@Test public void authorize() throws Exception { when(clientAppService.verifyRedirectUri(clientApp.getClientId(), "foo: Optional.of(clientApp)); mockMvc.perform(get("/oauth/authorize").param("client_id", clientApp.getClientId()) .param("scope", "feed article") .param("state", "123") .param("response_type", "code") .param("redirect_uri", "foo: .andExpect(view().name("v1/authorize")) .andExpect(status().isOk()) .andExpect(containsText("news feed")); }
@RequestMapping(value = "/authorize", method = RequestMethod.GET) public Object authorize(HttpServletResponse response, @RequestParam(value = "client_id", required = false) String clientId, @RequestParam(value = "state", required = false) String state, @RequestParam(value = "scope", required = false) String scope, @RequestParam(value = "response_type", required = false) String responseType, @RequestParam(value = "redirect_uri", required = false) String redirectUri) { try { Optional<ClientApp> clientApp = clientAppService.verifyRedirectUri(clientId, redirectUri); if (!clientApp.isPresent()) { logger.warn("invalid redirect uri, may be attack: {}, {}", clientId, redirectUri); response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new ModelAndView("error"); } if (!"code".equals(responseType)) { return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.UNSUPPORTED_RESPONSE_TYPE, "response_type must be code", state); } if (Strings.isNullOrEmpty(state)) { return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.INVALID_REQUEST, "missing state", state); } Set<ClientAppScope> clientAppScopes = ClientAppScope.tryParse(scope); if (clientAppScopes.isEmpty()) { return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.INVALID_SCOPE, "wrong scope", state); } return new ModelAndView("v1/authorize").addObject("clientApp", clientApp.get()) .addObject("clientAppScopes", clientAppScopes); } catch (RuntimeException e) { logger.warn("unexpected error while GET /authorize", e); return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.SERVER_ERROR, "unknown server error", state); } }
OauthController { @RequestMapping(value = "/authorize", method = RequestMethod.GET) public Object authorize(HttpServletResponse response, @RequestParam(value = "client_id", required = false) String clientId, @RequestParam(value = "state", required = false) String state, @RequestParam(value = "scope", required = false) String scope, @RequestParam(value = "response_type", required = false) String responseType, @RequestParam(value = "redirect_uri", required = false) String redirectUri) { try { Optional<ClientApp> clientApp = clientAppService.verifyRedirectUri(clientId, redirectUri); if (!clientApp.isPresent()) { logger.warn("invalid redirect uri, may be attack: {}, {}", clientId, redirectUri); response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new ModelAndView("error"); } if (!"code".equals(responseType)) { return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.UNSUPPORTED_RESPONSE_TYPE, "response_type must be code", state); } if (Strings.isNullOrEmpty(state)) { return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.INVALID_REQUEST, "missing state", state); } Set<ClientAppScope> clientAppScopes = ClientAppScope.tryParse(scope); if (clientAppScopes.isEmpty()) { return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.INVALID_SCOPE, "wrong scope", state); } return new ModelAndView("v1/authorize").addObject("clientApp", clientApp.get()) .addObject("clientAppScopes", clientAppScopes); } catch (RuntimeException e) { logger.warn("unexpected error while GET /authorize", e); return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.SERVER_ERROR, "unknown server error", state); } } }
OauthController { @RequestMapping(value = "/authorize", method = RequestMethod.GET) public Object authorize(HttpServletResponse response, @RequestParam(value = "client_id", required = false) String clientId, @RequestParam(value = "state", required = false) String state, @RequestParam(value = "scope", required = false) String scope, @RequestParam(value = "response_type", required = false) String responseType, @RequestParam(value = "redirect_uri", required = false) String redirectUri) { try { Optional<ClientApp> clientApp = clientAppService.verifyRedirectUri(clientId, redirectUri); if (!clientApp.isPresent()) { logger.warn("invalid redirect uri, may be attack: {}, {}", clientId, redirectUri); response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new ModelAndView("error"); } if (!"code".equals(responseType)) { return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.UNSUPPORTED_RESPONSE_TYPE, "response_type must be code", state); } if (Strings.isNullOrEmpty(state)) { return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.INVALID_REQUEST, "missing state", state); } Set<ClientAppScope> clientAppScopes = ClientAppScope.tryParse(scope); if (clientAppScopes.isEmpty()) { return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.INVALID_SCOPE, "wrong scope", state); } return new ModelAndView("v1/authorize").addObject("clientApp", clientApp.get()) .addObject("clientAppScopes", clientAppScopes); } catch (RuntimeException e) { logger.warn("unexpected error while GET /authorize", e); return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.SERVER_ERROR, "unknown server error", state); } }  }
