Skip to content

Commit 6cafa48

Browse files
author
Steve Riesenberg
committed
URL encode client credentials
Closes gh-9610
1 parent 5b802a4 commit 6cafa48

File tree

4 files changed

+116
-11
lines changed

4 files changed

+116
-11
lines changed

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/AbstractWebClientReactiveOAuth2AccessTokenResponseClient.java

+22-6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2021 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -15,6 +15,14 @@
1515
*/
1616
package org.springframework.security.oauth2.client.endpoint;
1717

18+
import java.io.UnsupportedEncodingException;
19+
import java.net.URLEncoder;
20+
import java.nio.charset.StandardCharsets;
21+
import java.util.Collections;
22+
import java.util.Set;
23+
24+
import reactor.core.publisher.Mono;
25+
1826
import org.springframework.http.HttpHeaders;
1927
import org.springframework.http.MediaType;
2028
import org.springframework.security.oauth2.client.registration.ClientRegistration;
@@ -27,10 +35,6 @@
2735
import org.springframework.web.reactive.function.BodyInserters;
2836
import org.springframework.web.reactive.function.client.ClientResponse;
2937
import org.springframework.web.reactive.function.client.WebClient;
30-
import reactor.core.publisher.Mono;
31-
32-
import java.util.Collections;
33-
import java.util.Set;
3438

3539
import static org.springframework.security.oauth2.core.web.reactive.function.OAuth2BodyExtractors.oauth2AccessTokenResponse;
3640

@@ -86,7 +90,19 @@ private void populateTokenRequestHeaders(T grantRequest, HttpHeaders headers) {
8690
headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
8791
headers.setAccept(Collections.singletonList(MediaType.APPLICATION_JSON));
8892
if (ClientAuthenticationMethod.BASIC.equals(clientRegistration.getClientAuthenticationMethod())) {
89-
headers.setBasicAuth(clientRegistration.getClientId(), clientRegistration.getClientSecret());
93+
String clientId = encodeClientCredential(clientRegistration.getClientId());
94+
String clientSecret = encodeClientCredential(clientRegistration.getClientSecret());
95+
headers.setBasicAuth(clientId, clientSecret);
96+
}
97+
}
98+
99+
private static String encodeClientCredential(String clientCredential) {
100+
try {
101+
return URLEncoder.encode(clientCredential, StandardCharsets.UTF_8.toString());
102+
}
103+
catch (UnsupportedEncodingException ex) {
104+
// Will not happen since UTF-8 is a standard charset
105+
throw new IllegalArgumentException(ex);
90106
}
91107
}
92108

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/OAuth2AuthorizationGrantRequestEntityUtils.java

+19-4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2021 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -15,15 +15,18 @@
1515
*/
1616
package org.springframework.security.oauth2.client.endpoint;
1717

18+
import java.io.UnsupportedEncodingException;
19+
import java.net.URLEncoder;
20+
import java.nio.charset.StandardCharsets;
21+
import java.util.Collections;
22+
1823
import org.springframework.core.convert.converter.Converter;
1924
import org.springframework.http.HttpHeaders;
2025
import org.springframework.http.MediaType;
2126
import org.springframework.http.RequestEntity;
2227
import org.springframework.security.oauth2.client.registration.ClientRegistration;
2328
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
2429

25-
import java.util.Collections;
26-
2730
import static org.springframework.http.MediaType.APPLICATION_FORM_URLENCODED_VALUE;
2831

2932
/**
@@ -44,11 +47,23 @@ static HttpHeaders getTokenRequestHeaders(ClientRegistration clientRegistration)
4447
HttpHeaders headers = new HttpHeaders();
4548
headers.addAll(DEFAULT_TOKEN_REQUEST_HEADERS);
4649
if (ClientAuthenticationMethod.BASIC.equals(clientRegistration.getClientAuthenticationMethod())) {
47-
headers.setBasicAuth(clientRegistration.getClientId(), clientRegistration.getClientSecret());
50+
String clientId = encodeClientCredential(clientRegistration.getClientId());
51+
String clientSecret = encodeClientCredential(clientRegistration.getClientSecret());
52+
headers.setBasicAuth(clientId, clientSecret);
4853
}
4954
return headers;
5055
}
5156

