You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2026/06/26 09:02:38 UTC
(cxf) branch coheigea/CXF-9222 created (now 88e351cae31)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a change to branch coheigea/CXF-9222
in repository https://gitbox.apache.org/repos/asf/cxf.git
at 88e351cae31 CXF-9222 - Remove partialMatchScopeValidation for OAuth
This branch includes the following new commits:
new 88e351cae31 CXF-9222 - Remove partialMatchScopeValidation for OAuth
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(cxf) 01/01: CXF-9222 - Remove partialMatchScopeValidation for OAuth
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch coheigea/CXF-9222
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 88e351cae31e5a7ef40fd8eba1b1c3aed611f3ad
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Fri Jun 26 10:02:11 2026 +0100
CXF-9222 - Remove partialMatchScopeValidation for OAuth
---
.../oauth2/grants/AbstractGrantHandler.java | 3 +-
.../grants/refresh/RefreshTokenGrantHandler.java | 7 +---
.../services/RedirectionBasedGrantService.java | 11 +-----
.../cxf/rs/security/oauth2/utils/OAuthUtils.java | 30 +++------------
.../rs/security/oauth2/utils/OAuthUtilsTest.java | 43 +++++++++-------------
5 files changed, 28 insertions(+), 66 deletions(-)
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/AbstractGrantHandler.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/AbstractGrantHandler.java
index 25071b31f0a..6ff15913bf8 100644
--- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/AbstractGrantHandler.java
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/AbstractGrantHandler.java
@@ -144,8 +144,7 @@ public abstract class AbstractGrantHandler implements AccessTokenGrantHandler {
String requestedGrant,
List<String> requestedScopes,
List<String> audiences) {
- if (!OAuthUtils.validateScopes(requestedScopes, client.getRegisteredScopes(),
- partialMatchScopeValidation)) {
+ if (!OAuthUtils.validateScopes(requestedScopes, client.getRegisteredScopes())) {
throw new OAuthServiceException(new OAuthError(OAuthConstants.INVALID_SCOPE));
}
if (!OAuthUtils.validateAudiences(audiences, client.getRegisteredAudiences())) {
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/refresh/RefreshTokenGrantHandler.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/refresh/RefreshTokenGrantHandler.java
index 67e77e3d6ca..153f9882d59 100644
--- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/refresh/RefreshTokenGrantHandler.java
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/refresh/RefreshTokenGrantHandler.java
@@ -33,7 +33,6 @@ import org.apache.cxf.rs.security.oauth2.utils.OAuthUtils;
public class RefreshTokenGrantHandler implements AccessTokenGrantHandler {
private OAuthDataProvider dataProvider;
- private boolean partialMatchScopeValidation;
private boolean useAllClientScopes;
public void setDataProvider(OAuthDataProvider dataProvider) {
@@ -50,16 +49,12 @@ public class RefreshTokenGrantHandler implements AccessTokenGrantHandler {
List<String> requestedScopes = OAuthUtils.getRequestedScopes(client,
params.getFirst(OAuthConstants.SCOPE),
useAllClientScopes,
- partialMatchScopeValidation, false);
+ false);
final ServerAccessToken st = dataProvider.refreshAccessToken(client, refreshToken, requestedScopes);
st.setGrantType(OAuthConstants.REFRESH_TOKEN_GRANT);
return st;
}
- public void setPartialMatchScopeValidation(boolean partialMatchScopeValidation) {
- this.partialMatchScopeValidation = partialMatchScopeValidation;
- }
-
public void setUseAllClientScopes(boolean useAllClientScopes) {
this.useAllClientScopes = useAllClientScopes;
}
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java
index 0267ed33080..ec64a26f1ed 100644
--- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java
@@ -61,7 +61,6 @@ public abstract class RedirectionBasedGrantService extends AbstractOAuthService
private Set<String> supportedResponseTypes;
private String supportedGrantType;
private boolean useAllClientScopes;
- private boolean partialMatchScopeValidation;
private boolean useRegisteredRedirectUriIfPossible = true;
private SessionAuthenticityTokenProvider sessionAuthenticityTokenProvider;
private SubjectCreator subjectCreator;
@@ -180,8 +179,7 @@ public abstract class RedirectionBasedGrantService extends AbstractOAuthService
try {
requestedScope = OAuthUtils.getRequestedScopes(client,
providedScope,
- useAllClientScopes,
- partialMatchScopeValidation);
+ useAllClientScopes);
requestedPermissions = getDataProvider().convertScopeToPermissions(client, requestedScope);
} catch (OAuthServiceException ex) {
LOG.log(Level.FINE, "Error processing scopes", ex);
@@ -401,8 +399,7 @@ public abstract class RedirectionBasedGrantService extends AbstractOAuthService
approvedScope.add(rScope);
}
}
- if (!OAuthUtils.validateScopes(requestedScope, client.getRegisteredScopes(),
- partialMatchScopeValidation)) {
+ if (!OAuthUtils.validateScopes(requestedScope, client.getRegisteredScopes())) {
return createErrorResponse(params, redirectUri, OAuthConstants.INVALID_SCOPE);
}
getMessageContext().put(AUTHORIZATION_REQUEST_PARAMETERS, params);
@@ -571,10 +568,6 @@ public abstract class RedirectionBasedGrantService extends AbstractOAuthService
this.resourceOwnerNameProvider = resourceOwnerNameProvider;
}
- public void setPartialMatchScopeValidation(boolean partialMatchScopeValidation) {
- this.partialMatchScopeValidation = partialMatchScopeValidation;
- }
-