OauthController { @RequestMapping(value = "/authorize", method = RequestMethod.GET) public Object authorize(HttpServletResponse response, @RequestParam(value = "client_id", required = false) String clientId, @RequestParam(value = "state", required = false) String state, @RequestParam(value = "scope", required = false) String scope, @RequestParam(value = "response_type", required = false) String responseType, @RequestParam(value = "redirect_uri", required = false) String redirectUri) { try { Optional<ClientApp> clientApp = clientAppService.verifyRedirectUri(clientId, redirectUri); if (!clientApp.isPresent()) { logger.warn("invalid redirect uri, may be attack: {}, {}", clientId, redirectUri); response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new ModelAndView("error"); } if (!"code".equals(responseType)) { return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.UNSUPPORTED_RESPONSE_TYPE, "response_type must be code", state); } if (Strings.isNullOrEmpty(state)) { return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.INVALID_REQUEST, "missing state", state); } Set<ClientAppScope> clientAppScopes = ClientAppScope.tryParse(scope); if (clientAppScopes.isEmpty()) { return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.INVALID_SCOPE, "wrong scope", state); } return new ModelAndView("v1/authorize").addObject("clientApp", clientApp.get()) .addObject("clientAppScopes", clientAppScopes); } catch (RuntimeException e) { logger.warn("unexpected error while GET /authorize", e); return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.SERVER_ERROR, "unknown server error", state); } }  @RequestMapping(value = "/authorize", method = RequestMethod.GET) Object authorize(HttpServletResponse response,
      @RequestParam(value = "client_id", required = false) String clientId,
      @RequestParam(value = "state", required = false) String state,
      @RequestParam(value = "scope", required = false) String scope,
      @RequestParam(value = "response_type", required = false) String responseType,
      @RequestParam(value = "redirect_uri", required = false) String redirectUri); @RequestMapping(value = "/authorize", method = RequestMethod.POST) Object grantCode(HttpServletResponse response,
      @RequestParam(value = "grantDeny", required = false) Boolean grantDeny,
      @RequestParam(value = "oauthDirectAuthorize") String oauthDirectAuthorize,
      @RequestParam(value = "client_id") String clientId,
      @RequestParam(value = "state") String state,
      @RequestParam(value = "scope") String scope,
      @RequestParam(value = "redirect_uri") String redirectUri); @RequestMapping(value = "/access-token", method = RequestMethod.POST) @ResponseBody Object accessToken(HttpServletResponse response,
      @RequestParam(value = "client_id", required = false) String clientId,
      @RequestParam(value = "client_secret", required = false) String clientSecret,
      @RequestParam(value = "grant_type", required = false) String grantType,
      @RequestParam(value = "code", required = false) String code,
      @RequestParam(value = "redirect_uri", required = false) String redirectUri); }
OauthController { @RequestMapping(value = "/authorize", method = RequestMethod.GET) public Object authorize(HttpServletResponse response, @RequestParam(value = "client_id", required = false) String clientId, @RequestParam(value = "state", required = false) String state, @RequestParam(value = "scope", required = false) String scope, @RequestParam(value = "response_type", required = false) String responseType, @RequestParam(value = "redirect_uri", required = false) String redirectUri) { try { Optional<ClientApp> clientApp = clientAppService.verifyRedirectUri(clientId, redirectUri); if (!clientApp.isPresent()) { logger.warn("invalid redirect uri, may be attack: {}, {}", clientId, redirectUri); response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new ModelAndView("error"); } if (!"code".equals(responseType)) { return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.UNSUPPORTED_RESPONSE_TYPE, "response_type must be code", state); } if (Strings.isNullOrEmpty(state)) { return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.INVALID_REQUEST, "missing state", state); } Set<ClientAppScope> clientAppScopes = ClientAppScope.tryParse(scope); if (clientAppScopes.isEmpty()) { return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.INVALID_SCOPE, "wrong scope", state); } return new ModelAndView("v1/authorize").addObject("clientApp", clientApp.get()) .addObject("clientAppScopes", clientAppScopes); } catch (RuntimeException e) { logger.warn("unexpected error while GET /authorize", e); return redirectViewWithError(redirectUri, OauthErrors.CodeResponse.SERVER_ERROR, "unknown server error", state); } }  @RequestMapping(value = "/authorize", method = RequestMethod.GET) Object authorize(HttpServletResponse response,
      @RequestParam(value = "client_id", required = false) String clientId,
      @RequestParam(value = "state", required = false) String state,
      @RequestParam(value = "scope", required = false) String scope,
      @RequestParam(value = "response_type", required = false) String responseType,
      @RequestParam(value = "redirect_uri", required = false) String redirectUri); @RequestMapping(value = "/authorize", method = RequestMethod.POST) Object grantCode(HttpServletResponse response,
      @RequestParam(value = "grantDeny", required = false) Boolean grantDeny,
      @RequestParam(value = "oauthDirectAuthorize") String oauthDirectAuthorize,
      @RequestParam(value = "client_id") String clientId,
      @RequestParam(value = "state") String state,
      @RequestParam(value = "scope") String scope,
      @RequestParam(value = "redirect_uri") String redirectUri); @RequestMapping(value = "/access-token", method = RequestMethod.POST) @ResponseBody Object accessToken(HttpServletResponse response,
      @RequestParam(value = "client_id", required = false) String clientId,
      @RequestParam(value = "client_secret", required = false) String clientSecret,
      @RequestParam(value = "grant_type", required = false) String grantType,
      @RequestParam(value = "code", required = false) String code,
      @RequestParam(value = "redirect_uri", required = false) String redirectUri);  }