Opaque token introspectors should not allow empty credentials

Describe the bug

In Spring Security 7.0 and earlier, both SpringOpaqueTokenIntrospector and SpringReactiveOpaqueTokenIntrospector could not be created without a client ID and secret. In 7.1, this has changed and the introspector is now created but it won't use basic auth:

spring-security/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/introspection/SpringOpaqueTokenIntrospector.java

Lines 384 to 387 in aaaa9b9

    
           if (this.clientId != null && this.clientSecret != null) { 
        
           	restTemplate.getInterceptors() 
        
           		.add(new BasicAuthenticationInterceptor(this.clientId, this.clientSecret)); 
        
           }

spring-security/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/introspection/SpringReactiveOpaqueTokenIntrospector.java

Lines 338 to 342 in aaaa9b9

    
           if (this.clientId != null && this.clientSecret != null) { 
        
           	String clientId = this.clientId; 
        
           	String clientSecret = this.clientSecret; 
        
           	builder.defaultHeaders((h) -> h.setBasicAuth(clientId, clientSecret)); 
        
           }

To Reproduce

SpringReactiveOpaqueTokenIntrospector
    .withIntrospectionUri(opaquetoken.getIntrospectionUri())
    .build();

Expected behavior

Creation fails as client ID and secret are required.

Align Assertions in Builder with Deprecated Constructor

Navigation Menu

Repository navigation

Opaque token introspectors should not allow empty credentials #19201

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	if (this.clientId != null && this.clientSecret != null) {
	restTemplate.getInterceptors()
	.add(new BasicAuthenticationInterceptor(this.clientId, this.clientSecret));
	}

	if (this.clientId != null && this.clientSecret != null) {
	String clientId = this.clientId;
	String clientSecret = this.clientSecret;
	builder.defaultHeaders((h) -> h.setBasicAuth(clientId, clientSecret));
	}

Opaque token introspectors should not allow empty credentials #19201

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions