Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-09-11 03:39:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '7.1.x'

Browse Source 
Closes gh-19649
This commit is contained in:
Josh Cummings
2026-09-03 15:28:33 -06:00
parent c7be397a16 9989735a49
commit d09463b865
2 changed files with 31 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/authentication/BearerTokenAuthentication.java
+3 -2
View File
@@ -53,7 +53,7 @@ public class BearerTokenAuthentication extends AbstractOAuth2TokenAuthentication
public BearerTokenAuthentication(OAuth2AuthenticatedPrincipal principal, OAuth2AccessToken credentials,
Collection<? extends GrantedAuthority> authorities) {
super(credentials, principal, credentials, authorities);
Assert.isTrue(credentials.getTokenType() == OAuth2AccessToken.TokenType.BEARER,
Assert.isTrue(OAuth2AccessToken.TokenType.BEARER.equals(credentials.getTokenType()),
"credentials must be a bearer token");
this.attributes = Collections.unmodifiableMap(new LinkedHashMap<>(principal.getAttributes()));
setAuthenticated(true);
@@ -121,7 +121,8 @@ public class BearerTokenAuthentication extends AbstractOAuth2TokenAuthentication
*/
@Override
public B token(OAuth2AccessToken token) {
Assert.isTrue(token.getTokenType() == OAuth2AccessToken.TokenType.BEARER, "token must be a bearer token");
Assert.isTrue(OAuth2AccessToken.TokenType.BEARER.equals(token.getTokenType()),
"token must be a bearer token");
super.credentials(token);
return super.token(token);
}
oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/authentication/BearerTokenAuthenticationTests.java
+28
View File
@@ -173,4 +173,32 @@ public class BearerTokenAuthenticationTests {
assertThat(authorities).containsExactlyInAnyOrder("FACTOR_ONE", "FACTOR_TWO");
}
// gh-19377
@Test
public void compareCredentialsHasBearerTokenType() {
Instant current = Instant.now();
Instant after1hour = Instant.now().plusSeconds(3600);
OAuth2AccessToken oAuth2AccessToken = new OAuth2AccessToken(new OAuth2AccessToken.TokenType("Bearer"), "token",
current, after1hour);
BearerTokenAuthentication authenticated = new BearerTokenAuthentication(this.principal, oAuth2AccessToken,
this.authorities);
assertThat(authenticated.getName()).isEqualTo(this.name);
assertThat(authenticated.getCredentials())
.isEqualTo(new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER, "token", current, after1hour));
}
// gh-19377
@Test
public void toBuilderCompareCredentialsHasBearerTokenType() {
Instant current = Instant.now();
Instant after1hour = Instant.now().plusSeconds(3600);
OAuth2AccessToken oAuth2AccessToken = new OAuth2AccessToken(new OAuth2AccessToken.TokenType("Bearer"), "token",
current, after1hour);
BearerTokenAuthentication token = new BearerTokenAuthentication(this.principal, this.token, this.authorities);
BearerTokenAuthentication authenticated = token.toBuilder().token(oAuth2AccessToken).build();
assertThat(authenticated.getName()).isEqualTo(this.name);
assertThat(authenticated.getCredentials())
.isEqualTo(new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER, "token", current, after1hour));
}
}