Repository: cxf Updated Branches: refs/heads/3.0.x-fixes abe4cba67 -> efa91109b
Minor updates to OAuth2 Redirection service Project: http://git-wip-us.apache.org/repos/asf/cxf/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/efa91109 Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/efa91109 Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/efa91109 Branch: refs/heads/3.0.x-fixes Commit: efa91109b8d80999b64aaab98c31f2cc85f85e81 Parents: abe4cba Author: Sergey Beryozkin <[email protected]> Authored: Wed Mar 18 13:16:48 2015 +0000 Committer: Sergey Beryozkin <[email protected]> Committed: Wed Mar 18 13:23:45 2015 +0000 ---------------------------------------------------------------------- .../rs/security/oauth2/services/AbstractOAuthService.java | 2 +- .../oauth2/services/AuthorizationCodeGrantService.java | 4 ++++ .../oauth2/services/RedirectionBasedGrantService.java | 10 ++++++++++ 3 files changed, 15 insertions(+), 1 deletion(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf/blob/efa91109/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AbstractOAuthService.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AbstractOAuthService.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AbstractOAuthService.java index c0a4207..994f0d7 100644 --- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AbstractOAuthService.java +++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AbstractOAuthService.java @@ -40,7 +40,7 @@ import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants; * Abstract OAuth service */ public abstract class AbstractOAuthService { - private static final Logger LOG = LogUtils.getL7dLogger(AbstractOAuthService.class); + protected static final Logger LOG = LogUtils.getL7dLogger(AbstractOAuthService.class); private MessageContext mc; private OAuthDataProvider dataProvider; private boolean blockUnsecureRequests; http://git-wip-us.apache.org/repos/asf/cxf/blob/efa91109/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AuthorizationCodeGrantService.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AuthorizationCodeGrantService.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AuthorizationCodeGrantService.java index 1ce7ddb..70f97f2 100644 --- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AuthorizationCodeGrantService.java +++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AuthorizationCodeGrantService.java @@ -52,6 +52,7 @@ import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants; */ @Path("/authorize") public class AuthorizationCodeGrantService extends RedirectionBasedGrantService { + private static final Integer RECOMMENDED_CODE_EXPIRY_TIME_MINS = 10; private boolean canSupportPublicClients; private OOBResponseDeliverer oobDeliverer; private AuthorizationCodeRequestFilter codeRequestFilter; @@ -106,6 +107,9 @@ public class AuthorizationCodeGrantService extends RedirectionBasedGrantService } catch (OAuthServiceException ex) { return createErrorResponse(params, redirectUri, OAuthConstants.ACCESS_DENIED); } + if (grant.getExpiresIn() / 60 > RECOMMENDED_CODE_EXPIRY_TIME_MINS) { + LOG.warning("Code expiry time exceeds 10 minutes"); + } String grantCode = processCodeGrant(client, grant.getCode(), grant.getSubject()); if (redirectUri == null) { OOBAuthorizationResponse oobResponse = new OOBAuthorizationResponse(); http://git-wip-us.apache.org/repos/asf/cxf/blob/efa91109/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java index 9450a8a..0834e2e 100644 --- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java +++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java @@ -60,6 +60,7 @@ public abstract class RedirectionBasedGrantService extends AbstractOAuthService private SessionAuthenticityTokenProvider sessionAuthenticityTokenProvider; private SubjectCreator subjectCreator; private ResourceOwnerNameProvider resourceOwnerNameProvider; + private boolean matchRedirectUriWithApplicationUri; protected RedirectionBasedGrantService(String supportedResponseType, String supportedGrantType) { @@ -333,6 +334,11 @@ public abstract class RedirectionBasedGrantService extends AbstractOAuthService if (redirectUri == null && uris.size() == 0 && !canRedirectUriBeEmpty(client)) { reportInvalidRequestError("Client Redirect Uri is invalid"); } + if (redirectUri != null && matchRedirectUriWithApplicationUri + && client.getApplicationWebUri() != null + && !redirectUri.startsWith(client.getApplicationWebUri())) { + reportInvalidRequestError("Client Redirect Uri is invalid"); + } return redirectUri; } @@ -419,4 +425,8 @@ public abstract class RedirectionBasedGrantService extends AbstractOAuthService protected abstract boolean canSupportPublicClient(Client c); protected abstract boolean canRedirectUriBeEmpty(Client c); + + public void setMatchRedirectUriWithApplicationUri(boolean matchRedirectUriWithApplicationUri) { + this.matchRedirectUriWithApplicationUri = matchRedirectUriWithApplicationUri; + } }
