Skip to content

Commit 58e3235

Browse files
jgrandjajgrandja
committed
Deprecate ClientAuthenticationMethod BASIC and POST
Closes gh-9220
1 parent c002c6f commit 58e3235

File tree

46 files changed

+209
-142
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+209
-142
lines changed

‎config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2100,7 +2100,7 @@ public HttpSecurity saml2Login(Customizer<Saml2LoginConfigurer<HttpSecurity>> sa
21002100
* return ClientRegistration.withRegistrationId("google")
21012101
* .clientId("google-client-id")
21022102
* .clientSecret("google-client-secret")
2103-
* .clientAuthenticationMethod(ClientAuthenticationMethod.BASIC)
2103+
* .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
21042104
* .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
21052105
* .redirectUri("{baseUrl}/login/oauth2/code/{registrationId}")
21062106
* .scope("openid", "profile", "email", "address", "phone")
@@ -2201,7 +2201,7 @@ public OAuth2LoginConfigurer<HttpSecurity> oauth2Login() throws Exception {
22012201
* return ClientRegistration.withRegistrationId("google")
22022202
* .clientId("google-client-id")
22032203
* .clientSecret("google-client-secret")
2204-
* .clientAuthenticationMethod(ClientAuthenticationMethod.BASIC)
2204+
* .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
22052205
* .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
22062206
* .redirectUri("{baseUrl}/login/oauth2/code/{registrationId}")
22072207
* .scope("openid", "profile", "email", "address", "phone")

‎config/src/main/java/org/springframework/security/config/oauth2/client/CommonOAuth2Provider.java

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,8 @@ public enum CommonOAuth2Provider {
3636

3737
@Override
3838
public Builder getBuilder(String registrationId) {
39-
ClientRegistration.Builder builder = getBuilder(registrationId, ClientAuthenticationMethod.BASIC,
40-
DEFAULT_REDIRECT_URL);
39+
ClientRegistration.Builder builder = getBuilder(registrationId,
40+
ClientAuthenticationMethod.CLIENT_SECRET_BASIC, DEFAULT_REDIRECT_URL);
4141
builder.scope("openid", "profile", "email");
4242
builder.authorizationUri("https://accounts.google.com/o/oauth2/v2/auth");
4343
builder.tokenUri("https://www.googleapis.com/oauth2/v4/token");
@@ -55,8 +55,8 @@ public Builder getBuilder(String registrationId) {
5555

5656
@Override
5757
public Builder getBuilder(String registrationId) {
58-
ClientRegistration.Builder builder = getBuilder(registrationId, ClientAuthenticationMethod.BASIC,
59-
DEFAULT_REDIRECT_URL);
58+
ClientRegistration.Builder builder = getBuilder(registrationId,
59+
ClientAuthenticationMethod.CLIENT_SECRET_BASIC, DEFAULT_REDIRECT_URL);
6060
builder.scope("read:user");
6161
builder.authorizationUri("https://github.com/login/oauth/authorize");
6262
builder.tokenUri("https://github.com/login/oauth/access_token");
@@ -72,8 +72,8 @@ public Builder getBuilder(String registrationId) {
7272

7373
@Override
7474
public Builder getBuilder(String registrationId) {
75-
ClientRegistration.Builder builder = getBuilder(registrationId, ClientAuthenticationMethod.POST,
76-
DEFAULT_REDIRECT_URL);
75+
ClientRegistration.Builder builder = getBuilder(registrationId,
76+
ClientAuthenticationMethod.CLIENT_SECRET_POST, DEFAULT_REDIRECT_URL);
7777
builder.scope("public_profile", "email");
7878
builder.authorizationUri("https://www.facebook.com/v2.8/dialog/oauth");
7979
builder.tokenUri("https://graph.facebook.com/v2.8/oauth/access_token");
@@ -89,8 +89,8 @@ public Builder getBuilder(String registrationId) {
8989

9090
@Override
9191
public Builder getBuilder(String registrationId) {
92-
ClientRegistration.Builder builder = getBuilder(registrationId, ClientAuthenticationMethod.BASIC,
93-
DEFAULT_REDIRECT_URL);
92+
ClientRegistration.Builder builder = getBuilder(registrationId,
93+
ClientAuthenticationMethod.CLIENT_SECRET_BASIC, DEFAULT_REDIRECT_URL);
9494
builder.scope("openid", "profile", "email");
9595
builder.userNameAttributeName(IdTokenClaimNames.SUB);
9696
builder.clientName("Okta");

