OpenIdSessionStateCalculator { public String calculate(String currentUserId, String clientId, String origin) { byte[] array = new byte[32]; secureRandom.nextBytes(array); String salt = Hex.encodeHexString(array).toLowerCase(); String text = String.format("%s %s %s %s", clientId, origin, currentUserId, salt); byte[] hash = DigestUtils.sha256(text.getBytes(StandardCharsets.UTF_8)); logger.debug(String.format("Calculated OIDC session state for clientId=%s, origin=%s, sessionId=REDACTED, salt=%s", clientId, origin, salt)); return String.format("%s.%s", Hex.encodeHexString(hash).toLowerCase(), salt); } OpenIdSessionStateCalculator(); String calculate(String currentUserId, String clientId, String origin); void setSecureRandom(SecureRandom secureRandom);  }
@Test public void calculate() { String sessionState = calculator.calculate("current-user-id", "client_id", "http: assertEquals("3b501628aea599d810e86e06884fd5a468b91a7a1c05c5a0b7211b553ec4aa02.0000000000000000000000000000000000000000000000000000000000000000", sessionState); }
@Test public void calculate_shouldChangeSessionIdChanges() { String sessionState = calculator.calculate("current-user-id2", "client_id", "http: assertEquals("8ccaa974ff0d15740285da892a1296ff4cebcf6dfcc4b76bd36e76565aadf3df.0000000000000000000000000000000000000000000000000000000000000000", sessionState); }
@Test public void calculate_shouldChangeClientIdChanges() { String sessionState = calculator.calculate("current-user-id", "client_id2", "http: assertEquals("cfe7afa30be40cc680db7e0311b7cb559381995632477f05f66d7d88f905a6f4.0000000000000000000000000000000000000000000000000000000000000000", sessionState); }