Fix empty code parameter in CodeVerifierAuthenticator #1680
Conversation
spring-projects-issues
added
the
status: waiting-for-triage
jgrandja
added
type: bug
There was a problem hiding this comment.
Thanks for the PR @aijazkeerio. Please see review comments.
| @@ -140,7 +140,8 @@ private static boolean authorizationCodeGrant(Map<String, Object> parameters) { | |||
| // @formatter:off | |||
| return AuthorizationGrantType.AUTHORIZATION_CODE.getValue().equals( | |||
| parameters.get(OAuth2ParameterNames.GRANT_TYPE)) && | |||
| parameters.get(OAuth2ParameterNames.CODE) != null; | |||
| parameters.get(OAuth2ParameterNames.CODE) != null && | |||
There was a problem hiding this comment.
If the grant type is authorization_code and the code is empty, it should not return false and instead should error.
Try this instead:
if (!AuthorizationGrantType.AUTHORIZATION_CODE.getValue().equals(parameters.get(OAuth2ParameterNames.GRANT_TYPE))) {
return false;
}
if (!StringUtils.hasText((String) parameters.get(OAuth2ParameterNames.CODE))) {
throwInvalidGrant(OAuth2ParameterNames.CODE);
}
return true;There was a problem hiding this comment.
Please review new changes.
I have removed the formatter:on off, let me know if I should add it back.
| @@ -282,6 +283,29 @@ public void authenticateWhenAuthorizationCodeGrantAndValidCredentialsThenAuthent | |||
| assertThat(authenticationResult.getRegisteredClient()).isEqualTo(registeredClient); | |||
| } | |||
|
|
|||
| @Test | |||
| public void authenticateWhenAuthorizationCodeGrantAndPkceAndValidCodeVerifierAndMissingCodeThenAuthenticated() { | |||
There was a problem hiding this comment.
Please remove this test and add OAuth2AuthorizationCodeGrantTests.requestWhenPublicClientWithPkceAndEmptyCodeThenBadRequest(). You can use requestWhenPublicClientWithPkceThenReturnAccessTokenResponse() as a template and adjust it.
jgrandja
changed the title
|
Thanks for the updates @aijazkeerio ! This is now merged. FYI, I added a polish commit that was mostly formatting changes. |
Fixes #1671