Skip to content

Commit 1a261e8

Browse files
jgrandjajgrandja
committed
Polish OAuth2AuthorizationEndpointFilterTests
Issue spring-projectsgh-77
1 parent 5ea583a commit 1a261e8

File tree

1 file changed

+57
-82
lines changed

1 file changed

+57
-82
lines changed

‎core/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationEndpointFilterTests.java

+57-82
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import org.springframework.security.core.context.SecurityContext;
2727
import org.springframework.security.core.context.SecurityContextHolder;
2828
import org.springframework.security.oauth2.core.AuthorizationGrantType;
29+
import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
2930
import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
3031
import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationResponseType;
3132
import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
@@ -41,6 +42,7 @@
4142
import javax.servlet.http.HttpServletRequest;
4243
import javax.servlet.http.HttpServletResponse;
4344
import java.util.Set;
45+
import java.util.function.Consumer;
4446

4547
import static org.assertj.core.api.Assertions.assertThat;
4648
import static org.assertj.core.api.Assertions.assertThatThrownBy;
@@ -130,53 +132,29 @@ public void doFilterWhenAuthorizationRequestPostThenNotProcessed() throws Except
130132

131133
@Test
132134
public void doFilterWhenAuthorizationRequestMissingClientIdThenInvalidRequestError() throws Exception {
133-
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
134-
135-
MockHttpServletRequest request = createAuthorizationRequest(registeredClient);
136-
request.removeParameter(OAuth2ParameterNames.CLIENT_ID);
137-
MockHttpServletResponse response = new MockHttpServletResponse();
138-
FilterChain filterChain = mock(FilterChain.class);
139-
140-
this.filter.doFilter(request, response, filterChain);
141-
142-
verifyNoInteractions(filterChain);
143-
144-
assertThat(response.getStatus()).isEqualTo(HttpStatus.BAD_REQUEST.value());
145-
assertThat(response.getErrorMessage()).isEqualTo("[invalid_request] OAuth 2.0 Parameter: client_id");
135+
doFilterWhenAuthorizationRequestInvalidParameterThenError(
136+
TestRegisteredClients.registeredClient().build(),
137+
OAuth2ParameterNames.CLIENT_ID,
138+
OAuth2ErrorCodes.INVALID_REQUEST,
139+
request -> request.removeParameter(OAuth2ParameterNames.CLIENT_ID));
146140
}
147141

148142
@Test
149143
public void doFilterWhenAuthorizationRequestMultipleClientIdThenInvalidRequestError() throws Exception {
150-
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
151-
152-
MockHttpServletRequest request = createAuthorizationRequest(registeredClient);
153-
request.addParameter(OAuth2ParameterNames.CLIENT_ID, registeredClient.getClientId());
154-
MockHttpServletResponse response = new MockHttpServletResponse();
155-
FilterChain filterChain = mock(FilterChain.class);
156-
157-
this.filter.doFilter(request, response, filterChain);
158-
159-
verifyNoInteractions(filterChain);
160-
161-
assertThat(response.getStatus()).isEqualTo(HttpStatus.BAD_REQUEST.value());
162-
assertThat(response.getErrorMessage()).isEqualTo("[invalid_request] OAuth 2.0 Parameter: client_id");
144+
doFilterWhenAuthorizationRequestInvalidParameterThenError(
145+
TestRegisteredClients.registeredClient().build(),
146+
OAuth2ParameterNames.CLIENT_ID,
147+
OAuth2ErrorCodes.INVALID_REQUEST,
148+
request -> request.addParameter(OAuth2ParameterNames.CLIENT_ID, "client-2"));
163149
}
164150

