Skip to content

Commit 5dd2b47

Browse files
rohan-naik07rohan-naik07
committed
PKCE configuration - enabled by default
Signed-off-by: Rohan Naik <[email protected]>
1 parent d3b143d commit 5dd2b47

File tree

8 files changed

+139
-72
lines changed

8 files changed

+139
-72
lines changed

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2ClientConfigurerTests.java‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,7 @@ public void configureWhenAuthorizationCodeRequestThenRedirectForAuthorization()
156156
.andExpect(status().is3xxRedirection()).andReturn();
157157
assertThat(mvcResult.getResponse().getRedirectedUrl())
158158
.matches("https://provider.com/oauth2/authorize\\?" + "response_type=code&client_id=client-1&"
159-
+ "scope=user&state=.{15,}&" + "redirect_uri=http://localhost/client-1");
159+
+ "scope=user&state=.{15,}&" + "redirect_uri=http://localhost/client-1&code_challenge=([a-zA-Z0-9\\-\\.\\_\\~]){43}&code_challenge_method=S256");
160160
// @formatter:on
161161
}
162162

@@ -166,9 +166,9 @@ public void configureWhenOauth2ClientInLambdaThenRedirectForAuthorization() thro
166166
MvcResult mvcResult = this.mockMvc.perform(get("/oauth2/authorization/registration-1"))
167167
.andExpect(status().is3xxRedirection())
168168
.andReturn();
169-
assertThat(mvcResult.getResponse().getRedirectedUrl())
170-
.matches("https://provider.com/oauth2/authorize\\?" + "response_type=code&client_id=client-1&"
171-
+ "scope=user&state=.{15,}&" + "redirect_uri=http://localhost/client-1");
169+
assertThat(mvcResult.getResponse().getRedirectedUrl()).matches("https://provider.com/oauth2/authorize\\?"
170+
+ "response_type=code&client_id=client-1&" + "scope=user&state=.{15,}&"
171+
+ "redirect_uri=http://localhost/client-1&code_challenge=([a-zA-Z0-9\\-\\.\\_\\~]){43}&code_challenge_method=S256");
172172
}
173173

174174
@Test
@@ -215,9 +215,9 @@ public void configureWhenRequestCacheProvidedAndClientAuthorizationRequiredExcep
215215
MvcResult mvcResult = this.mockMvc.perform(get("/resource1").with(user("user1")))
216216
.andExpect(status().is3xxRedirection())
217217
.andReturn();
218-
assertThat(mvcResult.getResponse().getRedirectedUrl())
219-
.matches("https://provider.com/oauth2/authorize\\?" + "response_type=code&client_id=client-1&"
220-
+ "scope=user&state=.{15,}&" + "redirect_uri=http://localhost/client-1");
218+
assertThat(mvcResult.getResponse().getRedirectedUrl()).matches("https://provider.com/oauth2/authorize\\?"
219+
+ "response_type=code&client_id=client-1&" + "scope=user&state=.{15,}&"
220+
+ "redirect_uri=http://localhost/client-1&code_challenge=([a-zA-Z0-9\\-\\.\\_\\~]){43}&code_challenge_method=S256");
221221
verify(requestCache).saveRequest(any(HttpServletRequest.class), any(HttpServletResponse.class));
222222
}
223223

‎config/src/test/java/org/springframework/security/config/http/OAuth2ClientBeanDefinitionParserTests.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -112,9 +112,9 @@ public void requestWhenAuthorizeThenRedirect() throws Exception {
112112
.andExpect(status().is3xxRedirection())
113113
.andReturn();
114114
// @formatter:on
115-
assertThat(result.getResponse().getRedirectedUrl()).matches(
116-
"https://accounts.google.com/o/oauth2/v2/auth\\?" + "response_type=code&client_id=google-client-id&"
117-
+ "scope=scope1%20scope2&state=.{15,}&redirect_uri=http://localhost/callback/google");
115+
assertThat(result.getResponse().getRedirectedUrl()).matches("https://accounts.google.com/o/oauth2/v2/auth\\?"
116+
+ "response_type=code&client_id=google-client-id&"
117+
+ "scope=scope1%20scope2&state=.{15,}&redirect_uri=http://localhost/callback/google&code_challenge=([a-zA-Z0-9\\-\\.\\_\\~]){43}&code_challenge_method=S256");
118118
}
119119

