Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OAuth2AuthorizationCodeGrantFilter should also match on query parameters #7963

Closed
jgrandja opened this issue Feb 10, 2020 · 0 comments
Closed
Assignees
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) status: backported An issue that has been backported to maintenance branches type: bug A general bug
Milestone

Comments

@jgrandja
Copy link
Contributor

The current implementation of OAuth2AuthorizationCodeGrantFilter does not match on the query parameters that may be contained in the registered redirect_uri.

As per spec, in section 3.1.2 Redirection Endpoint:

The redirection endpoint URI MUST be an absolute URI as defined by
[RFC3986] Section 4.3. The endpoint URI MAY include an
"application/x-www-form-urlencoded" formatted (per Appendix B) query
component
([RFC3986] Section 3.4), which MUST be retained when adding
additional query parameters. The endpoint URI MUST NOT include a
fragment component.

We should apply this fix to ensure the OAuth2AuthorizationCodeGrantFilter also matches on the query parameters.

@jgrandja jgrandja added type: bug A general bug in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) labels Feb 10, 2020
@jgrandja jgrandja added this to the 5.3.0 milestone Feb 10, 2020
@jgrandja jgrandja self-assigned this Feb 10, 2020
@jgrandja jgrandja added the for: backport-to-5.2.x Designates an issue for backport to 5.2.x label Feb 10, 2020
@spring-projects-issues spring-projects-issues added status: backported An issue that has been backported to maintenance branches and removed for: backport-to-5.2.x Designates an issue for backport to 5.2.x labels Feb 10, 2020
@jgrandja jgrandja added the for: backport-to-5.1.x Designates an issue for backport to 5.1.x label Feb 10, 2020
@spring-projects-issues spring-projects-issues removed the for: backport-to-5.1.x Designates an issue for backport to 5.1.x label Feb 10, 2020
jgrandja added a commit that referenced this issue Feb 10, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) status: backported An issue that has been backported to maintenance branches type: bug A general bug
Projects
None yet
Development

No branches or pull requests

2 participants