Skip to content

Commit 2915a70

Browse files
author
Steve Riesenberg
committed
Merge branch '5.6.x' into 5.7.x
2 parents aed7a86 + 6530777 commit 2915a70

19 files changed

+369
-142
lines changed

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/AbstractWebClientReactiveOAuth2AccessTokenResponseClient.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2021 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -214,7 +214,7 @@ BodyInserters.FormInserter<String> populateTokenRequestBody(T grantRequest,
214214
* no scopes.
215215
*/
216216
Set<String> defaultScopes(T grantRequest) {
217-
return scopes(grantRequest);
217+
return Collections.emptySet();
218218
}
219219

220220
/**

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/DefaultAuthorizationCodeTokenResponseClient.java

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -30,7 +30,6 @@
3030
import org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse;
3131
import org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter;
3232
import org.springframework.util.Assert;
33-
import org.springframework.util.CollectionUtils;
3433
import org.springframework.web.client.ResponseErrorHandler;
3534
import org.springframework.web.client.RestClientException;
3635
import org.springframework.web.client.RestOperations;
@@ -76,19 +75,12 @@ public OAuth2AccessTokenResponse getTokenResponse(
7675
Assert.notNull(authorizationCodeGrantRequest, "authorizationCodeGrantRequest cannot be null");
7776
RequestEntity<?> request = this.requestEntityConverter.convert(authorizationCodeGrantRequest);
7877
ResponseEntity<OAuth2AccessTokenResponse> response = getResponse(request);
79-
OAuth2AccessTokenResponse tokenResponse = response.getBody();
80-
if (CollectionUtils.isEmpty(tokenResponse.getAccessToken().getScopes())) {
81-
// As per spec, in Section 5.1 Successful Access Token Response
82-
// https://tools.ietf.org/html/rfc6749#section-5.1
83-
// If AccessTokenResponse.scope is empty, then default to the scope
84-
// originally requested by the client in the Token Request
85-
// @formatter:off
86-
tokenResponse = OAuth2AccessTokenResponse.withResponse(tokenResponse)
87-
.scopes(authorizationCodeGrantRequest.getClientRegistration().getScopes())
88-
.build();
89-
// @formatter:on
90-
}
91-
return tokenResponse;
78+
// As per spec, in Section 5.1 Successful Access Token Response
79+
// https://tools.ietf.org/html/rfc6749#section-5.1
80+
// If AccessTokenResponse.scope is empty, then we assume all requested scopes were
81+
// granted.
82+
// However, we use the explicit scopes returned in the response (if any).
83+
return response.getBody();
9284
}
9385

9486
private ResponseEntity<OAuth2AccessTokenResponse> getResponse(RequestEntity<?> request) {

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/DefaultClientCredentialsTokenResponseClient.java

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -30,7 +30,6 @@
3030
import org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse;
3131
import org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter;
3232
import org.springframework.util.Assert;
33-
import org.springframework.util.CollectionUtils;
3433
import org.springframework.web.client.ResponseErrorHandler;
3534
import org.springframework.web.client.RestClientException;
3635
import org.springframework.web.client.RestOperations;
@@ -76,19 +75,12 @@ public OAuth2AccessTokenResponse getTokenResponse(
7675
Assert.notNull(clientCredentialsGrantRequest, "clientCredentialsGrantRequest cannot be null");
7776
RequestEntity<?> request = this.requestEntityConverter.convert(clientCredentialsGrantRequest);
7877
ResponseEntity<OAuth2AccessTokenResponse> response = getResponse(request);
79-
OAuth2AccessTokenResponse tokenResponse = response.getBody();
80-
if (CollectionUtils.isEmpty(tokenResponse.getAccessToken().getScopes())) {
81-
// As per spec, in Section 5.1 Successful Access Token Response
82-
// https://tools.ietf.org/html/rfc6749#section-5.1
83-
// If AccessTokenResponse.scope is empty, then default to the scope
84-
// originally requested by the client in the Token Request
85-
// @formatter:off
86-
tokenResponse = OAuth2AccessTokenResponse.withResponse(tokenResponse)
87-
.scopes(clientCredentialsGrantRequest.getClientRegistration().getScopes())
88-
.build();
89-
// @formatter:on
90-
}
91-
return tokenResponse;
78+
// As per spec, in Section 5.1 Successful Access Token Response
79+
// https://tools.ietf.org/html/rfc6749#section-5.1
80+
// If AccessTokenResponse.scope is empty, then we assume all requested scopes were
81+
// granted.
82+
// However, we use the explicit scopes returned in the response (if any).
83+
return response.getBody();
9284
}
9385