120120
@Test
@@ -134,9 +134,9 @@ public void requestWhenCustomClientRegistrationRepositoryThenCalled() throws Exc
134134
.andExpect(status().is3xxRedirection())
135135
.andReturn();
136136
// @formatter:on
137-
assertThat(result.getResponse().getRedirectedUrl()).matches(
138-
"https://accounts.google.com/o/oauth2/v2/auth\\?" + "response_type=code&client_id=google-client-id&"
139-
+ "scope=scope1%20scope2&state=.{15,}&redirect_uri=http://localhost/callback/google");
137+
assertThat(result.getResponse().getRedirectedUrl()).matches("https://accounts.google.com/o/oauth2/v2/auth\\?"
138+
+ "response_type=code&client_id=google-client-id&"
139+
+ "scope=scope1%20scope2&state=.{15,}&redirect_uri=http://localhost/callback/google&code_challenge=([a-zA-Z0-9\\-\\.\\_\\~]){43}&code_challenge_method=S256");
140140
verify(this.clientRegistrationRepository).findByRegistrationId(any());
141141
}
142142

‎docs/modules/ROOT/pages/servlet/oauth2/client/core.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ This information is available only if the Spring Boot property `spring.security.
6969
<15> `(userInfoEndpoint)authenticationMethod`: The authentication method used when sending the access token to the UserInfo Endpoint.
7070
The supported values are *header*, *form*, and *query*.
7171
<16> `userNameAttributeName`: The name of the attribute returned in the UserInfo Response that references the Name or Identifier of the end-user.
72-
<17> [[oauth2Client-client-registration-requireProofKey]]`requireProofKey`: If `true` or if `authorizationGrantType` is `none`, then PKCE will be enabled by default.
72+
<17> [[oauth2Client-client-registration-requireProofKey]]`requireProofKey`: If `true` or if clientAuthenticationMethod is `none`, then PKCE will be enabled.
7373

7474
You can initially configure a `ClientRegistration` by using discovery of an OpenID Connect Provider's https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig[Configuration endpoint] or an Authorization Server's https://tools.ietf.org/html/rfc8414#section-3[Metadata endpoint].
7575

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/registration/ClientRegistration.java‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -701,11 +701,19 @@ private void validateAuthorizationGrantTypes() {
701701
"AuthorizationGrantType: %s does not match the pre-defined constant %s and won't match a valid OAuth2AuthorizedClientProvider",
702702
this.authorizationGrantType, authorizationGrantType));
703703
}
704-
if (!AuthorizationGrantType.AUTHORIZATION_CODE.equals(this.authorizationGrantType)
704+
if ((!AuthorizationGrantType.AUTHORIZATION_CODE.equals(this.authorizationGrantType)
705+
|| !ClientAuthenticationMethod.NONE.equals(this.clientAuthenticationMethod))
705706
&& this.clientSettings.isRequireProofKey()) {
706-
throw new IllegalStateException(
707-
"clientSettings.isRequireProofKey=true is only valid with authorizationGrantType=AUTHORIZATION_CODE. Got authorizationGrantType="
708-
+ this.authorizationGrantType);
707+
if (!AuthorizationGrantType.AUTHORIZATION_CODE.equals(this.authorizationGrantType)) {
708+
throw new IllegalStateException(
709+
"clientSettings.isRequireProofKey=true is only valid with authorizationGrantType=AUTHORIZATION_CODE and clientAuthenticationMethod=NONE. Got authorizationGrantType="
710+
+ this.authorizationGrantType);
711+
}
712+
else {
713+
throw new IllegalStateException(
714+
"clientSettings.isRequireProofKey=true is only valid with authorizationGrantType=AUTHORIZATION_CODE and clientAuthenticationMethod=NONE. Got clientAuthenticationMethod="
715+
+ this.clientAuthenticationMethod);
716+
}
709717
}
710718
}
711719
}
@@ -779,7 +787,7 @@ public static Builder builder() {
779787

780788
public static final class Builder {
781789

782-
private boolean requireProofKey;
790+
private boolean requireProofKey = true;
783791

784792
private Builder() {
785793
}

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/registration/ClientRegistrationTests.java‎

Lines changed: 48 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,6 @@
3737

