Skip to content

Commit 798c48e

Browse files
jgrandjajgrandja
committed
Remove redundant validation for redirect-uri
Fixes gh-7706
1 parent b7f1bda commit 798c48e

File tree

8 files changed

+6
-103
lines changed

8 files changed

+6
-103
lines changed

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/authentication/OAuth2AuthorizationExchangeValidator.java

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -30,7 +30,6 @@
3030
*/
3131
final class OAuth2AuthorizationExchangeValidator {
3232
private static final String INVALID_STATE_PARAMETER_ERROR_CODE = "invalid_state_parameter";
33-
private static final String INVALID_REDIRECT_URI_PARAMETER_ERROR_CODE = "invalid_redirect_uri_parameter";
3433

3534
static void validate(OAuth2AuthorizationExchange authorizationExchange) {
3635
OAuth2AuthorizationRequest authorizationRequest = authorizationExchange.getAuthorizationRequest();
@@ -44,10 +43,5 @@ static void validate(OAuth2AuthorizationExchange authorizationExchange) {
4443
OAuth2Error oauth2Error = new OAuth2Error(INVALID_STATE_PARAMETER_ERROR_CODE);
4544
throw new OAuth2AuthorizationException(oauth2Error);
4645
}
47-
48-
if (!authorizationResponse.getRedirectUri().equals(authorizationRequest.getRedirectUri())) {
49-
OAuth2Error oauth2Error = new OAuth2Error(INVALID_REDIRECT_URI_PARAMETER_ERROR_CODE);
50-
throw new OAuth2AuthorizationException(oauth2Error);
51-
}
5246
}
5347
}

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/authentication/OidcAuthorizationCodeAuthenticationProvider.java

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,6 @@
7373
*/
7474
public class OidcAuthorizationCodeAuthenticationProvider implements AuthenticationProvider {
7575
private static final String INVALID_STATE_PARAMETER_ERROR_CODE = "invalid_state_parameter";
76-
private static final String INVALID_REDIRECT_URI_PARAMETER_ERROR_CODE = "invalid_redirect_uri_parameter";
7776
private static final String INVALID_ID_TOKEN_ERROR_CODE = "invalid_id_token";
7877
private static final String MISSING_SIGNATURE_VERIFIER_ERROR_CODE = "missing_signature_verifier";
7978
private final OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> accessTokenResponseClient;
@@ -127,11 +126,6 @@ public Authentication authenticate(Authentication authentication) throws Authent
127126
throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
128127
}
129128

130-
if (!authorizationResponse.getRedirectUri().equals(authorizationRequest.getRedirectUri())) {
131-
OAuth2Error oauth2Error = new OAuth2Error(INVALID_REDIRECT_URI_PARAMETER_ERROR_CODE);
132-
throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
133-
}
134-
135129
OAuth2AccessTokenResponse accessTokenResponse;
136130
try {
137131
accessTokenResponse = this.accessTokenResponseClient.getTokenResponse(

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/authentication/OidcAuthorizationCodeReactiveAuthenticationManager.java

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,6 @@ public class OidcAuthorizationCodeReactiveAuthenticationManager implements
7676
ReactiveAuthenticationManager {
7777

7878
private static final String INVALID_STATE_PARAMETER_ERROR_CODE = "invalid_state_parameter";
79-
private static final String INVALID_REDIRECT_URI_PARAMETER_ERROR_CODE = "invalid_redirect_uri_parameter";
8079
private static final String INVALID_ID_TOKEN_ERROR_CODE = "invalid_id_token";
8180
private static final String MISSING_SIGNATURE_VERIFIER_ERROR_CODE = "missing_signature_verifier";
8281

@@ -127,11 +126,6 @@ public Mono<Authentication> authenticate(Authentication authentication) {
127126
throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
128127
}
129128

