spring-projects / spring-projects/spring-security
Default value for ClientRegistration redirect-uri
Open
@rwinch is already working on this.
Since Jan 8, 2025.
in: oauth2
type: enhancement
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
If the Client Registration redirect-uri property is missing from a Spring Boot application, it fails on startup with:
Caused by: java.lang.IllegalArgumentException: redirectUri cannot be empty
at org.springframework.util.Assert.hasText(Assert.java:253) ~[spring-core-6.2.1.jar:6.2.1]
at org.springframework.security.oauth2.client.registration.ClientRegistration$Builder.validateAuthorizationCodeGrantType(ClientRegistration.java:659) ~[spring-security-oauth2-client-6.4.2.jar:6.4.2]
at org.springframework.security.oauth2.client.registration.ClientRegistration$Builder.build(ClientRegistration.java:610) ~[spring-security-oauth2-client-6.4.2.jar:6.4.2]
at org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientPropertiesMapper.getClientRegistration(OAuth2ClientPropertiesMapper.java:87) ~[spring-boot-autoconfigure-3.4.1.jar:3.4.1]
...
The redirect URI should be defaulted to {baseUrl}/login/oauth2/code/{registrationId}. I'm not sure if it makes sense for this to default in Spring Security or Boot, but a user should not have to provide the property
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.