165151
@Test
166152
public void doFilterWhenAuthorizationRequestInvalidClientIdThenInvalidRequestError() throws Exception {
167-
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
168-
169-
MockHttpServletRequest request = createAuthorizationRequest(registeredClient);
170-
request.setParameter(OAuth2ParameterNames.CLIENT_ID, "invalid");
171-
MockHttpServletResponse response = new MockHttpServletResponse();
172-
FilterChain filterChain = mock(FilterChain.class);
173-
174-
this.filter.doFilter(request, response, filterChain);
175-
176-
verifyNoInteractions(filterChain);
177-
178-
assertThat(response.getStatus()).isEqualTo(HttpStatus.BAD_REQUEST.value());
179-
assertThat(response.getErrorMessage()).isEqualTo("[invalid_request] OAuth 2.0 Parameter: client_id");
153+
doFilterWhenAuthorizationRequestInvalidParameterThenError(
154+
TestRegisteredClients.registeredClient().build(),
155+
OAuth2ParameterNames.CLIENT_ID,
156+
OAuth2ErrorCodes.INVALID_REQUEST,
157+
request -> request.setParameter(OAuth2ParameterNames.CLIENT_ID, "invalid"));
180158
}
181159

182160
@Test
@@ -188,16 +166,10 @@ public void doFilterWhenAuthorizationRequestAndClientNotAuthorizedToRequestCodeT
188166
when(this.registeredClientRepository.findByClientId((eq(registeredClient.getClientId()))))
189167
.thenReturn(registeredClient);
190168

191-
MockHttpServletRequest request = createAuthorizationRequest(registeredClient);
192-
MockHttpServletResponse response = new MockHttpServletResponse();
193-
FilterChain filterChain = mock(FilterChain.class);
194-
195-
this.filter.doFilter(request, response, filterChain);
196-
197-
verifyNoInteractions(filterChain);
198-
199-
assertThat(response.getStatus()).isEqualTo(HttpStatus.BAD_REQUEST.value());
200-
assertThat(response.getErrorMessage()).isEqualTo("[unauthorized_client] OAuth 2.0 Parameter: client_id");
169+
doFilterWhenAuthorizationRequestInvalidParameterThenError(
170+
registeredClient,
171+
OAuth2ParameterNames.CLIENT_ID,
172+
OAuth2ErrorCodes.UNAUTHORIZED_CLIENT);
201173
}
202174

203175
@Test
@@ -206,17 +178,11 @@ public void doFilterWhenAuthorizationRequestInvalidRedirectUriThenInvalidRequest
206178
when(this.registeredClientRepository.findByClientId((eq(registeredClient.getClientId()))))
207179
.thenReturn(registeredClient);
208180

209-
MockHttpServletRequest request = createAuthorizationRequest(registeredClient);
210-
request.setParameter(OAuth2ParameterNames.REDIRECT_URI, "https://invalid-example.com");
211-
MockHttpServletResponse response = new MockHttpServletResponse();
212-
FilterChain filterChain = mock(FilterChain.class);
213-
214-
this.filter.doFilter(request, response, filterChain);
215-
216-
verifyNoInteractions(filterChain);
217-
218-
assertThat(response.getStatus()).isEqualTo(HttpStatus.BAD_REQUEST.value());
219-
assertThat(response.getErrorMessage()).isEqualTo("[invalid_request] OAuth 2.0 Parameter: redirect_uri");
181+
doFilterWhenAuthorizationRequestInvalidParameterThenError(
182+
registeredClient,
183+
OAuth2ParameterNames.REDIRECT_URI,
184+
OAuth2ErrorCodes.INVALID_REQUEST,
185+
request -> request.setParameter(OAuth2ParameterNames.REDIRECT_URI, "https://invalid-example.com"));
220186
}
221187

222188
@Test
@@ -225,17 +191,11 @@ public void doFilterWhenAuthorizationRequestMultipleRedirectUriThenInvalidReques
225191
when(this.registeredClientRepository.findByClientId((eq(registeredClient.getClientId()))))
226192
.thenReturn(registeredClient);
227193