‎config/src/main/resources/META-INF/spring.schemas

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,8 @@ http\://www.springframework.org/schema/security/spring-security-2.0.xsd=org/spri
1616
http\://www.springframework.org/schema/security/spring-security-2.0.1.xsd=org/springframework/security/config/spring-security-2.0.1.xsd
1717
http\://www.springframework.org/schema/security/spring-security-2.0.2.xsd=org/springframework/security/config/spring-security-2.0.2.xsd
1818
http\://www.springframework.org/schema/security/spring-security-2.0.4.xsd=org/springframework/security/config/spring-security-2.0.4.xsd
19-
https\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-5.4.xsd
19+
https\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-5.5.xsd
20+
https\://www.springframework.org/schema/security/spring-security-5.5.xsd=org/springframework/security/config/spring-security-5.5.xsd
2021
https\://www.springframework.org/schema/security/spring-security-5.4.xsd=org/springframework/security/config/spring-security-5.4.xsd
2122
https\://www.springframework.org/schema/security/spring-security-5.3.xsd=org/springframework/security/config/spring-security-5.3.xsd
2223
https\://www.springframework.org/schema/security/spring-security-5.2.xsd=org/springframework/security/config/spring-security-5.2.xsd

‎config/src/main/resources/org/springframework/security/config/spring-security-5.5.rnc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -526,8 +526,8 @@ client-registration.attlist &=
526526
## The client secret.
527527
attribute client-secret {xsd:token}?
528528
client-registration.attlist &=
529-
## The method used to authenticate the client with the provider. The supported values are basic, post and none (public clients).
530-
attribute client-authentication-method {"basic" | "post" | "none"}?
529+
## The method used to authenticate the client with the provider. The supported values are client_secret_basic, client_secret_post and none (public clients).
530+
attribute client-authentication-method {"client_secret_basic" | "basic" | "client_secret_post" | "post" | "none"}?
531531
client-registration.attlist &=
532532
## The OAuth 2.0 Authorization Framework defines four Authorization Grant types. The supported values are authorization_code, client_credentials, password and implicit.
533533
attribute authorization-grant-type {"authorization_code" | "client_credentials" | "password" | "implicit"}?

‎config/src/main/resources/org/springframework/security/config/spring-security-5.5.xsd

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1657,12 +1657,14 @@
16571657
<xs:attribute name="client-authentication-method">
16581658
<xs:annotation>
16591659
<xs:documentation>The method used to authenticate the client with the provider. The supported values are
1660-
basic, post and none (public clients).
1660+
client_secret_basic, client_secret_post and none (public clients).
16611661
</xs:documentation>
16621662
</xs:annotation>
16631663
<xs:simpleType>
16641664
<xs:restriction base="xs:token">
1665+
<xs:enumeration value="client_secret_basic"/>
16651666
<xs:enumeration value="basic"/>
1667+
<xs:enumeration value="client_secret_post"/>
16661668
<xs:enumeration value="post"/>
16671669
<xs:enumeration value="none"/>
16681670
</xs:restriction>

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2ClientConfigurerTests.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ public void setup() {
113113
.registrationId("registration-1")
114114
.clientId("client-1")
115115
.clientSecret("secret")
116-
.clientAuthenticationMethod(ClientAuthenticationMethod.BASIC)
116+
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
117117
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
118118
.redirectUri("{baseUrl}/client-1")
119119
.scope("user")

‎config/src/test/java/org/springframework/security/config/oauth2/client/ClientRegistrationsBeanDefinitionParserTests.java