3838
import static org.assertj.core.api.Assertions.assertThat;
3939
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
40-
import static org.assertj.core.api.Assertions.assertThatIllegalStateException;
4140

4241
/**
4342
* Tests for {@link ClientRegistration}.
@@ -683,7 +682,7 @@ void buildWhenDefaultClientSettingsThenDefaulted() {
683682
// should not be null
684683
assertThat(clientRegistration.getClientSettings()).isNotNull();
685684
// proof key should be false for passivity
686-
assertThat(clientRegistration.getClientSettings().isRequireProofKey()).isFalse();
685+
assertThat(clientRegistration.getClientSettings().isRequireProofKey()).isTrue();
687686
}
688687

689688
// gh-16382
@@ -701,10 +700,55 @@ void buildWhenNewAuthorizationCodeAndPkceThenBuilds() {
701700
.tokenUri(TOKEN_URI)
702701
.build();
703702

704-
// proof key should be false for passivity
705703
assertThat(clientRegistration.getClientSettings().isRequireProofKey()).isTrue();
706704
}
707705

706+
@Test
707+
void buildWhenNewAuthorizationCodeAndPkceDisabledThenBuilds() {
708+
ClientRegistration.ClientSettings pkceDisabled = ClientRegistration.ClientSettings.builder()
709+
.requireProofKey(false)
710+
.build();
711+
ClientRegistration clientRegistration = ClientRegistration.withRegistrationId(REGISTRATION_ID)
712+
.clientId(CLIENT_ID)
713+
.clientSettings(pkceDisabled)
714+
.authorizationGrantType(new AuthorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE.getValue()))
715+
.redirectUri(REDIRECT_URI)
716+
.authorizationUri(AUTHORIZATION_URI)
717+
.tokenUri(TOKEN_URI)
718+
.build();
719+
720+
assertThat(clientRegistration.getClientSettings().isRequireProofKey()).isFalse();
721+
}
722+
723+
@Test
724+
void buildWhenNewAuthorizationCodeAndPrivateClientThenPkceEnabledAndExceptionThrown() {
725+
List<ClientAuthenticationMethod> clientAuthenticationMethods = Arrays
726+
.stream(ClientAuthenticationMethod.class.getFields())
727+
.filter((field) -> Modifier.isFinal(field.getModifiers())
728+
&& field.getType() == ClientAuthenticationMethod.class)
729+
.map((field) -> getStaticValue(field, ClientAuthenticationMethod.class))
730+
.filter((authenticationMethod) -> authenticationMethod != ClientAuthenticationMethod.NONE)
731+
.map((authenticationMethod) -> new ClientAuthenticationMethod(authenticationMethod.getValue()))
732+
.toList();
733+
for (ClientAuthenticationMethod clientAuthenticationMethod : clientAuthenticationMethods) {
734+
ClientRegistration.ClientSettings pkceEnabled = ClientRegistration.ClientSettings.builder()
735+
.requireProofKey(true)
736+
.build();
737+
ClientRegistration clientRegistration = ClientRegistration.withRegistrationId(REGISTRATION_ID)
738+
.clientId(CLIENT_ID)
739+
.clientSettings(pkceEnabled)
740+
.authorizationGrantType(
741+
new AuthorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE.getValue()))
742+
.clientAuthenticationMethod(clientAuthenticationMethod)
743+
.redirectUri(REDIRECT_URI)
744+
.authorizationUri(AUTHORIZATION_URI)
745+
.tokenUri(TOKEN_URI)
746+
.build();
747+
748+
assertThat(clientRegistration.getClientSettings().isRequireProofKey()).isTrue();
749+
}
750+
}
751+
708752
@ParameterizedTest
709753
@MethodSource("invalidPkceGrantTypes")
710754
void buildWhenInvalidGrantTypeForPkceThenException(AuthorizationGrantType invalidGrantType) {
@@ -718,11 +762,7 @@ void buildWhenInvalidGrantTypeForPkceThenException(AuthorizationGrantType invali
718762
.redirectUri(REDIRECT_URI)
719763
.authorizationUri(AUTHORIZATION_URI)
720764
.tokenUri(TOKEN_URI);
721-
722-
assertThatIllegalStateException().describedAs(
723-
"clientSettings.isRequireProofKey=true is only valid with authorizationGrantType=AUTHORIZATION_CODE. Got authorizationGrantType={}",
724-
invalidGrantType)
725-
.isThrownBy(builder::build);
765+
assertThatIllegalArgumentException().isThrownBy(builder::build);
726766
}
727767

