Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-06 02:08:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Deprecate Implicit Grant

Browse Source 
Fixes gh-8013
This commit is contained in:
Joe Grandja
2020-02-23 08:08:12 -05:00
parent c8cc9717c9
commit 204a612be1
4 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/AuthorizationGrantType.java
+10
View File
@@ -36,7 +36,17 @@ import java.io.Serializable;
public final class AuthorizationGrantType implements Serializable {
private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
public static final AuthorizationGrantType AUTHORIZATION_CODE = new AuthorizationGrantType("authorization_code");
/**
* It is not recommended to use the implicit flow
* due to the inherent risks of returning access tokens in an HTTP redirect
* without any confirmation that it has been received by the client.
*
* @see <a target="_blank" href="https://oauth.net/2/grant-types/implicit/">OAuth 2.0 Implicit Grant</a>
*/
@Deprecated
public static final AuthorizationGrantType IMPLICIT = new AuthorizationGrantType("implicit");
public static final AuthorizationGrantType REFRESH_TOKEN = new AuthorizationGrantType("refresh_token");
public static final AuthorizationGrantType CLIENT_CREDENTIALS = new AuthorizationGrantType("client_credentials");
public static final AuthorizationGrantType PASSWORD = new AuthorizationGrantType("password");
oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/endpoint/OAuth2AuthorizationRequest.java
+5
View File
@@ -186,8 +186,13 @@ public final class OAuth2AuthorizationRequest implements Serializable {
/**
* Returns a new {@link Builder}, initialized with the implicit grant type.
*
* @deprecated It is not recommended to use the implicit flow
* due to the inherent risks of returning access tokens in an HTTP redirect
* without any confirmation that it has been received by the client.
* @see <a target="_blank" href="https://oauth.net/2/grant-types/implicit/">OAuth 2.0 Implicit Grant</a>
* @return the {@link Builder}
*/
@Deprecated
public static Builder implicit() {
return new Builder(AuthorizationGrantType.IMPLICIT);
}