This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.2.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/3.2.x-fixes by this push:
new c92b23c Make sure that only the client associated with a token can
revoke it
c92b23c is described below
commit c92b23c770d074fa0c6dfe4bc83896caa9130cb4
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Tue Nov 5 16:20:07 2019 +0000
Make sure that only the client associated with a token can revoke it
(cherry picked from commit a9a7302896c4d52bace3af0ac2e252bf6e4d6ba1)
---
.../oauth2/provider/AbstractOAuthDataProvider.java | 37 +++++++++++++---------
1 file changed, 22 insertions(+), 15 deletions(-)
diff --git
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/AbstractOAuthDataProvider.java
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/AbstractOAuthDataProvider.java
index c335cde..4c6abb1 100644
---
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/AbstractOAuthDataProvider.java
+++
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/AbstractOAuthDataProvider.java
@@ -194,18 +194,18 @@ public abstract class AbstractOAuthDataProvider
implements OAuthDataProvider, Cl
public ServerAccessToken refreshAccessToken(Client client, String
refreshTokenKey,
List<String> restrictedScopes)
throws OAuthServiceException {
RefreshToken currentRefreshToken = recycleRefreshTokens
- ? revokeRefreshToken(refreshTokenKey) :
getRefreshToken(refreshTokenKey);
+ ? revokeRefreshToken(client, refreshTokenKey) :
getRefreshToken(refreshTokenKey);
if (currentRefreshToken == null) {
throw new OAuthServiceException(OAuthConstants.ACCESS_DENIED);
}
if (OAuthUtils.isExpired(currentRefreshToken.getIssuedAt(),
currentRefreshToken.getExpiresIn())) {
if (!recycleRefreshTokens) {
- revokeRefreshToken(refreshTokenKey);
+ revokeRefreshToken(client, refreshTokenKey);
}
throw new OAuthServiceException(OAuthConstants.ACCESS_DENIED);
}
if (recycleRefreshTokens) {
- revokeAccessTokens(currentRefreshToken);
+ revokeAccessTokens(client, currentRefreshToken);
}
ServerAccessToken at = doRefreshAccessToken(client,
currentRefreshToken, restrictedScopes);
@@ -222,16 +222,17 @@ public abstract class AbstractOAuthDataProvider
implements OAuthDataProvider, Cl
public void revokeToken(Client client, String tokenKey, String
tokenTypeHint) throws OAuthServiceException {
ServerAccessToken accessToken = null;
if (!OAuthConstants.REFRESH_TOKEN.equals(tokenTypeHint)) {
- accessToken = revokeAccessToken(tokenKey);
+ accessToken = revokeAccessToken(client, tokenKey);
}
if (accessToken != null) {
- handleLinkedRefreshToken(accessToken);
+ handleLinkedRefreshToken(client, accessToken);
} else if (!OAuthConstants.ACCESS_TOKEN.equals(tokenTypeHint)) {
- RefreshToken currentRefreshToken = revokeRefreshToken(tokenKey);
- revokeAccessTokens(currentRefreshToken);
+ RefreshToken currentRefreshToken = revokeRefreshToken(client,
tokenKey);
+ revokeAccessTokens(client, currentRefreshToken);
}
}
- protected void handleLinkedRefreshToken(ServerAccessToken accessToken) {
+
+ protected void handleLinkedRefreshToken(Client client, ServerAccessToken
accessToken) {
if (accessToken != null && accessToken.getRefreshToken() != null) {
RefreshToken rt = getRefreshToken(accessToken.getRefreshToken());
if (rt == null) {
@@ -240,7 +241,7 @@ public abstract class AbstractOAuthDataProvider implements
OAuthDataProvider, Cl
unlinkRefreshAccessToken(rt, accessToken.getTokenKey());
if (rt.getAccessTokens().isEmpty()) {
- revokeRefreshToken(rt.getTokenKey());
+ revokeRefreshToken(client, rt.getTokenKey());
} else {
saveRefreshToken(rt);
}
@@ -248,10 +249,10 @@ public abstract class AbstractOAuthDataProvider
implements OAuthDataProvider, Cl
}
- protected void revokeAccessTokens(RefreshToken currentRefreshToken) {
+ protected void revokeAccessTokens(Client client, RefreshToken
currentRefreshToken) {
if (currentRefreshToken != null) {
for (String accessTokenKey :
currentRefreshToken.getAccessTokens()) {
- revokeAccessToken(accessTokenKey);
+ revokeAccessToken(client, accessTokenKey);
}
}
}
@@ -490,13 +491,13 @@ public abstract class AbstractOAuthDataProvider
implements OAuthDataProvider, Cl
List<RefreshToken> refreshTokens = getRefreshTokens(c, null);
if (refreshTokens != null) {
for (RefreshToken rt : refreshTokens) {
- revokeRefreshToken(rt.getTokenKey());
+ revokeRefreshToken(c, rt.getTokenKey());
}
}
List<ServerAccessToken> accessTokens = getAccessTokens(c, null);
if (accessTokens != null) {
for (ServerAccessToken at : accessTokens) {
- revokeAccessToken(at.getTokenKey());
+ revokeAccessToken(c, at.getTokenKey());
}
}
}
@@ -544,16 +545,22 @@ public abstract class AbstractOAuthDataProvider
implements OAuthDataProvider, Cl
return null;
}
- protected ServerAccessToken revokeAccessToken(String accessTokenKey) {
+ protected ServerAccessToken revokeAccessToken(Client client, String
accessTokenKey) {
ServerAccessToken at = getAccessToken(accessTokenKey);
if (at != null) {
+ if (!at.getClient().getClientId().equals(client.getClientId())) {
+ throw new OAuthServiceException(OAuthConstants.INVALID_GRANT);
+ }
doRevokeAccessToken(at);
}
return at;
}
- protected RefreshToken revokeRefreshToken(String refreshTokenKey) {
+ protected RefreshToken revokeRefreshToken(Client client, String
refreshTokenKey) {
RefreshToken refreshToken = getRefreshToken(refreshTokenKey);
if (refreshToken != null) {
+ if
(!refreshToken.getClient().getClientId().equals(client.getClientId())) {
+ throw new OAuthServiceException(OAuthConstants.INVALID_GRANT);
+ }
doRevokeRefreshToken(refreshToken);
}
return refreshToken;