728768
static List<AuthorizationGrantType> invalidPkceGrantTypes() {

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/web/DefaultOAuth2AuthorizationRequestResolverTests.java‎

Lines changed: 34 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,8 @@ public class DefaultOAuth2AuthorizationRequestResolverTests {
6060

6161
private ClientRegistration pkceClientRegistration;
6262

63+
private ClientRegistration nonProofKeyPublicClientRegistration;
64+
6365
private ClientRegistration fineRedirectUriTemplateRegistration;
6466

6567
private ClientRegistration publicClientRegistration;
@@ -78,7 +80,11 @@ public void setUp() {
7880
this.registration2 = TestClientRegistrations.clientRegistration2().build();
7981

8082
this.pkceClientRegistration = pkceClientRegistration().build();
81-
83+
this.nonProofKeyPublicClientRegistration = TestClientRegistrations.clientRegistration()
84+
.registrationId("invalid-public-client-registration-id")
85+
.clientAuthenticationMethod(ClientAuthenticationMethod.NONE)
86+
.clientSettings(ClientRegistration.ClientSettings.builder().requireProofKey(false).build())
87+
.build();
8288
this.fineRedirectUriTemplateRegistration = fineRedirectUriTemplateClientRegistration().build();
8389
// @formatter:off
8490
this.publicClientRegistration = TestClientRegistrations.clientRegistration()
@@ -94,7 +100,7 @@ public void setUp() {
94100
// @formatter:on
95101
this.clientRegistrationRepository = new InMemoryClientRegistrationRepository(this.registration1,
96102
this.registration2, this.pkceClientRegistration, this.fineRedirectUriTemplateRegistration,
97-
this.publicClientRegistration, this.oidcRegistration);
103+
this.publicClientRegistration, this.oidcRegistration, this.nonProofKeyPublicClientRegistration);
98104
this.resolver = new DefaultOAuth2AuthorizationRequestResolver(this.clientRegistrationRepository,
99105
this.authorizationRequestBaseUri);
100106
}
@@ -178,12 +184,14 @@ public void resolveWhenAuthorizationRequestWithValidClientThenResolves() {
178184
assertThat(authorizationRequest.getState()).isNotNull();
179185
assertThat(authorizationRequest.getAdditionalParameters())
180186
.doesNotContainKey(OAuth2ParameterNames.REGISTRATION_ID);
181-
assertThat(authorizationRequest.getAttributes())
182-
.containsExactly(entry(OAuth2ParameterNames.REGISTRATION_ID, clientRegistration.getRegistrationId()));
187+
assertThat(authorizationRequest.getAttributes()).containsExactly(
188+
entry(OAuth2ParameterNames.REGISTRATION_ID, clientRegistration.getRegistrationId()),
189+
entry(PkceParameterNames.CODE_VERIFIER,
190+
authorizationRequest.getAttributes().get(PkceParameterNames.CODE_VERIFIER)));
183191
assertThat(authorizationRequest.getAuthorizationRequestUri())
184192
.matches("https://example.com/login/oauth/authorize\\?" + "response_type=code&client_id=client-id&"
185193
+ "scope=read:user&state=.{15,}&"
186-
+ "redirect_uri=http://localhost/login/oauth2/code/registration-id");
194+
+ "redirect_uri=http://localhost/login/oauth2/code/registration-id&code_challenge=([a-zA-Z0-9\\-\\.\\_\\~]){43}&code_challenge_method=S256");
187195
}
188196

189197
@Test
@@ -194,8 +202,10 @@ public void resolveWhenClientAuthorizationRequiredExceptionAvailableThenResolves
194202
OAuth2AuthorizationRequest authorizationRequest = this.resolver.resolve(request,
195203
clientRegistration.getRegistrationId());
196204
assertThat(authorizationRequest).isNotNull();
197-
assertThat(authorizationRequest.getAttributes())
198-
.containsExactly(entry(OAuth2ParameterNames.REGISTRATION_ID, clientRegistration.getRegistrationId()));
205+
assertThat(authorizationRequest.getAttributes()).containsExactly(
206+
entry(OAuth2ParameterNames.REGISTRATION_ID, clientRegistration.getRegistrationId()),
207+
entry(PkceParameterNames.CODE_VERIFIER,
208+
authorizationRequest.getAttributes().get(PkceParameterNames.CODE_VERIFIER)));
199209
}
200210

