spring-projects / spring-projects/spring-security

Multiple /authorize requests in the same session are not supported. Why?

Open
#16,336 2 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: bug
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Describe the bug
In a new session when hit /authorize requests in multiple tabs of the same browser session, I get IDP login screen in both all the tabs. After entering credentials, I login to IDP is successful, but failure occurs at spring security class OAuth2LoginAuthenticationFilter in attemptAuthentication method along the following lines -

Auth2AuthorizationRequest authorizationRequest = this.authorizationRequestRepository
.removeAuthorizationRequest(request, response);
if (authorizationRequest == null) {
OAuth2Error oauth2Error = new OAuth2Error(AUTHORIZATION_REQUEST_NOT_FOUND_ERROR_CODE);
throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
}

I see that this was supported in older versions of spring security (< 6.x) but this support was removed in 6.x versions

To Reproduce
In a new browser session when hit /authorize requests in multiple tabs of the same browser session
Login to IDP in all tabs
Login is successful
Failure occurs at spring security class OAuth2LoginAuthenticationFilter as stated above

Expected behavior
code should be returned in the /authorize call of each tab

Sample

A link to a GitHub repository with a minimal, reproducible sample.

Reports that include a sample will take priority over reports that do not.
At times, we may require a sample, so it is good to try and include a sample up front.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in OAuth2LoginAuthenticationFilter#attemptAuthentication, especially the authorizationRequestRepository.removeAuthorizationRequest call described in the report. Reproduce the flow with multiple /authorize requests in separate tabs, then compare it with the pre-6.x behavior mentioned in the issue. Done means determining the cause and ensuring each tab can complete authorization and receive its code.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.