Skip to content

Adapt to form data not adding charset if it is UTF-8 #15275

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
marcusdacoregio opened this issue Jun 18, 2024 · 2 comments
Closed

Adapt to form data not adding charset if it is UTF-8 #15275

marcusdacoregio opened this issue Jun 18, 2024 · 2 comments
Assignees
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: breaks-passivity A change that breaks passivity with the previous release
Milestone

Comments

@marcusdacoregio
Copy link
Contributor

marcusdacoregio commented Jun 18, 2024

In spring-projects/spring-framework#31742 a change was made to not add the charset parameter if it is UTF-8 (more details on the linked issue). This affected some of the OAuth2 classes.

We should probably accept this breaking change and make sure that we include the necessary information in this ticket if users still need to include the charset parameter.

@marcusdacoregio marcusdacoregio added type: enhancement A general enhancement in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) labels Jun 18, 2024
@marcusdacoregio marcusdacoregio self-assigned this Jun 18, 2024
@marcusdacoregio
Copy link
Contributor Author

Closed via aa9c1ba

@sjohnr
Copy link
Member

sjohnr commented Jun 24, 2024

If you are impacted by this issue, please consider adding a comment letting us know how you were impacted. This will help us understand if any environments are affected by removing charset parameter of the Content-Type header.


The following is a workaround that can be applied to restore the charset parameter of the Content-Type header for the authorization_code grant.

@Configuration
@EnableWebFluxSecurity
public class SecurityConfiguration {

	...

	@Bean
	public ReactiveOAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> authorizationCodeTokenResponseClient() {
		var defaultHeadersConverter = new DefaultOAuth2TokenRequestHeadersConverter<OAuth2AuthorizationCodeGrantRequest>();
		var headersConverter = defaultHeadersConverter
			.andThen((headers) -> {
				headers.setContentType(new MediaType(MediaType.APPLICATION_FORM_URLENCODED, StandardCharsets.UTF_8));
				return headers;
			});

		var tokenResponseClient = new WebClientReactiveAuthorizationCodeTokenResponseClient();
		tokenResponseClient.setHeadersConverter(headersConverter);

		return tokenResponseClient;
	}

}

See the Customize Token Request Parameters section in the reference for information on customizing other grant types.

@sjohnr sjohnr added type: breaks-passivity A change that breaks passivity with the previous release and removed type: enhancement A general enhancement labels Jun 24, 2024
@marcusdacoregio marcusdacoregio added this to the 6.4.0-M1 milestone Jun 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: breaks-passivity A change that breaks passivity with the previous release
Projects
None yet
Development

No branches or pull requests

2 participants