Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Deprecate Implicit Grant 

Fixes gh-8013
This commit is contained in:
Joe Grandja 2020-02-23 08:08:12 -05:00
parent c8cc9717c9
commit 204a612be1
4 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docs/manual/src/docs/asciidoc/_includes/servlet/appendix/namespace.adoc
View File

@ -1082,7 +1082,7 @@ The supported values are *basic*, *post* and *none* https://tools.ietf.org/html/
[[nsa-client-registration-authorization-grant-type]] [[nsa-client-registration-authorization-grant-type]]
* **authorization-grant-type** * **authorization-grant-type**
The OAuth 2.0 Authorization Framework defines four https://tools.ietf.org/html/rfc6749#section-1.3[Authorization Grant] types. The OAuth 2.0 Authorization Framework defines four https://tools.ietf.org/html/rfc6749#section-1.3[Authorization Grant] types.
The supported values are `authorization_code`, `client_credentials`, `password` and `implicit`. The supported values are `authorization_code`, `client_credentials` and `password`.
[[nsa-client-registration-redirect-uri]] [[nsa-client-registration-redirect-uri]]

2
docs/manual/src/docs/asciidoc/_includes/servlet/oauth2/oauth2-client.adoc
View File

@ -135,7 +135,7 @@ public final class ClientRegistration {
<4> `clientAuthenticationMethod`: The method used to authenticate the Client with the Provider. <4> `clientAuthenticationMethod`: The method used to authenticate the Client with the Provider.
The supported values are *basic*, *post* and *none* https://tools.ietf.org/html/rfc6749#section-2.1[(public clients)]. The supported values are *basic*, *post* and *none* https://tools.ietf.org/html/rfc6749#section-2.1[(public clients)].
<5> `authorizationGrantType`: The OAuth 2.0 Authorization Framework defines four https://tools.ietf.org/html/rfc6749#section-1.3[Authorization Grant] types. <5> `authorizationGrantType`: The OAuth 2.0 Authorization Framework defines four https://tools.ietf.org/html/rfc6749#section-1.3[Authorization Grant] types.
The supported values are `authorization_code`, `client_credentials`, `password` and `implicit`. The supported values are `authorization_code`, `client_credentials` and `password`.
<6> `redirectUriTemplate`: The client's registered redirect URI that the _Authorization Server_ redirects the end-user's user-agent <6> `redirectUriTemplate`: The client's registered redirect URI that the _Authorization Server_ redirects the end-user's user-agent
to after the end-user has authenticated and authorized access to the client. to after the end-user has authenticated and authorized access to the client.
<7> `scopes`: The scope(s) requested by the client during the Authorization Request flow, such as openid, email, or profile. <7> `scopes`: The scope(s) requested by the client during the Authorization Request flow, such as openid, email, or profile.

10
oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/AuthorizationGrantType.java
View File

@ -36,7 +36,17 @@ import java.io.Serializable;
public final class AuthorizationGrantType implements Serializable { public final class AuthorizationGrantType implements Serializable {
private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID; private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
public static final AuthorizationGrantType AUTHORIZATION_CODE = new AuthorizationGrantType("authorization_code"); public static final AuthorizationGrantType AUTHORIZATION_CODE = new AuthorizationGrantType("authorization_code");
/**
* It is not recommended to use the implicit flow
* due to the inherent risks of returning access tokens in an HTTP redirect
* without any confirmation that it has been received by the client.
*
* @see <a target="_blank" href="https://oauth.net/2/grant-types/implicit/">OAuth 2.0 Implicit Grant</a>
*/
@Deprecated
public static final AuthorizationGrantType IMPLICIT = new AuthorizationGrantType("implicit"); public static final AuthorizationGrantType IMPLICIT = new AuthorizationGrantType("implicit");
public static final AuthorizationGrantType REFRESH_TOKEN = new AuthorizationGrantType("refresh_token"); public static final AuthorizationGrantType REFRESH_TOKEN = new AuthorizationGrantType("refresh_token");
public static final AuthorizationGrantType CLIENT_CREDENTIALS = new AuthorizationGrantType("client_credentials"); public static final AuthorizationGrantType CLIENT_CREDENTIALS = new AuthorizationGrantType("client_credentials");
public static final AuthorizationGrantType PASSWORD = new AuthorizationGrantType("password"); public static final AuthorizationGrantType PASSWORD = new AuthorizationGrantType("password");

5
oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/endpoint/OAuth2AuthorizationRequest.java
View File

@ -186,8 +186,13 @@ public final class OAuth2AuthorizationRequest implements Serializable {
/** /**
* Returns a new {@link Builder}, initialized with the implicit grant type. * Returns a new {@link Builder}, initialized with the implicit grant type.
* *
* @deprecated It is not recommended to use the implicit flow
* due to the inherent risks of returning access tokens in an HTTP redirect
* without any confirmation that it has been received by the client.
* @see <a target="_blank" href="https://oauth.net/2/grant-types/implicit/">OAuth 2.0 Implicit Grant</a>
* @return the {@link Builder} * @return the {@link Builder}
*/ */
@Deprecated
public static Builder implicit() { public static Builder implicit() {
return new Builder(AuthorizationGrantType.IMPLICIT); return new Builder(AuthorizationGrantType.IMPLICIT);
} }