Use OAuth2 token_type equal "Bearer" by default everywhere

[karwer]

There is a line
private String tokenType = BEARER_TYPE.toLowerCase();
in DefaultOAuth2AccessToken class. Isn't it inconsistent with RFC stating that the type name should be "Bearer" (https://tools.ietf.org/html/rfc6750#section-6.1.1)?

[dsyer]

Historical reasons (that's the way we inherited this project). The RFC used to say it was case insensitive, but I can't find that bit now, so it must have changed. I suspect this might be a breaking change for some apps, so we probably ought to wait till 2.1 to change it. The client always sends back the token type it gets from the server though, so in practice it probably often doesn't matter much.

[bassman5]

This causes a problem on https://github.com/spring-cloud/spring-cloud-security/blob/master/src/main/java/org/springframework/cloud/security/oauth2/resource/UserInfoTokenServices.java#L102-L103 that creates a token without setting the type.
This means that the userInfoUri request (and tokenInfoUri) are made with Authentication: "bearer xxx" which fails for Google+.
Changing to "Bearer" fixes this issue. This issue may also be causing spring-attic/spring-cloud-security#59

[dsyer]

Yeah I know, but it's not something that will get fixed here in 2.0.* (as already explained). The spring cloud bug you mentioned is unrelated, but if you are using spring cloud there are workarounds available (look through github issues for mentions of toke type). The best one is to only send tokens from a rest template that was used to obtain the token (because the token type usually comes with the response from the /token endpoint). If you can't do that then you need to customize the rest template, adding your own "authenticator" (it's a standard extension point in spring oauth).

[bassman5]

Thanks, I am overriding loadAuthentication in my own UserInfoTokenServices so I can set the tokenType on the token in my version of getMap for now.

[kelsin]

Hey guys, just want to point out that the token type field that is returned with an access token IS case insensitive: https://tools.ietf.org/html/rfc6749#section-4.2.2

When USING bearer tokens you need to pass the string "Bearer" (as linked in the RFC by @karwer) but it's improper to ever take the string returned as token_type and pass it along in an Authorization header without some logic involved with the token type.

IMHO not returning the token type with access tokens as lower case implies associations that are not officially there in the specs. We've dealt with many clients trying to use our OAuth server with clients that do not follow the spec, and the behavior right now on spring security (in this regard) seems perfect and on-spec to me.

[karwer]

OK, I missed the statement that it is case insensitive. So perhaps there is no point in changing this indeed.

[RogerVanHertsen]

Case-insensitivity applies for the token type field. However there is no ambiguity on the casing in the request headers it should be 'Bearer'. This should be addressed as multiple APIs respect this strictly.

[dsyer]

Spring Cloud now has "Bearer" by default for the user info endpoint (which is the only place anyone ever complained about this), and a configuration setting for changing it if you need to. See spring-attic/spring-cloud-security#63.

[lukeway]

We ran into this issue with someone using and old version of WSO2 API Manager (<1.8.0):

https://wso2.org/jira/browse/APIMANAGER-2921

The "bug" was fixed in that software, but we had no control over the service side and could not upgrade. Our hacky solution was to copy DefaultOAuth2AccessToken into our project and make the following changes:

private String tokenType = BEARER_TYPE; // Removed toLowerCase()

and

    public void setTokenType(String tokenType) {
        if(BEARER_TYPE.equalsIgnoreCase(tokenType)) {
            // Force "Bearer" for any case variation
            this.tokenType = BEARER_TYPE;
        } else {
            // Otherwise use as-is
            this.tokenType = tokenType;
        }
    }

Not a great solution, but it worked for us.

[oli99sc]

Just hitting the same problem, with a scala based resource server (that only checks for Bearer).
Regarding comment of @kelsin, rfc6749 describes the data returned by the auth server, https://tools.ietf.org/html/rfc6750#section-2.1 describes Bearer token handling in Request header. Here it does not say anything about case insensitive and uses "Bearer"

[nicodewet]

You'll run into this when integrating with WSO2 Identity Server 5.0

With spring-security-oauth2 2.0.8.RELEASE I just included this class.

public class WSO2OAuth2RequestAuthenticator extends DefaultOAuth2RequestAuthenticator {
  @Override
  public void authenticate(OAuth2ProtectedResourceDetails resource,
      OAuth2ClientContext clientContext, ClientHttpRequest request) {
    OAuth2AccessToken accessToken = clientContext.getAccessToken();
    String tokenType = OAuth2AccessToken.BEARER_TYPE;
    request.getHeaders().set("Authorization",
        String.format("%s %s", tokenType, accessToken.getValue()));
  }
}