Make sure both a request + request_uri can't be specified
@@ -21,9 +21,11 @@ package org.apache.cxf.rs.security.oauth2.grants.code;
import java.security.cert.X509Certificate;
import java.util.List;
import java.util.Map;
+import java.util.logging.Logger;
import javax.ws.rs.core.MultivaluedMap;
+import org.apache.cxf.common.logging.LogUtils;
import org.apache.cxf.helpers.CastUtils;
import org.apache.cxf.jaxrs.client.WebClient;
import org.apache.cxf.jaxrs.impl.MetadataMap;
@@ -42,23 +44,31 @@ import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants;
import org.apache.cxf.rt.security.crypto.CryptoUtils;
public class JwtRequestCodeFilter extends OAuthJoseJwtConsumer implements AuthorizationRequestFilter {
+ protected static final Logger LOG = LogUtils.getL7dLogger(JwtRequestCodeFilter.class);
private static final String REQUEST_URI_CONTENT_TYPE = "application/oauth-authz-req+jwt";
private static final String REQUEST_PARAM = "request";
private static final String REQUEST_URI_PARAM = "request_uri";
+
private boolean verifyWithClientCertificates;
private String issuer;
private JsonMapObjectReaderWriter jsonHandler = new JsonMapObjectReaderWriter();
+
@Override
public MultivaluedMap<String, String> process(MultivaluedMap<String, String> params,
UserSubject endUser,
Client client) {
String requestToken = params.getFirst(REQUEST_PARAM);
- if (requestToken == null) {
String requestUri = params.getFirst(REQUEST_URI_PARAM);
+
+ if (requestToken == null) {
if (isRequestUriValid(client, requestUri)) {
requestToken = WebClient.create(requestUri).accept(REQUEST_URI_CONTENT_TYPE).get(String.class);
}
+ } else if (requestUri != null) {
+ LOG.warning("It is not valid to specify both a request and request_uri value");
+ throw new SecurityException();
}
+
if (requestToken != null) {
JweDecryptionProvider theDecryptor = super.getInitializedDecryptionProvider(client.getClientSecret());
JwsSignatureVerifier theSigVerifier = getInitializedSigVerifier(client);