57+
private static String encodeClientCredential(String clientCredential) {
58+
try {
59+
return URLEncoder.encode(clientCredential, StandardCharsets.UTF_8.toString());
60+
}
61+
catch (UnsupportedEncodingException ex) {
62+
// Will not happen since UTF-8 is a standard charset
63+
throw new IllegalArgumentException(ex);
64+
}
65+
}
66+
5267
private static HttpHeaders getDefaultTokenRequestHeaders() {
5368
HttpHeaders headers = new HttpHeaders();
5469
headers.setAccept(Collections.singletonList(MediaType.APPLICATION_JSON_UTF8));

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/endpoint/OAuth2ClientCredentialsGrantRequestEntityConverterTests.java

+40
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,20 @@
1515
*/
1616
package org.springframework.security.oauth2.client.endpoint;
1717

18+
import java.io.UnsupportedEncodingException;
19+
import java.net.URLEncoder;
20+
import java.nio.charset.StandardCharsets;
21+
import java.util.Base64;
22+
1823
import org.junit.Before;
1924
import org.junit.Test;
25+
2026
import org.springframework.http.HttpHeaders;
2127
import org.springframework.http.HttpMethod;
2228
import org.springframework.http.MediaType;
2329
import org.springframework.http.RequestEntity;
2430
import org.springframework.security.oauth2.client.registration.ClientRegistration;
31+
import org.springframework.security.oauth2.client.registration.TestClientRegistrations;
2532
import org.springframework.security.oauth2.core.AuthorizationGrantType;
2633
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
2734
import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
@@ -74,4 +81,37 @@ public void convertWhenGrantRequestValidThenConverts() {
7481
AuthorizationGrantType.CLIENT_CREDENTIALS.getValue());
7582
assertThat(formParameters.getFirst(OAuth2ParameterNames.SCOPE)).isEqualTo("read write");
7683
}
84+
85+
// gh-9610
86+
@SuppressWarnings("unchecked")
87+
@Test
88+
public void convertWhenSpecialCharactersThenConvertsWithEncodedClientCredentials()
89+
throws UnsupportedEncodingException {
90+
String clientCredentialWithAnsiKeyboardSpecialCharacters = "~!@#$%^&*()_+{}|:\"<>?`-=[]\\;',./ ";
91+
// @formatter:off
92+
ClientRegistration clientRegistration = TestClientRegistrations.clientCredentials()
93+
.clientId(clientCredentialWithAnsiKeyboardSpecialCharacters)
94+
.clientSecret(clientCredentialWithAnsiKeyboardSpecialCharacters)
95+
.build();
96+
// @formatter:on
97+
OAuth2ClientCredentialsGrantRequest clientCredentialsGrantRequest = new OAuth2ClientCredentialsGrantRequest(
98+
clientRegistration);
99+
RequestEntity<?> requestEntity = this.converter.convert(clientCredentialsGrantRequest);
100+
assertThat(requestEntity.getMethod()).isEqualTo(HttpMethod.POST);
101+
assertThat(requestEntity.getUrl().toASCIIString())
102+
.isEqualTo(clientRegistration.getProviderDetails().getTokenUri());
103+
HttpHeaders headers = requestEntity.getHeaders();
104+
assertThat(headers.getAccept()).contains(MediaType.APPLICATION_JSON_UTF8);
105+
assertThat(headers.getContentType())
106+
.isEqualTo(MediaType.valueOf(MediaType.APPLICATION_FORM_URLENCODED_VALUE + ";charset=UTF-8"));
107+
String urlEncodedClientCredential = URLEncoder.encode(clientCredentialWithAnsiKeyboardSpecialCharacters,
108+
StandardCharsets.UTF_8.toString());
109+
String clientCredentials = Base64.getEncoder().encodeToString(
110+
(urlEncodedClientCredential + ":" + urlEncodedClientCredential).getBytes(StandardCharsets.UTF_8));
111+
assertThat(headers.getFirst(HttpHeaders.AUTHORIZATION)).isEqualTo("Basic " + clientCredentials);
112+
MultiValueMap<String, String> formParameters = (MultiValueMap<String, String>) requestEntity.getBody();
113+
assertThat(formParameters.getFirst(OAuth2ParameterNames.GRANT_TYPE))
114+
.isEqualTo(AuthorizationGrantType.CLIENT_CREDENTIALS.getValue());
115+
assertThat(formParameters.getFirst(OAuth2ParameterNames.SCOPE)).contains(clientRegistration.getScopes());
116+
}
77117
}

