Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ability to disable URL encoding of client credentials #10074

Closed
wants to merge 1 commit into from
+41 −6
Closed

Add ability to disable URL encoding of client credentials #10074

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 16 additions & 1 deletion ...curity/oauth2/client/endpoint/AbstractOAuth2AuthorizationGrantRequestEntityConverter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,10 +42,12 @@
abstract class AbstractOAuth2AuthorizationGrantRequestEntityConverter<T extends AbstractOAuth2AuthorizationGrantRequest>
implements Converter<T, RequestEntity<?>> {

private boolean encodeClientCredentials = true;

// @formatter:off
private Converter<T, HttpHeaders> headersConverter =
(authorizationGrantRequest) -> OAuth2AuthorizationGrantRequestEntityUtils
.getTokenRequestHeaders(authorizationGrantRequest.getClientRegistration());
.getTokenRequestHeaders(authorizationGrantRequest.getClientRegistration(), this.encodeClientCredentials);
// @formatter:on

private Converter<T, MultiValueMap<String, String>> parametersConverter = this::createParameters;
Expand Down Expand Up @@ -170,4 +172,17 @@ public final void addParametersConverter(Converter<T, MultiValueMap<String, Stri
};
}

/**
* Sets the flag that controls whether client credentials are encoded using the
* application/x-www-form-urlencoded algorithm in the headers converter.
* @deprecated Support for non-compliant providers will be removed in Spring Security
* 5.6
* @param encodeClientCredentials {@code false} to disable encoding client credentials
* (default is true)
*/
@Deprecated
public void setEncodeClientCredentials(boolean encodeClientCredentials) {
this.encodeClientCredentials = encodeClientCredentials;
}

}
22 changes: 20 additions & 2 deletions ...rity/oauth2/client/endpoint/AbstractWebClientReactiveOAuth2AccessTokenResponseClient.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,8 @@
public abstract class AbstractWebClientReactiveOAuth2AccessTokenResponseClient<T extends AbstractOAuth2AuthorizationGrantRequest>
implements ReactiveOAuth2AccessTokenResponseClient<T> {

private boolean encodeClientCredentials = true;

private WebClient webClient = WebClient.builder().build();

AbstractWebClientReactiveOAuth2AccessTokenResponseClient() {
Expand Down Expand Up @@ -100,8 +102,11 @@ private void populateTokenRequestHeaders(T grantRequest, HttpHeaders headers) {
headers.setAccept(Collections.singletonList(MediaType.APPLICATION_JSON));
if (ClientAuthenticationMethod.CLIENT_SECRET_BASIC.equals(clientRegistration.getClientAuthenticationMethod())
|| ClientAuthenticationMethod.BASIC.equals(clientRegistration.getClientAuthenticationMethod())) {
String clientId = encodeClientCredential(clientRegistration.getClientId());
String clientSecret = encodeClientCredential(clientRegistration.getClientSecret());
String clientId = this.encodeClientCredentials ? encodeClientCredential(clientRegistration.getClientId())
: clientRegistration.getClientId();
String clientSecret = this.encodeClientCredentials
? encodeClientCredential(clientRegistration.getClientSecret())
: clientRegistration.getClientSecret();
headers.setBasicAuth(clientId, clientSecret);
}
}
Expand Down Expand Up @@ -230,4 +235,17 @@ public void setWebClient(WebClient webClient) {
this.webClient = webClient;
}

/**
* Sets the flag that controls whether client credentials are encoded using the
* application/x-www-form-urlencoded algorithm while populating token request headers.
* @deprecated Support for non-compliant providers will be removed in Spring Security
* 5.6
* @param encodeClientCredentials {@code false} to disable encoding client credentials
* (default is true)
*/
@Deprecated
public void setEncodeClientCredentials(boolean encodeClientCredentials) {
this.encodeClientCredentials = encodeClientCredentials;
}

}
8 changes: 5 additions & 3 deletions ...framework/security/oauth2/client/endpoint/OAuth2AuthorizationGrantRequestEntityUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,13 +46,15 @@ final class OAuth2AuthorizationGrantRequestEntityUtils {
private OAuth2AuthorizationGrantRequestEntityUtils() {
}

static HttpHeaders getTokenRequestHeaders(ClientRegistration clientRegistration) {
static HttpHeaders getTokenRequestHeaders(ClientRegistration clientRegistration, boolean encodeClientCredentials) {
HttpHeaders headers = new HttpHeaders();
headers.addAll(DEFAULT_TOKEN_REQUEST_HEADERS);
if (ClientAuthenticationMethod.CLIENT_SECRET_BASIC.equals(clientRegistration.getClientAuthenticationMethod())
|| ClientAuthenticationMethod.BASIC.equals(clientRegistration.getClientAuthenticationMethod())) {
String clientId = encodeClientCredential(clientRegistration.getClientId());
String clientSecret = encodeClientCredential(clientRegistration.getClientSecret());
String clientId = encodeClientCredentials ? encodeClientCredential(clientRegistration.getClientId())
: clientRegistration.getClientId();
String clientSecret = encodeClientCredentials ? encodeClientCredential(clientRegistration.getClientSecret())
: clientRegistration.getClientSecret();
headers.setBasicAuth(clientId, clientSecret);
}
return headers;
Expand Down