9486
private ResponseEntity<OAuth2AccessTokenResponse> getResponse(RequestEntity<?> request) {

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/DefaultJwtBearerTokenResponseClient.java

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@
3030
import org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse;
3131
import org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter;
3232
import org.springframework.util.Assert;
33-
import org.springframework.util.CollectionUtils;
3433
import org.springframework.web.client.ResponseErrorHandler;
3534
import org.springframework.web.client.RestClientException;
3635
import org.springframework.web.client.RestOperations;
@@ -73,19 +72,12 @@ public OAuth2AccessTokenResponse getTokenResponse(JwtBearerGrantRequest jwtBeare
7372
Assert.notNull(jwtBearerGrantRequest, "jwtBearerGrantRequest cannot be null");
7473
RequestEntity<?> request = this.requestEntityConverter.convert(jwtBearerGrantRequest);
7574
ResponseEntity<OAuth2AccessTokenResponse> response = getResponse(request);
76-
OAuth2AccessTokenResponse tokenResponse = response.getBody();
77-
if (CollectionUtils.isEmpty(tokenResponse.getAccessToken().getScopes())) {
78-
// As per spec, in Section 5.1 Successful Access Token Response
79-
// https://tools.ietf.org/html/rfc6749#section-5.1
80-
// If AccessTokenResponse.scope is empty, then default to the scope
81-
// originally requested by the client in the Token Request
82-
// @formatter:off
83-
tokenResponse = OAuth2AccessTokenResponse.withResponse(tokenResponse)
84-
.scopes(jwtBearerGrantRequest.getClientRegistration().getScopes())
85-
.build();
86-
// @formatter:on
87-
}
88-
return tokenResponse;
75+
// As per spec, in Section 5.1 Successful Access Token Response
76+
// https://tools.ietf.org/html/rfc6749#section-5.1
77+
// If AccessTokenResponse.scope is empty, then we assume all requested scopes were
78+
// granted.
79+
// However, we use the explicit scopes returned in the response (if any).
80+
return response.getBody();
8981
}
9082

9183
private ResponseEntity<OAuth2AccessTokenResponse> getResponse(RequestEntity<?> request) {

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/DefaultPasswordTokenResponseClient.java

Lines changed: 7 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2019 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -30,7 +30,6 @@
3030
import org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse;
3131
import org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter;
3232
import org.springframework.util.Assert;
33-
import org.springframework.util.CollectionUtils;
3433
import org.springframework.web.client.ResponseErrorHandler;
3534
import org.springframework.web.client.RestClientException;
3635
import org.springframework.web.client.RestOperations;
@@ -75,16 +74,12 @@ public OAuth2AccessTokenResponse getTokenResponse(OAuth2PasswordGrantRequest pas
7574
Assert.notNull(passwordGrantRequest, "passwordGrantRequest cannot be null");
7675
RequestEntity<?> request = this.requestEntityConverter.convert(passwordGrantRequest);
7776
ResponseEntity<OAuth2AccessTokenResponse> response = getResponse(request);
78-
OAuth2AccessTokenResponse tokenResponse = response.getBody();
79-
if (CollectionUtils.isEmpty(tokenResponse.getAccessToken().getScopes())) {
80-
// As per spec, in Section 5.1 Successful Access Token Response
81-
// https://tools.ietf.org/html/rfc6749#section-5.1
82-
// If AccessTokenResponse.scope is empty, then default to the scope
83-
// originally requested by the client in the Token Request
84-
tokenResponse = OAuth2AccessTokenResponse.withResponse(tokenResponse)
85-
.scopes(passwordGrantRequest.getClientRegistration().getScopes()).build();
86-
}
87-
return tokenResponse;
77+
// As per spec, in Section 5.1 Successful Access Token Response
78+
// https://tools.ietf.org/html/rfc6749#section-5.1
79+
// If AccessTokenResponse.scope is empty, then we assume all requested scopes were
80+
// granted.
81+
// However, we use the explicit scopes returned in the response (if any).
82+
return response.getBody();
8883
}
8984