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,8 @@ public void parseWhenIssuerUriConfiguredThenRequestConfigFromIssuer() throws Exc
152152
assertThat(googleRegistration.getRegistrationId()).isEqualTo("google-login");
153153
assertThat(googleRegistration.getClientId()).isEqualTo("google-client-id");
154154
assertThat(googleRegistration.getClientSecret()).isEqualTo("google-client-secret");
155-
assertThat(googleRegistration.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.BASIC);
155+
assertThat(googleRegistration.getClientAuthenticationMethod())
156+
.isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
156157
assertThat(googleRegistration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.AUTHORIZATION_CODE);
157158
assertThat(googleRegistration.getRedirectUri()).isEqualTo("{baseUrl}/{action}/oauth2/code/{registrationId}");
158159
assertThat(googleRegistration.getScopes()).isNull();
@@ -180,7 +181,8 @@ public void parseWhenMultipleClientsConfiguredThenAvailableInRepository() {
180181
assertThat(googleRegistration.getRegistrationId()).isEqualTo("google-login");
181182
assertThat(googleRegistration.getClientId()).isEqualTo("google-client-id");
182183
assertThat(googleRegistration.getClientSecret()).isEqualTo("google-client-secret");
183-
assertThat(googleRegistration.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.BASIC);
184+
assertThat(googleRegistration.getClientAuthenticationMethod())
185+
.isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
184186
assertThat(googleRegistration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.AUTHORIZATION_CODE);
185187
assertThat(googleRegistration.getRedirectUri()).isEqualTo("{baseUrl}/login/oauth2/code/{registrationId}");
186188
assertThat(googleRegistration.getScopes())
@@ -203,7 +205,8 @@ public void parseWhenMultipleClientsConfiguredThenAvailableInRepository() {
203205
assertThat(githubRegistration.getRegistrationId()).isEqualTo("github-login");
204206
assertThat(githubRegistration.getClientId()).isEqualTo("github-client-id");
205207
assertThat(githubRegistration.getClientSecret()).isEqualTo("github-client-secret");
206-
assertThat(githubRegistration.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.BASIC);
208+
assertThat(githubRegistration.getClientAuthenticationMethod())
209+
.isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
207210
assertThat(githubRegistration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.AUTHORIZATION_CODE);
208211
assertThat(githubRegistration.getRedirectUri()).isEqualTo("{baseUrl}/login/oauth2/code/{registrationId}");
209212
assertThat(googleRegistration.getScopes())

‎config/src/test/java/org/springframework/security/config/oauth2/client/CommonOAuth2ProviderTests.java

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@ public void getBuilderWhenGoogleShouldHaveGoogleSettings() {
4646
assertThat(providerDetails.getUserInfoEndpoint().getUserNameAttributeName()).isEqualTo(IdTokenClaimNames.SUB);
4747
assertThat(providerDetails.getJwkSetUri()).isEqualTo("https://www.googleapis.com/oauth2/v3/certs");
4848
assertThat(providerDetails.getIssuerUri()).isEqualTo("https://accounts.google.com");
49-
assertThat(registration.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.BASIC);
49+
assertThat(registration.getClientAuthenticationMethod())
50+
.isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
5051
assertThat(registration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.AUTHORIZATION_CODE);
5152
assertThat(registration.getRedirectUri()).isEqualTo(DEFAULT_REDIRECT_URL);
5253
assertThat(registration.getScopes()).containsOnly("openid", "profile", "email");
@@ -63,7 +64,8 @@ public void getBuilderWhenGitHubShouldHaveGitHubSettings() {
6364
assertThat(providerDetails.getUserInfoEndpoint().getUri()).isEqualTo("https://api.github.com/user");
6465
assertThat(providerDetails.getUserInfoEndpoint().getUserNameAttributeName()).isEqualTo("id");
6566
assertThat(providerDetails.getJwkSetUri()).isNull();
66-
assertThat(registration.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.BASIC);
67+
assertThat(registration.getClientAuthenticationMethod())
68+
.isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
6769
assertThat(registration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.AUTHORIZATION_CODE);
6870
assertThat(registration.getRedirectUri()).isEqualTo(DEFAULT_REDIRECT_URL);
6971
assertThat(registration.getScopes()).containsOnly("read:user");
@@ -81,7 +83,8 @@ public void getBuilderWhenFacebookShouldHaveFacebookSettings() {
8183
.isEqualTo("https://graph.facebook.com/me?fields=id,name,email");
8284
assertThat(providerDetails.getUserInfoEndpoint().getUserNameAttributeName()).isEqualTo("id");
8385
assertThat(providerDetails.getJwkSetUri()).isNull();
84-
assertThat(registration.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.POST);
86+
assertThat(registration.getClientAuthenticationMethod())
87+
.isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_POST);
8588
assertThat(registration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.AUTHORIZATION_CODE);
8689
assertThat(registration.getRedirectUri()).isEqualTo(DEFAULT_REDIRECT_URL);
8790
assertThat(registration.getScopes()).containsOnly("public_profile", "email");
@@ -100,7 +103,8 @@ public void getBuilderWhenOktaShouldHaveOktaSettings() {
100103
assertThat(providerDetails.getUserInfoEndpoint().getUri()).isEqualTo("https://example.com/info");
101104
assertThat(providerDetails.getUserInfoEndpoint().getUserNameAttributeName()).isEqualTo(IdTokenClaimNames.SUB);
102105
assertThat(providerDetails.getJwkSetUri()).isEqualTo("https://example.com/jwkset");
103-
assertThat(registration.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.BASIC);
106+
assertThat(registration.getClientAuthenticationMethod())
107+
.isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
104108
assertThat(registration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.AUTHORIZATION_CODE);
105109
assertThat(registration.getRedirectUri()).isEqualTo(DEFAULT_REDIRECT_URL);
106110
assertThat(registration.getScopes()).containsOnly("openid", "profile", "email");

