spring-projects / spring-projects/spring-security
Multiple /authorize requests in the same session are not supported. Why?
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
In a new session when hit /authorize requests in multiple tabs of the same browser session, I get IDP login screen in both all the tabs. After entering credentials, I login to IDP is successful, but failure occurs at spring security class OAuth2LoginAuthenticationFilter in attemptAuthentication method along the following lines -
Auth2AuthorizationRequest authorizationRequest = this.authorizationRequestRepository
.removeAuthorizationRequest(request, response);
if (authorizationRequest == null) {
OAuth2Error oauth2Error = new OAuth2Error(AUTHORIZATION_REQUEST_NOT_FOUND_ERROR_CODE);
throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
}
I see that this was supported in older versions of spring security (< 6.x) but this support was removed in 6.x versions
To Reproduce
In a new browser session when hit /authorize requests in multiple tabs of the same browser session
Login to IDP in all tabs
Login is successful
Failure occurs at spring security class OAuth2LoginAuthenticationFilter as stated above
Expected behavior
code should be returned in the /authorize call of each tab
Sample
A link to a GitHub repository with a minimal, reproducible sample.
Reports that include a sample will take priority over reports that do not.
At times, we may require a sample, so it is good to try and include a sample up front.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in OAuth2LoginAuthenticationFilter#attemptAuthentication, especially the authorizationRequestRepository.removeAuthorizationRequest call described in the report. Reproduce the flow with multiple /authorize requests in separate tabs, then compare it with the pre-6.x behavior mentioned in the issue. Done means determining the cause and ensuring each tab can complete authorization and receive its code.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100