9085
private ResponseEntity<OAuth2AccessTokenResponse> getResponse(RequestEntity<?> request) {

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/WebClientReactiveAuthorizationCodeTokenResponseClient.java

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -65,11 +65,6 @@ Set<String> scopes(OAuth2AuthorizationCodeGrantRequest grantRequest) {
6565
return Collections.emptySet();
6666
}
6767

68-
@Override
69-
Set<String> defaultScopes(OAuth2AuthorizationCodeGrantRequest grantRequest) {
70-
return grantRequest.getAuthorizationExchange().getAuthorizationRequest().getScopes();
71-
}
72-
7368
@Override
7469
BodyInserters.FormInserter<String> populateTokenRequestBody(OAuth2AuthorizationCodeGrantRequest grantRequest,
7570
BodyInserters.FormInserter<String> body) {

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/WebClientReactiveClientCredentialsTokenResponseClient.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/WebClientReactivePasswordTokenResponseClient.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/endpoint/DefaultAuthorizationCodeTokenResponseClientTests.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2021 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -295,7 +295,7 @@ public void getTokenResponseWhenSuccessResponseIncludesScopeThenAccessTokenHasRe
295295
}
296296

297297
@Test
298-
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasDefaultScope() {
298+
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasNoScope() {
299299
// @formatter:off
300300
String accessTokenSuccessResponse = "{\n"
301301
+ " \"access_token\": \"access-token-1234\",\n"
@@ -307,7 +307,7 @@ public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessToke
307307
this.server.enqueue(jsonResponse(accessTokenSuccessResponse));
308308
OAuth2AccessTokenResponse accessTokenResponse = this.tokenResponseClient
309309
.getTokenResponse(authorizationCodeGrantRequest(this.clientRegistration.build()));
310-
assertThat(accessTokenResponse.getAccessToken().getScopes()).containsExactly("read", "write");
310+
assertThat(accessTokenResponse.getAccessToken().getScopes()).isEmpty();
311311
}
312312

313313
@Test

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/endpoint/DefaultClientCredentialsTokenResponseClientTests.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2021 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -304,7 +304,7 @@ public void getTokenResponseWhenSuccessResponseIncludesScopeThenAccessTokenHasRe
304304
}
305305

306306
@Test
307-
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasDefaultScope() {
307+
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasNoScope() {
308308
// @formatter:off
309309
String accessTokenSuccessResponse = "{\n"
310310
+ " \"access_token\": \"access-token-1234\",\n"
@@ -317,7 +317,7 @@ public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessToke
317317
this.clientRegistration.build());
318318
OAuth2AccessTokenResponse accessTokenResponse = this.tokenResponseClient
319319
.getTokenResponse(clientCredentialsGrantRequest);
320-
assertThat(accessTokenResponse.getAccessToken().getScopes()).containsExactly("read", "write");
320+
assertThat(accessTokenResponse.getAccessToken().getScopes()).isEmpty();
321321
}
322322

323323
@Test

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/endpoint/DefaultJwtBearerTokenResponseClientTests.java