130-
if (!authorizationResponse.getRedirectUri().equals(authorizationRequest.getRedirectUri())) {
131-
OAuth2Error oauth2Error = new OAuth2Error(INVALID_REDIRECT_URI_PARAMETER_ERROR_CODE);
132-
throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
133-
}
134-
135129
OAuth2AuthorizationCodeGrantRequest authzRequest = new OAuth2AuthorizationCodeGrantRequest(
136130
authorizationCodeAuthentication.getClientRegistration(),
137131
authorizationCodeAuthentication.getAuthorizationExchange());

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/authentication/OAuth2AuthorizationCodeAuthenticationProviderTests.java

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -108,18 +108,6 @@ public void authenticateWhenAuthorizationResponseStateNotEqualAuthorizationReque
108108
}).isInstanceOf(OAuth2AuthorizationException.class).hasMessageContaining("invalid_state_parameter");
109109
}
110110

111-
@Test
112-
public void authenticateWhenAuthorizationResponseRedirectUriNotEqualAuthorizationRequestRedirectUriThenThrowOAuth2AuthorizationException() {
113-
when(this.authorizationRequest.getRedirectUri()).thenReturn("https://example.com");
114-
when(this.authorizationResponse.getRedirectUri()).thenReturn("https://example2.com");
115-
116-
assertThatThrownBy(() -> {
117-
this.authenticationProvider.authenticate(
118-
new OAuth2AuthorizationCodeAuthenticationToken(
119-
this.clientRegistration, this.authorizationExchange));
120-
}).isInstanceOf(OAuth2AuthorizationException.class).hasMessageContaining("invalid_redirect_uri_parameter");
121-
}
122-
123111
@Test
124112
public void authenticateWhenAuthorizationSuccessResponseThenExchangedForAccessToken() {
125113
OAuth2AccessToken accessToken = mock(OAuth2AccessToken.class);

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/authentication/OAuth2AuthorizationCodeReactiveAuthenticationManagerTests.java

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -80,13 +80,6 @@ public void authenticateWhenStateNotEqualThenOAuth2AuthorizationException() {
8080
.isInstanceOf(OAuth2AuthorizationException.class);
8181
}
8282

83-
@Test
84-
public void authenticateWhenRedirectUriNotEqualThenOAuth2AuthorizationException() {
85-
this.authorizationRequest.redirectUri("https://example.org/notequal");
86-
assertThatCode(() -> authenticate())
87-
.isInstanceOf(OAuth2AuthorizationException.class);
88-
}
89-
9083
@Test
9184
public void authenticateWhenValidThenSuccess() {
9285
when(this.accessTokenResponseClient.getTokenResponse(any())).thenReturn(Mono.just(this.tokenResponse.build()));

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/authentication/OAuth2LoginAuthenticationProviderTests.java

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -154,18 +154,6 @@ public void authenticateWhenAuthorizationResponseStateNotEqualAuthorizationReque
154154
new OAuth2LoginAuthenticationToken(this.clientRegistration, this.authorizationExchange));
155155
}
156156

157-
@Test
158-
public void authenticateWhenAuthorizationResponseRedirectUriNotEqualAuthorizationRequestRedirectUriThenThrowOAuth2AuthenticationException() {
159-
this.exception.expect(OAuth2AuthenticationException.class);
160-
this.exception.expectMessage(containsString("invalid_redirect_uri_parameter"));
161-
162-
when(this.authorizationRequest.getRedirectUri()).thenReturn("https://example.com");
163-
when(this.authorizationResponse.getRedirectUri()).thenReturn("https://example2.com");
164-
165-
this.authenticationProvider.authenticate(
166-
new OAuth2LoginAuthenticationToken(this.clientRegistration, this.authorizationExchange));
167-
}
168-
169157
@Test
170158
public void authenticateWhenLoginSuccessThenReturnAuthentication() {
171159
OAuth2AccessTokenResponse accessTokenResponse = this.accessTokenSuccessResponse();

