Fix empty code parameter in CodeVerifierAuthenticator #1680
Conversation
spring-projects-issues
added
the
status: waiting-for-triage
jgrandja
added
type: bug
There was a problem hiding this comment.
Thanks for the PR @aijazkeerio. Please see review comments.
| return AuthorizationGrantType.AUTHORIZATION_CODE.getValue().equals( | ||
| parameters.get(OAuth2ParameterNames.GRANT_TYPE)) && | ||
| parameters.get(OAuth2ParameterNames.CODE) != null; | ||
| parameters.get(OAuth2ParameterNames.CODE) != null && |
There was a problem hiding this comment.
If the grant type is authorization_code and the code is empty, it should not return false and instead should error.
Try this instead:
if (!AuthorizationGrantType.AUTHORIZATION_CODE.getValue().equals(parameters.get(OAuth2ParameterNames.GRANT_TYPE))) {
return false;
}
if (!StringUtils.hasText((String) parameters.get(OAuth2ParameterNames.CODE))) {
throwInvalidGrant(OAuth2ParameterNames.CODE);
}
return true;There was a problem hiding this comment.
Please review new changes.
I have removed the formatter:on off, let me know if I should add it back.
| } | ||
|
|
||
| @Test | ||
| public void authenticateWhenAuthorizationCodeGrantAndPkceAndValidCodeVerifierAndMissingCodeThenAuthenticated() { |
There was a problem hiding this comment.
Please remove this test and add OAuth2AuthorizationCodeGrantTests.requestWhenPublicClientWithPkceAndEmptyCodeThenBadRequest(). You can use requestWhenPublicClientWithPkceThenReturnAccessTokenResponse() as a template and adjust it.
jgrandja
changed the title
|
Thanks for the updates @aijazkeerio ! This is now merged. FYI, I added a polish commit that was mostly formatting changes. |
4 participants
Fixes #1671