Skip to content

validate client secret expired or not #862

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 4 commits into from
Closed

validate client secret expired or not #862

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
641b201
validate client secret expired or not
liuyunsh Aug 18, 2022
15437db
add negative unit test case on ClientSecretAuthenticationProviderTests
liuyunsh Aug 19, 2022
4e6b1d1
set the client secret expired 1 hour ago
liuyunsh Aug 19, 2022
74e1629
rebase 0.4.x and also removed some duplicate method
liuyunsh Aug 25, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions ...curity/oauth2/server/authorization/authentication/ClientSecretAuthenticationProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@
*/
package org.springframework.security.oauth2.server.authorization.authentication;

import java.time.Instant;

import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
Expand Down Expand Up @@ -107,6 +109,11 @@ public Authentication authenticate(Authentication authentication) throws Authent
throwInvalidClient(OAuth2ParameterNames.CLIENT_SECRET);
}

if (registeredClient.getClientSecretExpiresAt() != null &&
Instant.now().isAfter(registeredClient.getClientSecretExpiresAt())) {
throwInvalidClient("client_secret_expires_at");
}

// Validate the "code_verifier" parameter for the confidential client, if available
this.codeVerifierAuthenticator.authenticateIfAvailable(clientAuthentication, registeredClient);

Expand Down
18 changes: 18 additions & 0 deletions ...y/oauth2/server/authorization/authentication/ClientSecretAuthenticationProviderTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,6 +182,24 @@ public void authenticateWhenInvalidClientSecretThenThrowOAuth2AuthenticationExce
verify(this.passwordEncoder).matches(any(), any());
}

@Test
public void authenticateWhenExpiredClientSecretThenThrowOAuth2AuthenticationException() {
RegisteredClient registeredClient = TestRegisteredClients.registeredClient4().build();
when(this.registeredClientRepository.findByClientId(eq(registeredClient.getClientId())))
.thenReturn(registeredClient);

OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken(
registeredClient.getClientId(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret(), null);
assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication))
.isInstanceOf(OAuth2AuthenticationException.class)
.extracting(ex -> ((OAuth2AuthenticationException) ex).getError())
.satisfies(error -> {
assertThat(error.getErrorCode()).isEqualTo(OAuth2ErrorCodes.INVALID_CLIENT);
assertThat(error.getDescription()).contains("client_secret_expires_at");
});
verify(this.passwordEncoder).matches(any(), any());
}

@Test
public void authenticateWhenValidCredentialsThenAuthenticated() {
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
Expand Down
16 changes: 16 additions & 0 deletions ...rg/springframework/security/oauth2/server/authorization/client/TestRegisteredClients.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,4 +64,20 @@ public static RegisteredClient.Builder registeredPublicClient() {
.scope("scope1")
.clientSettings(ClientSettings.builder().requireProofKey(true).build());
}

public static RegisteredClient.Builder registeredClient4() {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove this and reuse TestRegisteredClients.registeredClient(), which returns the Builder and allows you to update clientSecretExpiresAt()

return RegisteredClient.withId("registration-4")
.clientId("client-4")
.clientIdIssuedAt(Instant.now().minus(1, ChronoUnit.DAYS).truncatedTo(ChronoUnit.SECONDS))
.clientSecret("secret")
.clientSecretExpiresAt(Instant.now().minus(1, ChronoUnit.HOURS).truncatedTo(ChronoUnit.SECONDS))
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST)
.redirectUri("https://example.com")
.scope("scope1")
.scope("scope2");
}
}