spring-projects / spring-projects/spring-security

Error while extracting response for type [org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse]

Open
#16,398 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

in: docs type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Describe the bug
When trying to use Spring Security to enable Google authentication, without Spring Boot, as described in https://docs.spring.io/spring-security/reference/servlet/oauth2/login/core.html , I keep getting the error:

[invalid_token_response] An error occurred while attempting to retrieve the OAuth 2.0 Access Token Response: Error while extracting response for type [org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse] and content type [application/json;charset=utf-8]

As far as I managed to debug this, it seems that the user agent is redirected from the authorization server back to the application with the authorization code, the client app exchanges the authorization code with an access token and ID token, but it seems that it can't translate the JSON object to a OAuth2AccessTokenResponse from a reason I couldn't discover.

Digging down the rabbit whole, I managed to see the actual response received from the token endpoint:

{
  "access_token": "ya29..xxxxx-ObUjFSl6cErFz6oUmuXw86Aki9kb5bVBKv1zysS2_KPF9q-xxxx",
  "expires_in": 3599,
  "scope": "https://www.googleapis.com/auth/userinfo.email openid https://www.googleapis.com/auth/userinfo.profile",
  "token_type": "Bearer",
  "id_token": "eyJhbGciOiJSUzI1NixxxxY2UzNTk4YzQ3M2FmMWJkYTRiZmY5NWU2Yzg3MzY0NTAyMDZmYmEiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOixxxxx1d0kdTSGk-RKUn84YDfs0t8JBdl1rZu0kVZmGOc_LRoeWQxSWuVlWoO1_9AoMUU-eJTxxxxGxyOXuQkHA"
}

To Reproduce


@Configuration
@EnableWebSecurity(debug=true)
public class SpringConfig {

    Logger logger = Logger.getLogger("MyLogger");

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http)  throws Exception {
        http
        .authorizeHttpRequests(authorize -> authorize
            .anyRequest().authenticated()
        )
        .oauth2Login(Customizer.withDefaults());
        return http.build();
    }
   @Bean
	public ClientRegistrationRepository clientRegistrationRepository() {
		return new InMemoryClientRegistrationRepository(this.googleClientRegistration());
	}
   private ClientRegistration googleClientRegistration() {
		return CommonOAuth2Provider.GOOGLE.getBuilder("google")
			.clientId("xxx")
			.clientSecret("xxx")
			.build();
	}

Expected behavior
I expect that google authentication will work just fine.

Sample

A link to a GitHub repository with a minimal, reproducible sample.

Reports that include a sample will take priority over reports that do not.
At times, we may require a sample, so it is good to try and include a sample up front.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked minimal Spring Security sample and the OAuth2 login configuration using ClientRegistrationRepository and CommonOAuth2Provider.GOOGLE. Reproduce the token exchange, then trace extraction into OAuth2AccessTokenResponse using the response shown in the report. Done means Google authentication works without Spring Boot and the sample no longer raises invalid_token_response.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.