‎config/src/test/resources/org/springframework/security/config/http/OAuth2LoginBeanDefinitionParserTests-SingleClientRegistration.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
<client-registration registration-id="google-login"
3535
client-id="google-client-id"
3636
client-secret="google-client-secret"
37-
client-authentication-method="basic"
37+
client-authentication-method="client_secret_basic"
3838
authorization-grant-type="authorization_code"
3939
redirect-uri="{baseUrl}/login/oauth2/code/{registrationId}"
4040
scope="openid,profile,email"

‎config/src/test/resources/org/springframework/security/config/oauth2/client/google-github-registration.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
<client-registration registration-id="google-login"
2828
client-id="google-client-id"
2929
client-secret="google-client-secret"
30-
client-authentication-method="basic"
30+
client-authentication-method="client_secret_basic"
3131
authorization-grant-type="authorization_code"
3232
redirect-uri="{baseUrl}/login/oauth2/code/{registrationId}"
3333
scope="openid,profile,email"
@@ -36,7 +36,7 @@
3636
<client-registration registration-id="github-login"
3737
client-id="github-client-id"
3838
client-secret="github-client-secret"
39-
client-authentication-method="basic"
39+
client-authentication-method="client_secret_basic"
4040
authorization-grant-type="authorization_code"
4141
redirect-uri="{baseUrl}/login/oauth2/code/{registrationId}"
4242
scope="read:user"

‎config/src/test/resources/org/springframework/security/config/oauth2/client/google-registration.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
<client-registration registration-id="google-login"
2828
client-id="google-client-id"
2929
client-secret="google-client-secret"
30-
client-authentication-method="basic"
30+
client-authentication-method="client_secret_basic"
3131
authorization-grant-type="authorization_code"
3232
redirect-uri="{baseUrl}/login/oauth2/code/{registrationId}"
3333
scope="openid,profile,email"

‎docs/manual/src/docs/asciidoc/_includes/servlet/appendix/namespace.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1046,7 +1046,7 @@ The client secret.
10461046
[[nsa-client-registration-client-authentication-method]]
10471047
* **client-authentication-method**
10481048
The method used to authenticate the Client with the Provider.
1049-
The supported values are *basic*, *post* and *none* https://tools.ietf.org/html/rfc6749#section-2.1[(public clients)].
1049+
The supported values are *client_secret_basic*, *client_secret_post* and *none* https://tools.ietf.org/html/rfc6749#section-2.1[(public clients)].
10501050

10511051

10521052
[[nsa-client-registration-authorization-grant-type]]

‎docs/manual/src/docs/asciidoc/_includes/servlet/oauth2/oauth2-client.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -205,7 +205,7 @@ public final class ClientRegistration {
205205
<2> `clientId`: The client identifier.
206206
<3> `clientSecret`: The client secret.
207207
<4> `clientAuthenticationMethod`: The method used to authenticate the Client with the Provider.
208-
The supported values are *basic*, *post* and *none* https://tools.ietf.org/html/rfc6749#section-2.1[(public clients)].
208+
The supported values are *client_secret_basic*, *client_secret_post* and *none* https://tools.ietf.org/html/rfc6749#section-2.1[(public clients)].
209209
<5> `authorizationGrantType`: The OAuth 2.0 Authorization Framework defines four https://tools.ietf.org/html/rfc6749#section-1.3[Authorization Grant] types.
210210
The supported values are `authorization_code`, `client_credentials` and `password`.
211211
<6> `redirectUri`: The client's registered redirect URI that the _Authorization Server_ redirects the end-user's user-agent

