Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OAuth2AuthorizationRequest additionalParameters urlencoding #9213

Closed
pyorama opened this issue Nov 23, 2020 · 1 comment
Closed

OAuth2AuthorizationRequest additionalParameters urlencoding #9213

pyorama opened this issue Nov 23, 2020 · 1 comment
Assignees
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) status: duplicate A duplicate of another issue

Comments

@pyorama
Copy link

pyorama commented Nov 23, 2020

Describe the bug
Got invalid url If defining for example json-string as additional parameter for OAuth2AuthorizationRequest.
In addition if defining already urlencoded parameter for OAuth2AuthorizationRequest - still got invalid url because the parameter is now urlencoded again.

To Reproduce

Case 1:
Define custom oauth authorization requst with extra parameter as described in: https://www.baeldung.com/spring-security-custom-oauth-requests
Add parameter 'claims' with value: '{"userinfo":{"name":null}}'

-> the resulting redirect url is invalid because the claims parameter value is not urlencoded

Case 2:
Define custom oauth authorization requst with urlencoded parameter.
Add parameter 'claims' with value: '%7B%22userinfo%22%3A%7B%22name%22%3Anull%7D%7D'

-> the resulting redirect url is invalid because the claims parameter is now double urlencoded as:
claims=%257B%2522userinfo%2522%253A%257B%2522name%2522%253Anull%257D%257D

Expected behavior
Setting extra parameter should produce valid urlencoded request parameter for the redirect url.

Sample

@pyorama pyorama added status: waiting-for-triage An issue we've not yet triaged type: bug A general bug labels Nov 23, 2020
@jgrandja
Copy link
Contributor

@pyorama This has already been resolved via #7871. See this test:

+ "?claims=%7B%22userinfo%22%3A%7B%22email_verified%22%3A%7B%22essential%22%3Atrue%7D%7D%7D")

@jgrandja jgrandja added in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) status: duplicate A duplicate of another issue and removed status: waiting-for-triage An issue we've not yet triaged type: bug A general bug labels Nov 23, 2020
@jgrandja jgrandja self-assigned this Nov 23, 2020
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) status: duplicate A duplicate of another issue
Projects
None yet
Development

No branches or pull requests

2 participants