228-
MockHttpServletRequest request = createAuthorizationRequest(registeredClient);
229-
request.addParameter(OAuth2ParameterNames.REDIRECT_URI, "https://example2.com");
230-
MockHttpServletResponse response = new MockHttpServletResponse();
231-
FilterChain filterChain = mock(FilterChain.class);
232-
233-
this.filter.doFilter(request, response, filterChain);
234-
235-
verifyNoInteractions(filterChain);
236-
237-
assertThat(response.getStatus()).isEqualTo(HttpStatus.BAD_REQUEST.value());
238-
assertThat(response.getErrorMessage()).isEqualTo("[invalid_request] OAuth 2.0 Parameter: redirect_uri");
194+
doFilterWhenAuthorizationRequestInvalidParameterThenError(
195+
registeredClient,
196+
OAuth2ParameterNames.REDIRECT_URI,
197+
OAuth2ErrorCodes.INVALID_REQUEST,
198+
request -> request.addParameter(OAuth2ParameterNames.REDIRECT_URI, "https://example2.com"));
239199
}
240200

241201
@Test
@@ -244,17 +204,11 @@ public void doFilterWhenAuthorizationRequestExcludesRedirectUriAndMultipleRegist
244204
when(this.registeredClientRepository.findByClientId((eq(registeredClient.getClientId()))))
245205
.thenReturn(registeredClient);
246206

247-
MockHttpServletRequest request = createAuthorizationRequest(registeredClient);
248-
request.removeParameter(OAuth2ParameterNames.REDIRECT_URI);
249-
MockHttpServletResponse response = new MockHttpServletResponse();
250-
FilterChain filterChain = mock(FilterChain.class);
251-
252-
this.filter.doFilter(request, response, filterChain);
253-
254-
verifyNoInteractions(filterChain);
255-
256-
assertThat(response.getStatus()).isEqualTo(HttpStatus.BAD_REQUEST.value());
257-
assertThat(response.getErrorMessage()).isEqualTo("[invalid_request] OAuth 2.0 Parameter: redirect_uri");
207+
doFilterWhenAuthorizationRequestInvalidParameterThenError(
208+
registeredClient,
209+
OAuth2ParameterNames.REDIRECT_URI,
210+
OAuth2ErrorCodes.INVALID_REQUEST,
211+
request -> request.removeParameter(OAuth2ParameterNames.REDIRECT_URI));
258212
}
259213

260214
@Test
@@ -383,6 +337,27 @@ public void doFilterWhenAuthorizationRequestValidThenAuthorizationResponse() thr
383337
assertThat(authorizationRequest.getAdditionalParameters()).isEmpty();
384338
}
385339

340+
private void doFilterWhenAuthorizationRequestInvalidParameterThenError(RegisteredClient registeredClient,
341+
String parameterName, String errorCode) throws Exception {
342+
doFilterWhenAuthorizationRequestInvalidParameterThenError(registeredClient, parameterName, errorCode, request -> {});
343+
}
344+
345+
private void doFilterWhenAuthorizationRequestInvalidParameterThenError(RegisteredClient registeredClient,
346+
String parameterName, String errorCode, Consumer<MockHttpServletRequest> requestConsumer) throws Exception {
347+
348+
MockHttpServletRequest request = createAuthorizationRequest(registeredClient);
349+
requestConsumer.accept(request);
350+
MockHttpServletResponse response = new MockHttpServletResponse();
351+
FilterChain filterChain = mock(FilterChain.class);
352+
353+
this.filter.doFilter(request, response, filterChain);
354+
355+
verifyNoInteractions(filterChain);
356+
357+
assertThat(response.getStatus()).isEqualTo(HttpStatus.BAD_REQUEST.value());
358+
assertThat(response.getErrorMessage()).isEqualTo("[" + errorCode + "] OAuth 2.0 Parameter: " + parameterName);
359+
}
360+
386361
private static MockHttpServletRequest createAuthorizationRequest(RegisteredClient registeredClient) {
387362
String[] redirectUris = registeredClient.getRedirectUris().toArray(new String[0]);
388363

0 commit comments

Comments
 (0)