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,8 @@ public void getTokenResponseWhenSuccessResponseThenReturnAccessTokenResponse() t
102102
String accessTokenSuccessResponse = "{\n"
103103
+ " \"access_token\": \"access-token-1234\",\n"
104104
+ " \"token_type\": \"bearer\",\n"
105-
+ " \"expires_in\": \"3600\"\n"
105+
+ " \"expires_in\": \"3600\",\n"
106+
+ " \"scope\": \"read write\"\n"
106107
+ "}\n";
107108
// @formatter:on
108109
this.server.enqueue(jsonResponse(accessTokenSuccessResponse));
@@ -204,7 +205,7 @@ public void getTokenResponseWhenSuccessResponseIncludesScopeThenAccessTokenHasRe
204205
}
205206

206207
@Test
207-
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasDefaultScope() {
208+
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasNoScope() {
208209
// @formatter:off
209210
String accessTokenSuccessResponse = "{\n"
210211
+ " \"access_token\": \"access-token-1234\",\n"
@@ -217,7 +218,7 @@ public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessToke
217218
this.jwtAssertion);
218219
OAuth2AccessTokenResponse accessTokenResponse = this.tokenResponseClient
219220
.getTokenResponse(jwtBearerGrantRequest);
220-
assertThat(accessTokenResponse.getAccessToken().getScopes()).containsExactly("read", "write");
221+
assertThat(accessTokenResponse.getAccessToken().getScopes()).isEmpty();
221222
}
222223

223224
@Test

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/endpoint/DefaultPasswordTokenResponseClientTests.java

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2021 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -102,7 +102,8 @@ public void getTokenResponseWhenSuccessResponseThenReturnAccessTokenResponse() t
102102
String accessTokenSuccessResponse = "{\n"
103103
+ " \"access_token\": \"access-token-1234\",\n"
104104
+ " \"token_type\": \"bearer\",\n"
105-
+ " \"expires_in\": \"3600\"\n"
105+
+ " \"expires_in\": \"3600\",\n"
106+
+ " \"scope\": \"read write\"\n"
106107
+ "}\n";
107108
// @formatter:on
108109
this.server.enqueue(jsonResponse(accessTokenSuccessResponse));
@@ -136,7 +137,8 @@ public void getTokenResponseWhenAuthenticationClientSecretPostThenFormParameters
136137
String accessTokenSuccessResponse = "{\n"
137138
+ " \"access_token\": \"access-token-1234\",\n"
138139
+ " \"token_type\": \"bearer\",\n"
139-
+ " \"expires_in\": \"3600\"\n"
140+
+ " \"expires_in\": \"3600\",\n"
141+
+ " \"scope\": \"read\"\n"
140142
+ "}\n";
141143
// @formatter:on
142144
this.server.enqueue(jsonResponse(accessTokenSuccessResponse));
@@ -268,6 +270,22 @@ public void getTokenResponseWhenSuccessResponseIncludesScopeThenAccessTokenHasRe
268270
assertThat(accessTokenResponse.getAccessToken().getScopes()).containsExactly("read");
269271
}
270272

273+
@Test
274+
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasNoScope() {
275+
// @formatter:off
276+
String accessTokenSuccessResponse = "{\n"
277+
+ " \"access_token\": \"access-token-1234\",\n"
278+
+ " \"token_type\": \"bearer\",\n"
279+
+ " \"expires_in\": \"3600\"\n"
280+
+ "}\n";
281+
// @formatter:on
282+
this.server.enqueue(jsonResponse(accessTokenSuccessResponse));
283+
OAuth2PasswordGrantRequest passwordGrantRequest = new OAuth2PasswordGrantRequest(
284+
this.clientRegistration.build(), this.username, this.password);
285+
OAuth2AccessTokenResponse accessTokenResponse = this.tokenResponseClient.getTokenResponse(passwordGrantRequest);
286+
assertThat(accessTokenResponse.getAccessToken().getScopes()).isEmpty();
287+
}
288+
271289
@Test
272290
public void getTokenResponseWhenErrorResponseThenThrowOAuth2AuthorizationException() {
273291
String accessTokenErrorResponse = "{\n" + " \"error\": \"unauthorized_client\"\n" + "}\n";

