AuthCodeGrantController { @RequestMapping(path = RequestPath.PATH_OAUTH_AUTHORIZE_CODE, method = {GET, POST}) public ModelAndView authorize(HttpServletRequest request, HttpServletResponse response, HttpSession session, @RequestParam("response_type") String responseType, @RequestParam("client_id") long clientId, @RequestParam("redirect_uri") String redirectUri, @RequestParam(name = "scope", required = false) String scope, @RequestParam(name = "state", required = false) String state, @RequestParam(name = "skip_confirm", required = false, defaultValue = "false") boolean skipConfirm, @RequestParam(name = "force_login", required = false, defaultValue = "false") boolean forceLogin) throws VerificationException { log.info("Request authorize code, appId[{}]", clientId); ModelAndView mav = new ModelAndView(); AuthorizeRequestParams requestParams = new AuthorizeRequestParams(responseType, clientId, redirectUri, scope, state); ErrorCode validateResult = requestParams.validate(); if (!ErrorCode.NO_ERROR.equals(validateResult)) { log.error("Request authorize params error, appId[{}], errorCode[{}], params[{}]", clientId, validateResult, requestParams); if (ErrorCode.INVALID_CLIENT.equals(validateResult) || ErrorCode.INVALID_REDIRECT_URI.equals(validateResult)) { return JsonView.render(new ResultInfo(validateResult, state), response, false); } return ResponseUtils.buildErrorResponse(redirectUri, validateResult, state); } AppInfo appInfo = requestParams.getAppInfo(); UserInfo user = SessionUtils.getUser(session, CookieUtils.get(request, COOKIE_KEY_USER_LOGIN_SIGN)); if (null == user || forceLogin) { return ResponseUtils.buildLoginResponse(request, appInfo); } requestParams.setUserInfo(user); Optional<AuthorizeRelation> relation = authorizeRelationService.getAuthorizeRelation(user.getId(), requestParams.getClientId(), requestParams.getScope()); if (relation.isPresent() && skipConfirm) { log.info("User had authorized and issue auth code, appId[{}], userId[{}], scope[{}]", clientId, user.getId(), requestParams.getScope()); AuthorizationCode code = new AuthorizationCode( requestParams.getAppInfo(), user.getId(), relation.get().getScope(), requestParams.getRedirectUri()); String key = code.getValue(); if (StringUtils.isBlank(key)) { log.error("Generate auth code error, appId[{}], userId[{}], scope[{}]", clientId, user.getId(), requestParams.getScope()); return ResponseUtils.buildErrorResponse(redirectUri, ErrorCode.AUTHORIZATION_CODE_GENERATE_ERROR, state); } UriComponentsBuilder builder = UriComponentsBuilder.fromHttpUrl(requestParams.getRedirectUri()); builder.queryParam("code", key); if (StringUtils.isNotEmpty(state)) { builder.queryParam("state", state); } AuthCodeCacheHandler.getInstance().put(key, code); mav.setViewName("redirect:" + builder.toUriString()); return mav; } log.info("User not authorized and goto authorize page, appId[{}], userId[{}], relationExist[{}], skipConfirm[{}]", clientId, user.getId(), relation.isPresent(), skipConfirm); List<Scope> scopes = scopeService.getScopes(requestParams.getScope()); return ResponseUtils.buildAuthorizeResponse(request, scopes, user, appInfo, state); }  @RequestMapping(path = RequestPath.PATH_OAUTH_AUTHORIZE_CODE, method = {GET, POST}) ModelAndView authorize(HttpServletRequest request, HttpServletResponse response, HttpSession session,
                                  @RequestParam("response_type") String responseType,
                                  @RequestParam("client_id") long clientId,
                                  @RequestParam("redirect_uri") String redirectUri,
                                  @RequestParam(name = "scope", required = false) String scope,
                                  @RequestParam(name = "state", required = false) String state,
                                  @RequestParam(name = "skip_confirm", required = false, defaultValue = "false") boolean skipConfirm,
                                  @RequestParam(name = "force_login", required = false, defaultValue = "false") boolean forceLogin); @RequestMapping(path = RequestPath.PATH_OAUTH_AUTHORIZE_TOKEN, method = {GET, POST}) ModelAndView issueToken(HttpServletResponse response,
                                   @RequestParam("grant_type") String grantType,
                                   @RequestParam("code") String code,
                                   @RequestParam("redirect_uri") String redirectUri,
                                   @RequestParam("client_id") long clientId,
                                   @RequestParam(name = "client_secret", required = false) String clientSecret,
                                   @RequestParam(name = "token_type", required = false) String tokenType,
                                   @RequestParam(name = "issue_refresh_token", required = false, defaultValue = "true") boolean refresh);  }
@Test public void authorizeTest() throws Exception { Map<String, Object> params = new HashMap<>(); params.put("response_type", ResponseType.AUTHORIZATION_CODE.getType()); params.put("client_id", CLIENT_ID); params.put("redirect_uri", REDIRECT_URI); Response response = RestAssured.with().params(params).cookies(resp4Login.cookies()).get(PATH_OAUTH_AUTHORIZE_CODE); Assert.assertEquals(200, response.getStatusCode()); response = MockUserOperationUtils.authorizationCodeUserAuthorize(response, resp4Login.cookies(), ALL_SCOPE, StringUtils.EMPTY); System.out.println(response.asString()); Assert.assertEquals(302, response.getStatusCode()); String redirectUrl = response.getHeader("Location"); System.out.println(redirectUrl); response = RestAssured.with().redirects().follow(false).cookies(resp4Login.getCookies()).cookies(response.cookies()).get(redirectUrl); System.out.println(response.getHeader("Location")); Map<String, String> results = ResultUtils.getLocationUrlParamsValue(response); Assert.assertNotNull(results.get("code")); }