‎docs/manual/src/docs/asciidoc/_includes/servlet/oauth2/oauth2-login.adoc

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -266,7 +266,7 @@ public class OAuth2LoginConfig {
266266
return ClientRegistration.withRegistrationId("google")
267267
.clientId("google-client-id")
268268
.clientSecret("google-client-secret")
269-
.clientAuthenticationMethod(ClientAuthenticationMethod.BASIC)
269+
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
270270
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
271271
.redirectUri("{baseUrl}/login/oauth2/code/{registrationId}")
272272
.scope("openid", "profile", "email", "address", "phone")
@@ -295,7 +295,7 @@ class OAuth2LoginConfig {
295295
return ClientRegistration.withRegistrationId("google")
296296
.clientId("google-client-id")
297297
.clientSecret("google-client-secret")
298-
.clientAuthenticationMethod(ClientAuthenticationMethod.BASIC)
298+
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
299299
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
300300
.redirectUri("{baseUrl}/login/oauth2/code/{registrationId}")
301301
.scope("openid", "profile", "email", "address", "phone")
@@ -390,7 +390,7 @@ public class OAuth2LoginConfig {
390390
return ClientRegistration.withRegistrationId("google")
391391
.clientId("google-client-id")
392392
.clientSecret("google-client-secret")
393-
.clientAuthenticationMethod(ClientAuthenticationMethod.BASIC)
393+
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
394394
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
395395
.redirectUri("{baseUrl}/login/oauth2/code/{registrationId}")
396396
.scope("openid", "profile", "email", "address", "phone")
@@ -433,7 +433,7 @@ class OAuth2LoginConfig {
433433
return ClientRegistration.withRegistrationId("google")
434434
.clientId("google-client-id")
435435
.clientSecret("google-client-secret")
436-
.clientAuthenticationMethod(ClientAuthenticationMethod.BASIC)
436+
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
437437
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
438438
.redirectUri("{baseUrl}/login/oauth2/code/{registrationId}")
439439
.scope("openid", "profile", "email", "address", "phone")

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/AbstractWebClientReactiveOAuth2AccessTokenResponseClient.java

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,8 @@ private void populateTokenRequestHeaders(T grantRequest, HttpHeaders headers) {
9595
ClientRegistration clientRegistration = clientRegistration(grantRequest);
9696
headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
9797
headers.setAccept(Collections.singletonList(MediaType.APPLICATION_JSON));
98-
if (ClientAuthenticationMethod.BASIC.equals(clientRegistration.getClientAuthenticationMethod())) {
98+
if (ClientAuthenticationMethod.CLIENT_SECRET_BASIC.equals(clientRegistration.getClientAuthenticationMethod())
99+
|| ClientAuthenticationMethod.BASIC.equals(clientRegistration.getClientAuthenticationMethod())) {
99100
headers.setBasicAuth(clientRegistration.getClientId(), clientRegistration.getClientSecret());
100101
}
101102
}
@@ -132,10 +133,12 @@ private BodyInserters.FormInserter<String> createTokenRequestBody(T grantRequest
132133
BodyInserters.FormInserter<String> populateTokenRequestBody(T grantRequest,
133134
BodyInserters.FormInserter<String> body) {
134135
ClientRegistration clientRegistration = clientRegistration(grantRequest);
135-
if (!ClientAuthenticationMethod.BASIC.equals(clientRegistration.getClientAuthenticationMethod())) {
136+
if (!ClientAuthenticationMethod.CLIENT_SECRET_BASIC.equals(clientRegistration.getClientAuthenticationMethod())
137+
&& !ClientAuthenticationMethod.BASIC.equals(clientRegistration.getClientAuthenticationMethod())) {
136138
body.with(OAuth2ParameterNames.CLIENT_ID, clientRegistration.getClientId());
137139
}
138-
if (ClientAuthenticationMethod.POST.equals(clientRegistration.getClientAuthenticationMethod())) {
140+
if (ClientAuthenticationMethod.CLIENT_SECRET_POST.equals(clientRegistration.getClientAuthenticationMethod())
141+
|| ClientAuthenticationMethod.POST.equals(clientRegistration.getClientAuthenticationMethod())) {
139142
body.with(OAuth2ParameterNames.CLIENT_SECRET, clientRegistration.getClientSecret());
140143
}
141144
Set<String> scopes = scopes(grantRequest);

0 commit comments

Comments
 (0)