_URI;
394395
Instant requestUriExpiresAt = Instant.now().plusSeconds(30);
395396
OAuth2PushedAuthorizationRequestAuthenticationToken pushedAuthorizationRequestAuthenticationResult = new OAuth2PushedAuthorizationRequestAuthenticationToken(
396397
AUTHORIZATION_URI, registeredClient.getClientId(), this.clientPrincipal, requestUri,
@@ -424,7 +425,7 @@ public void doFilterWhenPushedAuthorizationRequestAuthenticatedThenPushedAuthori
424425
.isEqualTo(new String[] { "custom-value-1", "custom-value-2" });
425426
assertThat(response.getStatus()).isEqualTo(HttpStatus.CREATED.value());
426427
Map<String, Object> responseParameters = readPushedAuthorizationResponse(response);
427-
assertThat(responseParameters.get("request_uri")).isEqualTo(requestUri);
428+
assertThat(responseParameters.get(OAuth2ParameterNames.REQUEST_URI)).isEqualTo(requestUri);
428429
Instant requestUriExpiry = Instant.now()
429430
.plusSeconds(Long.parseLong(String.valueOf(responseParameters.get("expires_in"))));
430431
assertThat(requestUriExpiry).isBetween(requestUriExpiresAt.minusSeconds(1), requestUriExpiresAt.plusSeconds(1));

0 commit comments

Comments
 (0)