Skip to content

Commit dfebd6d

Browse files
author
Steve Riesenberg
committed
Revert "URL encode client credentials"
This reverts commit e6c268a. Issue gh-9610 gh-9858 Closes gh-10018 Closes gh-10121
1 parent bd703ff commit dfebd6d

File tree

4 files changed

+5
-106
lines changed

4 files changed

+5
-106
lines changed

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/AbstractWebClientReactiveOAuth2AccessTokenResponseClient.java

Lines changed: 2 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2021 the original author or authors.
2+
* Copyright 2002-2020 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,9 +16,6 @@
1616

1717
package org.springframework.security.oauth2.client.endpoint;
1818

19-
import java.io.UnsupportedEncodingException;
20-
import java.net.URLEncoder;
21-
import java.nio.charset.StandardCharsets;
2219
import java.util.Collections;
2320
import java.util.Set;
2421

@@ -100,19 +97,7 @@ private void populateTokenRequestHeaders(T grantRequest, HttpHeaders headers) {
10097
headers.setAccept(Collections.singletonList(MediaType.APPLICATION_JSON));
10198
if (ClientAuthenticationMethod.CLIENT_SECRET_BASIC.equals(clientRegistration.getClientAuthenticationMethod())
10299
|| ClientAuthenticationMethod.BASIC.equals(clientRegistration.getClientAuthenticationMethod())) {
103-
String clientId = encodeClientCredential(clientRegistration.getClientId());
104-
String clientSecret = encodeClientCredential(clientRegistration.getClientSecret());
105-
headers.setBasicAuth(clientId, clientSecret);
106-
}
107-
}
108-
109-
private static String encodeClientCredential(String clientCredential) {
110-
try {
111-
return URLEncoder.encode(clientCredential, StandardCharsets.UTF_8.toString());
112-
}
113-
catch (UnsupportedEncodingException ex) {
114-
// Will not happen since UTF-8 is a standard charset
115-
throw new IllegalArgumentException(ex);
100+
headers.setBasicAuth(clientRegistration.getClientId(), clientRegistration.getClientSecret());
116101
}
117102
}
118103

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/OAuth2AuthorizationGrantRequestEntityUtils.java

Lines changed: 2 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2021 the original author or authors.
2+
* Copyright 2002-2020 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,9 +16,6 @@
1616

1717
package org.springframework.security.oauth2.client.endpoint;
1818

19-
import java.io.UnsupportedEncodingException;
20-
import java.net.URLEncoder;
21-
import java.nio.charset.StandardCharsets;
2219
import java.util.Collections;
2320

2421
import org.springframework.core.convert.converter.Converter;
@@ -51,23 +48,11 @@ static HttpHeaders getTokenRequestHeaders(ClientRegistration clientRegistration)
5148
headers.addAll(DEFAULT_TOKEN_REQUEST_HEADERS);
5249
if (ClientAuthenticationMethod.CLIENT_SECRET_BASIC.equals(clientRegistration.getClientAuthenticationMethod())
5350
|| ClientAuthenticationMethod.BASIC.equals(clientRegistration.getClientAuthenticationMethod())) {
54-
String clientId = encodeClientCredential(clientRegistration.getClientId());
55-
String clientSecret = encodeClientCredential(clientRegistration.getClientSecret());
56-
headers.setBasicAuth(clientId, clientSecret);
51+
headers.setBasicAuth(clientRegistration.getClientId(), clientRegistration.getClientSecret());
5752
}
5853
return headers;
5954
}
6055

61-
private static String encodeClientCredential(String clientCredential) {
62-
try {
63-
return URLEncoder.encode(clientCredential, StandardCharsets.UTF_8.toString());
64-
}
65-
catch (UnsupportedEncodingException ex) {
66-
// Will not happen since UTF-8 is a standard charset
67-
throw new IllegalArgumentException(ex);
68-
}
69-
}
70-
7156
private static HttpHeaders getDefaultTokenRequestHeaders() {
7257
HttpHeaders headers = new HttpHeaders();
7358
headers.setAccept(Collections.singletonList(MediaType.APPLICATION_JSON_UTF8));

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/endpoint/OAuth2ClientCredentialsGrantRequestEntityConverterTests.java

Lines changed: 0 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,6 @@
1616

1717
package org.springframework.security.oauth2.client.endpoint;
1818

19-
import java.io.UnsupportedEncodingException;
20-
import java.net.URLEncoder;
21-
import java.nio.charset.StandardCharsets;
22-
import java.util.Base64;
23-
2419
import org.junit.Before;
2520
import org.junit.Test;
2621
import org.mockito.InOrder;
@@ -133,37 +128,4 @@ public void convertWhenGrantRequestValidThenConverts() {
133128
assertThat(formParameters.getFirst(OAuth2ParameterNames.SCOPE)).contains(clientRegistration.getScopes());
134129
}
135130

