diff --git a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/WebSessionOAuth2ReactiveAuthorizationRequestRepository.java b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/WebSessionOAuth2ReactiveAuthorizationRequestRepository.java index 2783c5968f..aa8b4302a6 100644 --- a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/WebSessionOAuth2ReactiveAuthorizationRequestRepository.java +++ b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/WebSessionOAuth2ReactiveAuthorizationRequestRepository.java @@ -84,7 +84,11 @@ public final class WebSessionOAuth2ReactiveAuthorizationRequestRepository implem if (stateToAuthzRequest.isEmpty()) { sessionAttrs.remove(this.sessionAttributeName); } - sink.next(removedValue); + if (removedValue == null) { + sink.complete(); + } else { + sink.next(removedValue); + } }); } diff --git a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/web/WebSessionOAuth2ReactiveAuthorizationRequestRepositoryTests.java b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/web/WebSessionOAuth2ReactiveAuthorizationRequestRepositoryTests.java index c4fc7adaed..50d18bf6db 100644 --- a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/web/WebSessionOAuth2ReactiveAuthorizationRequestRepositoryTests.java +++ b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/web/WebSessionOAuth2ReactiveAuthorizationRequestRepositoryTests.java @@ -24,6 +24,7 @@ import org.junit.Test; import org.springframework.http.codec.ServerCodecConfigurer; import org.springframework.mock.http.server.reactive.MockServerHttpRequest; import org.springframework.mock.http.server.reactive.MockServerHttpResponse; +import org.springframework.mock.web.MockHttpServletRequest; import org.springframework.mock.web.server.MockServerWebExchange; import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest; import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames; @@ -179,6 +180,23 @@ public class WebSessionOAuth2ReactiveAuthorizationRequestRepositoryTests { .verifyComplete(); } + // gh-5599 + @Test + public void removeAuthorizationRequestWhenStateMissingThenNoErrors() { + MockServerHttpRequest otherState = MockServerHttpRequest.get("/") + .queryParam(OAuth2ParameterNames.STATE, "other") + .build(); + ServerWebExchange otherStateExchange = this.exchange.mutate() + .request(otherState) + .build(); + Mono saveAndRemove = this.repository + .saveAuthorizationRequest(this.authorizationRequest, this.exchange) + .then(this.repository.removeAuthorizationRequest(otherStateExchange)); + + StepVerifier.create(saveAndRemove) + .verifyComplete(); + } + @Test public void removeAuthorizationRequestWhenMultipleThenOnlyOneRemoved() { String oldState = "state0";