Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-03-02 03:19:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

Bearer Token Padding

Browse Source 
Closes gh-8502
This commit is contained in:
kothasa 2020-05-11 12:32:56 +01:00 committed by Josh Cummings
parent 3dc59686fa
commit 6519029340
No known key found for this signature in database
GPG Key ID: 49EF60DD7FF83443
2 changed files with 19 additions and 1 deletions
oauth2/oauth2-resource-server/src
main/java/org/springframework/security/oauth2/server/resource/web
DefaultBearerTokenResolver.java
test/java/org/springframework/security/oauth2/server/resource/web
DefaultBearerTokenResolverTests.java

2
oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolver.java

@ -100,7 +100,7 @@ public final class DefaultBearerTokenResolver implements BearerTokenResolver {
throw new OAuth2AuthenticationException(error);
}
return matcher.group("token");
return authorization.substring(7);
}
return null;
}

18
oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolverTests.java

@ -51,6 +51,24 @@ public class DefaultBearerTokenResolverTests {
assertThat(this.resolver.resolve(request)).isEqualTo(TEST_TOKEN);
}
@Test
public void resolveWhenValidHeaderIsPresentWithSingleBytePaddingIndicatorThenTokenIsResolved() {
String token = TEST_TOKEN + "=";
MockHttpServletRequest request = new MockHttpServletRequest();
request.addHeader("Authorization", "Bearer " + token);
assertThat(this.resolver.resolve(request)).isEqualTo(token);
}
@Test
public void resolveWhenValidHeaderIsPresentWithTwoBytesPaddingIndicatorThenTokenIsResolved() {
String token = TEST_TOKEN + "==";
MockHttpServletRequest request = new MockHttpServletRequest();
request.addHeader("Authorization", "Bearer " + token);
assertThat(this.resolver.resolve(request)).isEqualTo(token);
}
@Test
public void resolveWhenLowercaseHeaderIsPresentThenTokenIsResolved() {
MockHttpServletRequest request = new MockHttpServletRequest();