From 7cfcfaefae8733fa291c890ce6fe6272b2e3c851 Mon Sep 17 00:00:00 2001 From: Daniel Garnier-Moiroux Date: Mon, 19 Jan 2026 14:26:18 +0100 Subject: [PATCH] BearerTokenAuthenticationEntryPoint uses context path Closes gh-18528 Signed-off-by: Daniel Garnier-Moiroux --- .../web/BearerTokenAuthenticationEntryPoint.java | 4 +++- .../BearerTokenAuthenticationEntryPointTests.java | 12 ++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/BearerTokenAuthenticationEntryPoint.java b/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/BearerTokenAuthenticationEntryPoint.java index 9a0792b0d9..76607173cc 100644 --- a/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/BearerTokenAuthenticationEntryPoint.java +++ b/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/BearerTokenAuthenticationEntryPoint.java @@ -98,9 +98,11 @@ public final class BearerTokenAuthenticationEntryPoint implements Authentication } private static String getResourceMetadataParameter(HttpServletRequest request) { + String path = request.getContextPath() + + OAuth2ProtectedResourceMetadataFilter.DEFAULT_OAUTH2_PROTECTED_RESOURCE_METADATA_ENDPOINT_URI; // @formatter:off return UriComponentsBuilder.fromUriString(UrlUtils.buildFullRequestUrl(request)) - .replacePath(OAuth2ProtectedResourceMetadataFilter.DEFAULT_OAUTH2_PROTECTED_RESOURCE_METADATA_ENDPOINT_URI) + .replacePath(path) .replaceQuery(null) .fragment(null) .build() diff --git a/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/BearerTokenAuthenticationEntryPointTests.java b/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/BearerTokenAuthenticationEntryPointTests.java index 45bb04060d..5063901dfb 100644 --- a/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/BearerTokenAuthenticationEntryPointTests.java +++ b/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/BearerTokenAuthenticationEntryPointTests.java @@ -65,6 +65,18 @@ public class BearerTokenAuthenticationEntryPointTests { "Bearer realm=\"test\", resource_metadata=\"http://localhost/.well-known/oauth-protected-resource\""); } + @Test + public void commenceWhenNoBearerTokenErrorAndContextPathSetThenStatus401AndAuthHeaderWithContextPath() { + MockHttpServletRequest request = new MockHttpServletRequest(); + request.setContextPath("/ctx"); + MockHttpServletResponse response = new MockHttpServletResponse(); + this.authenticationEntryPoint.commence(request, response, new BadCredentialsException("test")); + assertThat(response.getStatus()).isEqualTo(401); + assertThat(response.getHeader("WWW-Authenticate")) + .isEqualTo("Bearer resource_metadata=\"http://localhost/ctx/.well-known/oauth-protected-resource\""); + + } + @Test public void commenceWhenInvalidRequestErrorThenStatus400AndHeaderWithError() throws Exception { MockHttpServletRequest request = new MockHttpServletRequest();