spring-projects / spring-projects/spring-security

Should OidcIdToken implement equals?

Open
#15,156 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

in: oauth2 type: breaks-passivity type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Describe the bug
I wondered if OidcIdToken should implement equals. While running some test, I realized that the claims on OidcIdToken are not compared when using assertEquals.

Interestingly, OAuth2AccessToken which follows the same pattern does implement it.

Expected behavior
claims (and potentially other fields) are respected when comparing via equals. This might be considered a breaking change.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/oidc/OidcIdToken.java and compare its behavior with oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/OAuth2AccessToken.java. Check the relevant oauth2-core tests and confirm that equality respects claims and any other intended fields without overlooking the possible breaking-change impact.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.