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/oidc/authentication/OidcAuthorizationCodeAuthenticationProviderTests.java

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -169,18 +169,6 @@ public void authenticateWhenAuthorizationResponseStateNotEqualAuthorizationReque
169169
new OAuth2LoginAuthenticationToken(this.clientRegistration, this.authorizationExchange));
170170
}
171171

172-
@Test
173-
public void authenticateWhenAuthorizationResponseRedirectUriNotEqualAuthorizationRequestRedirectUriThenThrowOAuth2AuthenticationException() {
174-
this.exception.expect(OAuth2AuthenticationException.class);
175-
this.exception.expectMessage(containsString("invalid_redirect_uri_parameter"));
176-
177-
when(this.authorizationRequest.getRedirectUri()).thenReturn("https://example1.com");
178-
when(this.authorizationResponse.getRedirectUri()).thenReturn("https://example2.com");
179-
180-
this.authenticationProvider.authenticate(
181-
new OAuth2LoginAuthenticationToken(this.clientRegistration, this.authorizationExchange));
182-
}
183-
184172
@Test
185173
public void authenticateWhenTokenResponseDoesNotContainIdTokenThenThrowOAuth2AuthenticationException() {
186174
this.exception.expect(OAuth2AuthenticationException.class);

‎samples/boot/oauth2login/src/integration-test/java/org/springframework/security/samples/OAuth2LoginApplicationTests.java

Lines changed: 1 addition & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -255,42 +255,6 @@ public void requestAuthorizationCodeGrantWhenInvalidStateParamThenDisplayLoginPa
255255
assertThat(errorElement.asText()).contains("authorization_request_not_found");
256256
}
257257

258-
@Test
259-
public void requestAuthorizationCodeGrantWhenInvalidRedirectUriThenDisplayLoginPageWithError() throws Exception {
260-
HtmlPage page = this.webClient.getPage("/");
261-
URL loginPageUrl = page.getBaseURL();
262-
URL loginErrorPageUrl = new URL(loginPageUrl.toString() + "?error");
263-
264-
ClientRegistration clientRegistration = this.clientRegistrationRepository.findByRegistrationId("google");
265-
266-
HtmlAnchor clientAnchorElement = this.getClientAnchorElement(page, clientRegistration);
267-
assertThat(clientAnchorElement).isNotNull();
268-
269-
WebResponse response = this.followLinkDisableRedirects(clientAnchorElement);
270-
271-
UriComponents authorizeRequestUriComponents = UriComponentsBuilder.fromUri(
272-
URI.create(response.getResponseHeaderValue("Location"))).build();
273-
274-
Map<String, String> params = authorizeRequestUriComponents.getQueryParams().toSingleValueMap();
275-
String code = "auth-code";
276-
String state = URLDecoder.decode(params.get(OAuth2ParameterNames.STATE), "UTF-8");
277-
String redirectUri = URLDecoder.decode(params.get(OAuth2ParameterNames.REDIRECT_URI), "UTF-8");
278-
redirectUri += "-invalid";
279-
280-
String authorizationResponseUri =
281-
UriComponentsBuilder.fromHttpUrl(redirectUri)
282-
.queryParam(OAuth2ParameterNames.CODE, code)
283-
.queryParam(OAuth2ParameterNames.STATE, state)
284-
.build().encode().toUriString();
285-
286-
page = this.webClient.getPage(new URL(authorizationResponseUri));
287-
assertThat(page.getBaseURL()).isEqualTo(loginErrorPageUrl);
288-
289-
HtmlElement errorElement = page.getBody().getFirstByXPath("div");
290-
assertThat(errorElement).isNotNull();
291-
assertThat(errorElement.asText()).contains("invalid_redirect_uri_parameter");
292-
}
293-
294258
private void assertLoginPage(HtmlPage page) throws Exception {
295259
assertThat(page.getTitleText()).isEqualTo("Please sign in");
296260

0 commit comments

Comments
 (0)