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/endpoint/WebClientReactiveClientCredentialsTokenResponseClientTests.java

+35-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2021 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,12 +16,17 @@
1616

1717
package org.springframework.security.oauth2.client.endpoint;
1818

19+
import java.net.URLEncoder;
20+
import java.nio.charset.StandardCharsets;
21+
import java.util.Base64;
22+
1923
import okhttp3.mockwebserver.MockResponse;
2024
import okhttp3.mockwebserver.MockWebServer;
2125
import okhttp3.mockwebserver.RecordedRequest;
2226
import org.junit.After;
2327
import org.junit.Before;
2428
import org.junit.Test;
29+
2530
import org.springframework.http.HttpHeaders;
2631
import org.springframework.http.MediaType;
2732
import org.springframework.security.oauth2.client.registration.ClientRegistration;
@@ -88,6 +93,35 @@ public void getTokenResponseWhenHeaderThenSuccess() throws Exception {
8893
assertThat(body).isEqualTo("grant_type=client_credentials&scope=read%3Auser");
8994
}
9095

96+
// gh-9610
97+
@Test
98+
public void getTokenResponseWhenSpecialCharactersThenSuccessWithEncodedClientCredentials() throws Exception {
99+
// @formatter:off
100+
enqueueJson("{\n"
101+
+ " \"access_token\":\"MTQ0NjJkZmQ5OTM2NDE1ZTZjNGZmZjI3\",\n"
102+
+ " \"token_type\":\"bearer\",\n"
103+
+ " \"expires_in\":3600,\n"
104+
+ " \"refresh_token\":\"IwOGYzYTlmM2YxOTQ5MGE3YmNmMDFkNTVk\",\n"
105+
+ " \"scope\":\"create\"\n"
106+
+ "}");
107+
// @formatter:on
108+
String clientCredentialWithAnsiKeyboardSpecialCharacters = "~!@#$%^&*()_+{}|:\"<>?`-=[]\\;',./ ";
109+
OAuth2ClientCredentialsGrantRequest request = new OAuth2ClientCredentialsGrantRequest(
110+
this.clientRegistration.clientId(clientCredentialWithAnsiKeyboardSpecialCharacters)
111+
.clientSecret(clientCredentialWithAnsiKeyboardSpecialCharacters).build());
112+
OAuth2AccessTokenResponse response = this.client.getTokenResponse(request).block();
113+
RecordedRequest actualRequest = this.server.takeRequest();
114+
String body = actualRequest.getBody().readUtf8();
115+
assertThat(response.getAccessToken()).isNotNull();
116+
String urlEncodedClientCredentialecret = URLEncoder.encode(clientCredentialWithAnsiKeyboardSpecialCharacters,
117+
StandardCharsets.UTF_8.toString());
118+
String clientCredentials = Base64.getEncoder()
119+
.encodeToString((urlEncodedClientCredentialecret + ":" + urlEncodedClientCredentialecret)
120+
.getBytes(StandardCharsets.UTF_8));
121+
assertThat(actualRequest.getHeader(HttpHeaders.AUTHORIZATION)).isEqualTo("Basic " + clientCredentials);
122+
assertThat(body).isEqualTo("grant_type=client_credentials&scope=read%3Auser");
123+
}
124+
91125
@Test
92126
public void getTokenResponseWhenPostThenSuccess() throws Exception {
93127
ClientRegistration registration = this.clientRegistration

0 commit comments

Comments
 (0)