201211
@Test
@@ -282,7 +292,8 @@ public void resolveWhenAuthorizationRequestIncludesPort80ThenExpandedRedirectUri
282292
assertThat(authorizationRequest.getAuthorizationRequestUri())
283293
.matches("https://example.com/login/oauth/authorize\\?" + "response_type=code&client_id=client-id&"
284294
+ "scope=read:user&state=.{15,}&"
285-
+ "redirect_uri=http://localhost/login/oauth2/code/registration-id");
295+
+ "redirect_uri=http://localhost/login/oauth2/code/registration-id"
296+
+ "&code_challenge=([a-zA-Z0-9\\-\\.\\_\\~]){43}&code_challenge_method=S256");
286297
}
287298

288299
@Test
@@ -294,7 +305,8 @@ public void resolveWhenAuthorizationRequestIncludesPort443ThenExpandedRedirectUr
294305
assertThat(authorizationRequest.getAuthorizationRequestUri())
295306
.matches("https://example.com/login/oauth/authorize\\?" + "response_type=code&client_id=client-id&"
296307
+ "scope=read:user&state=.{15,}&"
297-
+ "redirect_uri=https://example.com/login/oauth2/code/registration-id");
308+
+ "redirect_uri=https://example.com/login/oauth2/code/registration-id"
309+
+ "&code_challenge=([a-zA-Z0-9\\-\\.\\_\\~]){43}&code_challenge_method=S256");
298310
}
299311

300312
@Test
@@ -307,7 +319,7 @@ public void resolveWhenClientAuthorizationRequiredExceptionAvailableThenRedirect
307319
assertThat(authorizationRequest.getAuthorizationRequestUri())
308320
.matches("https://example.com/login/oauth/authorize\\?" + "response_type=code&client_id=client-id&"
309321
+ "scope=read:user&state=.{15,}&"
310-
+ "redirect_uri=http://localhost/authorize/oauth2/code/registration-id");
322+
+ "redirect_uri=http://localhost/authorize/oauth2/code/registration-id&code_challenge=([a-zA-Z0-9\\-\\.\\_\\~]){43}&code_challenge_method=S256");
311323
}
312324

313325
@Test
@@ -319,7 +331,8 @@ public void resolveWhenAuthorizationRequestOAuth2LoginThenRedirectUriIsLogin() {
319331
assertThat(authorizationRequest.getAuthorizationRequestUri())
320332
.matches("https://example.com/login/oauth/authorize\\?" + "response_type=code&client_id=client-id-2&"
321333
+ "scope=read:user&state=.{15,}&"
322-
+ "redirect_uri=http://localhost/login/oauth2/code/registration-id-2");
334+
+ "redirect_uri=http://localhost/login/oauth2/code/registration-id-2"
335+
+ "&code_challenge=([a-zA-Z0-9\\-\\.\\_\\~]){43}&code_challenge_method=S256");
323336
}
324337

325338
@Test
@@ -331,7 +344,8 @@ public void resolveWhenAuthorizationRequestHasActionParameterAuthorizeThenRedire
331344
assertThat(authorizationRequest.getAuthorizationRequestUri())
332345
.matches("https://example.com/login/oauth/authorize\\?" + "response_type=code&client_id=client-id&"
333346
+ "scope=read:user&state=.{15,}&"
334-
+ "redirect_uri=http://localhost/authorize/oauth2/code/registration-id");
347+
+ "redirect_uri=http://localhost/authorize/oauth2/code/registration-id&"
348+
+ "code_challenge=([a-zA-Z0-9\\-\\.\\_\\~]){43}&code_challenge_method=S256");
335349
}
336350

337351
@Test
@@ -343,7 +357,7 @@ public void resolveWhenAuthorizationRequestHasActionParameterLoginThenRedirectUr
343357
assertThat(authorizationRequest.getAuthorizationRequestUri())
344358
.matches("https://example.com/login/oauth/authorize\\?" + "response_type=code&client_id=client-id-2&"
345359
+ "scope=read:user&state=.{15,}&"
346-
+ "redirect_uri=http://localhost/login/oauth2/code/registration-id-2");
360+
+ "redirect_uri=http://localhost/login/oauth2/code/registration-id-2&code_challenge=([a-zA-Z0-9\\-\\.\\_\\~]){43}&code_challenge_method=S256");
347361
}
348362

