Skip to content

Commit 3a90c1d

Browse files
committed
JwtIssuerValidator handles issuer (iss) claim values as Strings and URLs
- NimbusJwtDecoder uses claim set converters: issuer claim is converted to an URL object - JwtIssuerValidator (created by JwtValidators.createDefaultWithIssuer(String)) wraps a JwtClaimValidator<String> - because of different data types, equal() is always false This change allows both Strings and URLs as values of the issuer Closes gh-9136
1 parent d69032a commit 3a90c1d

File tree

2 files changed

+25
-2
lines changed

2 files changed

+25
-2
lines changed

oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/JwtIssuerValidator.java

+6-2
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.oauth2.jwt;
1818

19+
import java.util.function.Predicate;
20+
1921
import org.springframework.security.oauth2.core.OAuth2TokenValidator;
2022
import org.springframework.security.oauth2.core.OAuth2TokenValidatorResult;
2123
import org.springframework.util.Assert;
@@ -28,15 +30,17 @@
2830
*/
2931
public final class JwtIssuerValidator implements OAuth2TokenValidator<Jwt> {
3032

31-
private final JwtClaimValidator<String> validator;
33+
private final JwtClaimValidator<Object> validator;
3234

3335
/**
3436
* Constructs a {@link JwtIssuerValidator} using the provided parameters
3537
* @param issuer - The issuer that each {@link Jwt} should have.
3638
*/
3739
public JwtIssuerValidator(String issuer) {
3840
Assert.notNull(issuer, "issuer cannot be null");
39-
this.validator = new JwtClaimValidator(JwtClaimNames.ISS, issuer::equals);
41+
42+
Predicate<Object> testClaimValue = (claimValue) -> (claimValue != null) && issuer.equals(claimValue.toString());
43+
this.validator = new JwtClaimValidator<>(JwtClaimNames.ISS, testClaimValue);
4044
}
4145

4246
@Override

oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/JwtIssuerValidatorTests.java

+19
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@
1616

1717
package org.springframework.security.oauth2.jwt;
1818

19+
import java.net.MalformedURLException;
20+
import java.net.URL;
21+
1922
import org.junit.Test;
2023

2124
import org.springframework.security.oauth2.core.OAuth2TokenValidatorResult;
@@ -42,13 +45,29 @@ public void validateWhenIssuerMatchesThenReturnsSuccess() {
4245
// @formatter:on
4346
}
4447

48+
@Test
49+
public void validateWhenIssuerUrlMatchesThenReturnsSuccess() throws MalformedURLException {
50+
Jwt jwt = TestJwts.jwt().claim("iss", new URL(ISSUER)).build();
51+
52+
assertThat(this.validator.validate(jwt)).isEqualTo(OAuth2TokenValidatorResult.success());
53+
}
54+
4555
@Test
4656
public void validateWhenIssuerMismatchesThenReturnsError() {
4757
Jwt jwt = TestJwts.jwt().claim(JwtClaimNames.ISS, "https://other").build();
4858
OAuth2TokenValidatorResult result = this.validator.validate(jwt);
4959
assertThat(result.getErrors()).isNotEmpty();
5060
}
5161

62+
@Test
63+
public void validateWhenIssuerUrlMismatchesThenReturnsError() throws MalformedURLException {
64+
Jwt jwt = TestJwts.jwt().claim(JwtClaimNames.ISS, new URL("https://other")).build();
65+
66+
OAuth2TokenValidatorResult result = this.validator.validate(jwt);
67+
68+
assertThat(result.getErrors()).isNotEmpty();
69+
}
70+
5271
@Test
5372
public void validateWhenJwtHasNoIssuerThenReturnsError() {
5473
Jwt jwt = TestJwts.jwt().claim(JwtClaimNames.AUD, "https://aud").build();

0 commit comments

Comments
 (0)