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/endpoint/DefaultRefreshTokenTokenResponseClientTests.java

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2021 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -104,7 +104,8 @@ public void getTokenResponseWhenSuccessResponseThenReturnAccessTokenResponse() t
104104
String accessTokenSuccessResponse = "{\n"
105105
+ " \"access_token\": \"access-token-1234\",\n"
106106
+ " \"token_type\": \"bearer\",\n"
107-
+ " \"expires_in\": \"3600\"\n"
107+
+ " \"expires_in\": \"3600\",\n"
108+
+ " \"scope\": \"read write\"\n"
108109
+ "}\n";
109110
// @formatter:on
110111
this.server.enqueue(jsonResponse(accessTokenSuccessResponse));
@@ -131,6 +132,26 @@ public void getTokenResponseWhenSuccessResponseThenReturnAccessTokenResponse() t
131132
assertThat(accessTokenResponse.getRefreshToken().getTokenValue()).isEqualTo(this.refreshToken.getTokenValue());
132133
}
133134

135+
@Test
136+
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasOriginalScope() {
137+
// @formatter:off
138+
String accessTokenSuccessResponse = "{\n"
139+
+ " \"access_token\": \"access-token-1234\",\n"
140+
+ " \"token_type\": \"bearer\",\n"
141+
+ " \"expires_in\": \"3600\"\n"
142+
+ "}\n";
143+
// @formatter:on
144+
this.server.enqueue(jsonResponse(accessTokenSuccessResponse));
145+
ClientRegistration clientRegistration = this.clientRegistration
146+
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST).build();
147+
OAuth2RefreshTokenGrantRequest refreshTokenGrantRequest = new OAuth2RefreshTokenGrantRequest(clientRegistration,
148+
this.accessToken, this.refreshToken);
149+
OAuth2AccessTokenResponse accessTokenResponse = this.tokenResponseClient
150+
.getTokenResponse(refreshTokenGrantRequest);
151+
assertThat(accessTokenResponse.getAccessToken().getScopes())
152+
.containsExactly(this.accessToken.getScopes().toArray(new String[0]));
153+
}
154+
134155
@Test
135156
public void getTokenResponseWhenAuthenticationClientSecretPostThenFormParametersAreSent() throws Exception {
136157
// @formatter:off

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/endpoint/WebClientReactiveAuthorizationCodeTokenResponseClientTests.java

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -246,7 +246,7 @@ public void getTokenResponseWhenSuccessResponseIncludesScopeThenReturnAccessToke
246246
}
247247

248248
@Test
249-
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenReturnAccessTokenResponseUsingRequestedScope() {
249+
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenReturnAccessTokenResponseWithNoScopes() {
250250
// @formatter:off
251251
String accessTokenSuccessResponse = "{\n"
252252
+ " \"access_token\": \"access-token-1234\",\n"
@@ -258,8 +258,7 @@ public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenReturnAcce
258258
this.clientRegistration.scope("openid", "profile", "email", "address");
259259
OAuth2AccessTokenResponse accessTokenResponse = this.tokenResponseClient
260260
.getTokenResponse(authorizationCodeGrantRequest()).block();
261-
assertThat(accessTokenResponse.getAccessToken().getScopes()).containsExactly("openid", "profile", "email",
262-
"address");
261+
assertThat(accessTokenResponse.getAccessToken().getScopes()).isEmpty();
263262
}
264263

265264
private OAuth2AuthorizationCodeGrantRequest authorizationCodeGrantRequest() {

0 commit comments

Comments
 (0)