136-
// gh-9610
137-
@SuppressWarnings("unchecked")
138-
@Test
139-
public void convertWhenSpecialCharactersThenConvertsWithEncodedClientCredentials()
140-
throws UnsupportedEncodingException {
141-
String clientCredentialWithAnsiKeyboardSpecialCharacters = "~!@#$%^&*()_+{}|:\"<>?`-=[]\\;',./ ";
142-
// @formatter:off
143-
ClientRegistration clientRegistration = TestClientRegistrations.clientCredentials()
144-
.clientId(clientCredentialWithAnsiKeyboardSpecialCharacters)
145-
.clientSecret(clientCredentialWithAnsiKeyboardSpecialCharacters)
146-
.build();
147-
// @formatter:on
148-
OAuth2ClientCredentialsGrantRequest clientCredentialsGrantRequest = new OAuth2ClientCredentialsGrantRequest(
149-
clientRegistration);
150-
RequestEntity<?> requestEntity = this.converter.convert(clientCredentialsGrantRequest);
151-
assertThat(requestEntity.getMethod()).isEqualTo(HttpMethod.POST);
152-
assertThat(requestEntity.getUrl().toASCIIString())
153-
.isEqualTo(clientRegistration.getProviderDetails().getTokenUri());
154-
HttpHeaders headers = requestEntity.getHeaders();
155-
assertThat(headers.getAccept()).contains(MediaType.APPLICATION_JSON_UTF8);
156-
assertThat(headers.getContentType())
157-
.isEqualTo(MediaType.valueOf(MediaType.APPLICATION_FORM_URLENCODED_VALUE + ";charset=UTF-8"));
158-
String urlEncodedClientCredential = URLEncoder.encode(clientCredentialWithAnsiKeyboardSpecialCharacters,
159-
StandardCharsets.UTF_8.toString());
160-
String clientCredentials = Base64.getEncoder().encodeToString(
161-
(urlEncodedClientCredential + ":" + urlEncodedClientCredential).getBytes(StandardCharsets.UTF_8));
162-
assertThat(headers.getFirst(HttpHeaders.AUTHORIZATION)).isEqualTo("Basic " + clientCredentials);
163-
MultiValueMap<String, String> formParameters = (MultiValueMap<String, String>) requestEntity.getBody();
164-
assertThat(formParameters.getFirst(OAuth2ParameterNames.GRANT_TYPE))
165-
.isEqualTo(AuthorizationGrantType.CLIENT_CREDENTIALS.getValue());
166-
assertThat(formParameters.getFirst(OAuth2ParameterNames.SCOPE)).contains(clientRegistration.getScopes());
167-
}
168-
169131
}

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/endpoint/WebClientReactiveClientCredentialsTokenResponseClientTests.java

Lines changed: 1 addition & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2021 the original author or authors.
2+
* Copyright 2002-2020 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,10 +16,6 @@
1616

1717
package org.springframework.security.oauth2.client.endpoint;
1818

19-
import java.net.URLEncoder;
20-
import java.nio.charset.StandardCharsets;
21-
import java.util.Base64;
22-
2319
import okhttp3.mockwebserver.MockResponse;
2420
import okhttp3.mockwebserver.MockWebServer;
2521
import okhttp3.mockwebserver.RecordedRequest;
@@ -93,35 +89,6 @@ public void getTokenResponseWhenHeaderThenSuccess() throws Exception {
9389
assertThat(body).isEqualTo("grant_type=client_credentials&scope=read%3Auser");
9490
}
9591

96-
// gh-9610
97-
@Test
98-
public void getTokenResponseWhenSpecialCharactersThenSuccessWithEncodedClientCredentials() throws Exception {
99-
// @formatter:off
100-
enqueueJson("{\n"
101-
+ " \"access_token\":\"MTQ0NjJkZmQ5OTM2NDE1ZTZjNGZmZjI3\",\n"
102-
+ " \"token_type\":\"bearer\",\n"
103-
+ " \"expires_in\":3600,\n"
104-
+ " \"refresh_token\":\"IwOGYzYTlmM2YxOTQ5MGE3YmNmMDFkNTVk\",\n"
105-
+ " \"scope\":\"create\"\n"
106-
+ "}");
107-
// @formatter:on
108-
String clientCredentialWithAnsiKeyboardSpecialCharacters = "~!@#$%^&*()_+{}|:\"<>?`-=[]\\;',./ ";
109-
OAuth2ClientCredentialsGrantRequest request = new OAuth2ClientCredentialsGrantRequest(
110-
this.clientRegistration.clientId(clientCredentialWithAnsiKeyboardSpecialCharacters)
111-
.clientSecret(clientCredentialWithAnsiKeyboardSpecialCharacters).build());
112-
OAuth2AccessTokenResponse response = this.client.getTokenResponse(request).block();
113-
RecordedRequest actualRequest = this.server.takeRequest();
114-
String body = actualRequest.getBody().readUtf8();
115-
assertThat(response.getAccessToken()).isNotNull();
116-
String urlEncodedClientCredentialecret = URLEncoder.encode(clientCredentialWithAnsiKeyboardSpecialCharacters,
117-
StandardCharsets.UTF_8.toString());
118-
String clientCredentials = Base64.getEncoder()
119-
.encodeToString((urlEncodedClientCredentialecret + ":" + urlEncodedClientCredentialecret)
120-
.getBytes(StandardCharsets.UTF_8));
121-
assertThat(actualRequest.getHeader(HttpHeaders.AUTHORIZATION)).isEqualTo("Basic " + clientCredentials);
122-
assertThat(body).isEqualTo("grant_type=client_credentials&scope=read%3Auser");
123-
}
124-
12592
@Test
12693
public void getTokenResponseWhenPostThenSuccess() throws Exception {
12794
ClientRegistration registration = this.clientRegistration

0 commit comments

Comments
 (0)