Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow custom header during bearer token extraction #8341

Closed
wants to merge 1 commit into from
Closed

Allow custom header during bearer token extraction #8341

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 17 additions & 2 deletions ...a/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolver.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,8 @@ public final class DefaultBearerTokenResolver implements BearerTokenResolver {

private boolean allowUriQueryParameter = false;

private String bearerTokenHeaderName = HttpHeaders.AUTHORIZATION;

/**
* {@inheritDoc}
*/
Expand Down Expand Up @@ -85,8 +87,21 @@ public void setAllowUriQueryParameter(boolean allowUriQueryParameter) {
this.allowUriQueryParameter = allowUriQueryParameter;
}

private static String resolveFromAuthorizationHeader(HttpServletRequest request) {
String authorization = request.getHeader(HttpHeaders.AUTHORIZATION);
/**
* Set this value to configure what header is checked when resolving a Bearer Token.
* This value is defaulted to {@link HttpHeaders#AUTHORIZATION}.
*
* This allows other headers to be used as the Bearer Token source such as {@link HttpHeaders#PROXY_AUTHORIZATION}
*
* @param bearerTokenHeaderName the header to check when retrieving the Bearer Token.
* @since 5.4
*/
public void setBearerTokenHeaderName(String bearerTokenHeaderName) {
this.bearerTokenHeaderName = bearerTokenHeaderName;
}

private String resolveFromAuthorizationHeader(HttpServletRequest request) {
String authorization = request.getHeader(this.bearerTokenHeaderName);
if (StringUtils.startsWithIgnoreCase(authorization, "bearer")) {
Matcher matcher = authorizationPattern.matcher(authorization);

Expand Down
18 changes: 16 additions & 2 deletions .../security/oauth2/server/resource/web/server/ServerBearerTokenAuthenticationConverter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@ public class ServerBearerTokenAuthenticationConverter
Pattern.CASE_INSENSITIVE);

private boolean allowUriQueryParameter = false;
private String bearerTokenHeaderName = HttpHeaders.AUTHORIZATION;

public Mono<Authentication> convert(ServerWebExchange exchange) {
return Mono.justOrEmpty(token(exchange.getRequest()))
Expand Down Expand Up @@ -90,8 +91,21 @@ public void setAllowUriQueryParameter(boolean allowUriQueryParameter) {
this.allowUriQueryParameter = allowUriQueryParameter;
}

private static String resolveFromAuthorizationHeader(HttpHeaders headers) {
String authorization = headers.getFirst(HttpHeaders.AUTHORIZATION);
/**
* Set this value to configure what header is checked when resolving a Bearer Token.
* This value is defaulted to {@link HttpHeaders#AUTHORIZATION}.
*
* This allows other headers to be used as the Bearer Token source such as {@link HttpHeaders#PROXY_AUTHORIZATION}
*
* @param bearerTokenHeaderName the header to check when retrieving the Bearer Token.
* @since 5.4
*/
public void setBearerTokenHeaderName(String bearerTokenHeaderName) {
this.bearerTokenHeaderName = bearerTokenHeaderName;
}

private String resolveFromAuthorizationHeader(HttpHeaders headers) {
String authorization = headers.getFirst(this.bearerTokenHeaderName);
if (StringUtils.startsWithIgnoreCase(authorization, "bearer")) {
Matcher matcher = authorizationPattern.matcher(authorization);

Expand Down
11 changes: 10 additions & 1 deletion .../springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolverTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@
* @author Vedran Pavic
*/
public class DefaultBearerTokenResolverTests {

private static final String CUSTOM_HEADER = "custom-header";
private static final String TEST_TOKEN = "test-token";

private DefaultBearerTokenResolver resolver;
Expand All @@ -51,6 +51,15 @@ public void resolveWhenValidHeaderIsPresentThenTokenIsResolved() {
assertThat(this.resolver.resolve(request)).isEqualTo(TEST_TOKEN);
}

@Test
public void resolveWhenCustomDefinedHeaderIsValidAndPresentThenTokenIsResolved() {
this.resolver.setBearerTokenHeaderName(CUSTOM_HEADER);
MockHttpServletRequest request = new MockHttpServletRequest();
request.addHeader(CUSTOM_HEADER, "Bearer " + TEST_TOKEN);

assertThat(this.resolver.resolve(request)).isEqualTo(TEST_TOKEN);
}

@Test
public void resolveWhenLowercaseHeaderIsPresentThenTokenIsResolved() {
MockHttpServletRequest request = new MockHttpServletRequest();
Expand Down
11 changes: 11 additions & 0 deletions ...rity/oauth2/server/resource/web/server/ServerBearerTokenAuthenticationConverterTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@
* @since 5.1
*/
public class ServerBearerTokenAuthenticationConverterTests {
private static final String CUSTOM_HEADER = "custom-header";
private static final String TEST_TOKEN = "test-token";

private ServerBearerTokenAuthenticationConverter converter;
Expand All @@ -56,6 +57,16 @@ public void resolveWhenValidHeaderIsPresentThenTokenIsResolved() {
assertThat(convertToToken(request).getToken()).isEqualTo(TEST_TOKEN);
}

@Test
public void resolveWhenCustomDefinedHeaderIsValidAndPresentThenTokenIsResolved() {
this.converter.setBearerTokenHeaderName(CUSTOM_HEADER);
MockServerHttpRequest.BaseBuilder<?> request = MockServerHttpRequest
.get("/")
.header(CUSTOM_HEADER, "Bearer " + TEST_TOKEN);

assertThat(convertToToken(request).getToken()).isEqualTo(TEST_TOKEN);
}

// gh-7011
@Test
public void resolveWhenValidHeaderIsEmptyStringThenTokenIsResolved() {
Expand Down