349363
@Test
@@ -477,7 +491,7 @@ public void resolveWhenAuthenticationRequestWithValidOidcClientThenResolves() {
477491
.matches("https://example.com/login/oauth/authorize\\?" + "response_type=code&client_id=client-id&"
478492
+ "scope=openid&state=.{15,}&"
479493
+ "redirect_uri=http://localhost/login/oauth2/code/oidc-registration-id&"
480-
+ "nonce=([a-zA-Z0-9\\-\\.\\_\\~]){43}");
494+
+ "nonce=([a-zA-Z0-9\\-\\.\\_\\~]){43}&code_challenge=([a-zA-Z0-9\\-\\.\\_\\~]){43}&code_challenge_method=S256");
481495
}
482496

483497
// gh-7696
@@ -496,7 +510,8 @@ public void resolveWhenAuthorizationRequestCustomizerRemovesNonceThenQueryExclud
496510
assertThat(authorizationRequest.getAuthorizationRequestUri())
497511
.matches("https://example.com/login/oauth/authorize\\?" + "response_type=code&client_id=client-id&"
498512
+ "scope=openid&state=.{15,}&"
499-
+ "redirect_uri=http://localhost/login/oauth2/code/oidc-registration-id");
513+
+ "redirect_uri=http://localhost/login/oauth2/code/oidc-registration-id&"
514+
+ "code_challenge=([a-zA-Z0-9\\-\\.\\_\\~]){43}&code_challenge_method=S256");
500515
}
501516

502517
@Test
@@ -513,7 +528,8 @@ public void resolveWhenAuthorizationRequestCustomizerAddsParameterThenQueryInclu
513528
.matches("https://example.com/login/oauth/authorize\\?" + "response_type=code&client_id=client-id&"
514529
+ "scope=openid&state=.{15,}&"
515530
+ "redirect_uri=http://localhost/login/oauth2/code/oidc-registration-id&"
516-
+ "nonce=([a-zA-Z0-9\\-\\.\\_\\~]){43}&" + "param1=value1");
531+
+ "nonce=([a-zA-Z0-9\\-\\.\\_\\~]){43}"
532+
+ "&code_challenge=([a-zA-Z0-9\\-\\.\\_\\~]){43}&code_challenge_method=S256&param1=value1");
517533
}
518534

519535
@Test
@@ -529,18 +545,8 @@ public void resolveWhenAuthorizationRequestCustomizerOverridesParameterThenQuery
529545
assertThat(authorizationRequest.getAuthorizationRequestUri()).matches(
530546
"https://example.com/login/oauth/authorize\\?" + "response_type=code&" + "scope=openid&state=.{15,}&"
531547
+ "redirect_uri=http://localhost/login/oauth2/code/oidc-registration-id&"
532-
+ "nonce=([a-zA-Z0-9\\-\\.\\_\\~]){43}&" + "appid=client-id");
533-
}
534-
535-
@Test
536-
public void resolveWhenAuthorizationRequestNoProvideAuthorizationRequestBaseUri() {
537-
OAuth2AuthorizationRequestResolver resolver = new DefaultOAuth2AuthorizationRequestResolver(
538-
this.clientRegistrationRepository);
539-
String requestUri = this.authorizationRequestBaseUri + "/" + this.registration2.getRegistrationId();
540-
MockHttpServletRequest request = get(requestUri).build();
541-
OAuth2AuthorizationRequest authorizationRequest = resolver.resolve(request);
542-
assertThat(authorizationRequest.getRedirectUri())
543-
.isEqualTo("http://localhost/login/oauth2/code/" + this.registration2.getRegistrationId());
548+
+ "nonce=([a-zA-Z0-9\\-\\.\\_\\~]){43}"
549+
+ "&code_challenge=([a-zA-Z0-9\\-\\.\\_\\~]){43}&code_challenge_method=S256&appid=client-id");
544550
}
545551

546552
@Test

0 commit comments

Comments
 (0)