public void setUseAllClientScopes(boolean useAllClientScopes) {
this.useAllClientScopes = useAllClientScopes;
}
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/utils/OAuthUtils.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/utils/OAuthUtils.java
index cee0893b95d..2c0b54ce2d9 100644
--- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/utils/OAuthUtils.java
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/utils/OAuthUtils.java
@@ -321,15 +321,13 @@ public final class OAuthUtils {
public static List<String> getRequestedScopes(Client client,
String scopeParameter,
- boolean useAllClientScopes,
- boolean partialMatchScopeValidation) {
- return getRequestedScopes(client, scopeParameter, useAllClientScopes, partialMatchScopeValidation, true);
+ boolean useAllClientScopes) {
+ return getRequestedScopes(client, scopeParameter, useAllClientScopes, true);
}
public static List<String> getRequestedScopes(Client client,
String scopeParameter,
boolean useAllClientScopes,
- boolean partialMatchScopeValidation,
boolean defaultToRegisteredScopes) {
List<String> requestScopes = parseScope(scopeParameter);
List<String> registeredScopes = client.getRegisteredScopes();
@@ -339,7 +337,7 @@ public final class OAuthUtils {
}
return requestScopes;
}
- if (!validateScopes(requestScopes, registeredScopes, partialMatchScopeValidation)) {
+ if (!validateScopes(requestScopes, registeredScopes)) {
throw new OAuthServiceException("Unexpected scope");
}
if (useAllClientScopes) {
@@ -353,26 +351,10 @@ public final class OAuthUtils {
return requestScopes;
}
- public static boolean validateScopes(List<String> requestScopes, List<String> registeredScopes,
- boolean partialMatchScopeValidation) {
+ public static boolean validateScopes(List<String> requestScopes, List<String> registeredScopes) {
if (!registeredScopes.isEmpty()) {
- // if it is a strict validation then pre-registered scopes have to contains all
- // the current request scopes
- if (!partialMatchScopeValidation) {
- return registeredScopes.containsAll(requestScopes);
- }
- for (String requestScope : requestScopes) {
- boolean match = false;
- for (String registeredScope : registeredScopes) {
- if (requestScope.startsWith(registeredScope)) {
- match = true;
- break;
- }
- }
- if (!match) {
- return false;
- }
- }
+ // pre-registered scopes have to contains all the current request scopes
+ return registeredScopes.containsAll(requestScopes);
}
return true;
}
diff --git a/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/utils/OAuthUtilsTest.java b/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/utils/OAuthUtilsTest.java
index 72520960ce8..d0072a34e31 100644
--- a/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/utils/OAuthUtilsTest.java
+++ b/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/utils/OAuthUtilsTest.java
@@ -18,11 +18,8 @@
*/
package org.apache.cxf.rs.security.oauth2.utils;
-import java.util.Collections;
import java.util.List;
-import org.apache.cxf.rs.security.oauth2.common.Client;
-
import org.junit.Test;
import static org.junit.Assert.assertEquals;
@@ -35,42 +32,38 @@ public class OAuthUtilsTest {
public void testValidateScopesStrict() {
List<String> requestScopes = OAuthUtils.parseScope("a c b");
List<String> registeredScopes = OAuthUtils.parseScope("a b c d");
- assertTrue(OAuthUtils.validateScopes(requestScopes, registeredScopes, false));
+ assertTrue(OAuthUtils.validateScopes(requestScopes, registeredScopes));
}
@Test
public void testValidateScopesStrictFail() {
List<String> requestScopes = OAuthUtils.parseScope("a b c d");
List<String> registeredScopes = OAuthUtils.parseScope("a b d");
- assertFalse(OAuthUtils.validateScopes(requestScopes, registeredScopes, false));
- }
-
- @Test
- public void testValidateScopesPartial() {
- List<String> requestScopes = OAuthUtils.parseScope("a b c-1");
- List<String> registeredScopes = OAuthUtils.parseScope("a b c");
- assertTrue(OAuthUtils.validateScopes(requestScopes, registeredScopes, true));
+ assertFalse(OAuthUtils.validateScopes(requestScopes, registeredScopes));
}
@Test
- public void testValidateScopesPartialFail() {
- List<String> requestScopes = OAuthUtils.parseScope("a b c");
- List<String> registeredScopes = OAuthUtils.parseScope("a b");
- assertFalse(OAuthUtils.validateScopes(requestScopes, registeredScopes, true));
+ public void testParseScopeEmpty() {
+ assertTrue(OAuthUtils.parseScope(null).isEmpty());
+ assertTrue(OAuthUtils.parseScope("").isEmpty());
+ assertTrue(OAuthUtils.parseScope(" ").isEmpty());
}
@Test
- public void testGetRequestedScopesRegistered() {
- Client c = new Client();
- List<String> scopes = Collections.singletonList("a");
- c.setRegisteredScopes(scopes);
- assertEquals(scopes, OAuthUtils.getRequestedScopes(c, "", false, false));
+ public void testParseScopeWithExtraSpaces() {
+ List<String> scopes = OAuthUtils.parseScope(" read write admin ");
+ assertEquals(3, scopes.size());
+ assertEquals("read", scopes.get(0));
+ assertEquals("write", scopes.get(1));
+ assertEquals("admin", scopes.get(2));
}
@Test
- public void testParseScopeEmpty() {
- assertTrue(OAuthUtils.parseScope(null).isEmpty());
- assertTrue(OAuthUtils.parseScope("").isEmpty());
- assertTrue(OAuthUtils.parseScope(" ").isEmpty());
+ public void testParseScopeWithDuplicates() {
+ List<String> scopes = OAuthUtils.parseScope("a a b");
+ assertEquals(3, scopes.size());
+ assertEquals("a", scopes.get(0));
+ assertEquals("a", scopes.get(1));
+ assertEquals("b", scopes.get(2));
}
}