Skip to content

Add default authorizationRequestBaseUri to DefaultOAuth2AuthorizationRequestResolver #16384

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 27, 2025
Merged

Add default authorizationRequestBaseUri to DefaultOAuth2AuthorizationRequestResolver #16384

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
250a39c
Add default authorizationRequestBaseUri to DefaultOAuth2Authorization…
kse-music Jan 9, 2025
82be3dd
Fix cycle in DefaultOAuth2AuthorizationRequestResolver
rwinch Jun 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions ...springframework/security/oauth2/client/web/DefaultOAuth2AuthorizationRequestResolver.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,11 @@
*/
public final class DefaultOAuth2AuthorizationRequestResolver implements OAuth2AuthorizationRequestResolver {

/**
* The default base {@code URI} used for authorization requests.
*/
public static final String DEFAULT_AUTHORIZATION_REQUEST_BASE_URI = "/oauth2/authorization";

private static final String REGISTRATION_ID_URI_VARIABLE_NAME = "registrationId";

private static final char PATH_DELIMITER = '/';
Expand All @@ -86,6 +91,16 @@ public final class DefaultOAuth2AuthorizationRequestResolver implements OAuth2Au
private Consumer<OAuth2AuthorizationRequest.Builder> authorizationRequestCustomizer = (customizer) -> {
};

/**
* Constructs a {@code DefaultOAuth2AuthorizationRequestResolver} using the provided
* parameters.
* @param clientRegistrationRepository the repository of client registrations
* authorization requests
*/
public DefaultOAuth2AuthorizationRequestResolver(ClientRegistrationRepository clientRegistrationRepository) {
this(clientRegistrationRepository, DEFAULT_AUTHORIZATION_REQUEST_BASE_URI);
}

/**
* Constructs a {@code DefaultOAuth2AuthorizationRequestResolver} using the provided
* parameters.
Expand Down
9 changes: 3 additions & 6 deletions .../springframework/security/oauth2/client/web/OAuth2AuthorizationRequestRedirectFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,7 @@ public class OAuth2AuthorizationRequestRedirectFilter extends OncePerRequestFilt
/**
* The default base {@code URI} used for authorization requests.
*/
public static final String DEFAULT_AUTHORIZATION_REQUEST_BASE_URI = "/oauth2/authorization";
public static final String DEFAULT_AUTHORIZATION_REQUEST_BASE_URI = DefaultOAuth2AuthorizationRequestResolver.DEFAULT_AUTHORIZATION_REQUEST_BASE_URI;

private final ThrowableAnalyzer throwableAnalyzer = new DefaultThrowableAnalyzer();

Expand All @@ -107,7 +107,7 @@ public class OAuth2AuthorizationRequestRedirectFilter extends OncePerRequestFilt
* @param clientRegistrationRepository the repository of client registrations
*/
public OAuth2AuthorizationRequestRedirectFilter(ClientRegistrationRepository clientRegistrationRepository) {
this(clientRegistrationRepository, DEFAULT_AUTHORIZATION_REQUEST_BASE_URI);
this(new DefaultOAuth2AuthorizationRequestResolver(clientRegistrationRepository));
}

/**
Expand All @@ -119,10 +119,7 @@ public OAuth2AuthorizationRequestRedirectFilter(ClientRegistrationRepository cli
*/
public OAuth2AuthorizationRequestRedirectFilter(ClientRegistrationRepository clientRegistrationRepository,
String authorizationRequestBaseUri) {
Assert.notNull(clientRegistrationRepository, "clientRegistrationRepository cannot be null");
Assert.hasText(authorizationRequestBaseUri, "authorizationRequestBaseUri cannot be empty");
this.authorizationRequestResolver = new DefaultOAuth2AuthorizationRequestResolver(clientRegistrationRepository,
authorizationRequestBaseUri);
this(new DefaultOAuth2AuthorizationRequestResolver(clientRegistrationRepository, authorizationRequestBaseUri));
}

/**
Expand Down
18 changes: 18 additions & 0 deletions ...gframework/security/oauth2/client/web/DefaultOAuth2AuthorizationRequestResolverTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,12 @@ public void setUp() {
this.authorizationRequestBaseUri);
}

@Test
void authorizationRequestBaseUriEqualToRedirectFilter() {
assertThat(DefaultOAuth2AuthorizationRequestResolver.DEFAULT_AUTHORIZATION_REQUEST_BASE_URI)
.isEqualTo(OAuth2AuthorizationRequestRedirectFilter.DEFAULT_AUTHORIZATION_REQUEST_BASE_URI);
}

@Test
public void constructorWhenClientRegistrationRepositoryIsNullThenThrowIllegalArgumentException() {
assertThatIllegalArgumentException()
Expand Down Expand Up @@ -568,6 +574,18 @@ public void resolveWhenAuthorizationRequestCustomizerOverridesParameterThenQuery
+ "nonce=([a-zA-Z0-9\\-\\.\\_\\~]){43}&" + "appid=client-id");
}

@Test
public void resolveWhenAuthorizationRequestNoProvideAuthorizationRequestBaseUri() {
OAuth2AuthorizationRequestResolver resolver = new DefaultOAuth2AuthorizationRequestResolver(
this.clientRegistrationRepository);
String requestUri = this.authorizationRequestBaseUri + "/" + this.registration2.getRegistrationId();
MockHttpServletRequest request = new MockHttpServletRequest("GET", requestUri);
request.setServletPath(requestUri);
OAuth2AuthorizationRequest authorizationRequest = resolver.resolve(request);
assertThat(authorizationRequest.getRedirectUri())
.isEqualTo("http://localhost/login/oauth2/code/" + this.registration2.getRegistrationId());
}

@Test
public void resolveWhenAuthorizationRequestProvideCodeChallengeMethod() {
ClientRegistration clientRegistration = this.pkceClientRegistration;
Expand Down