spring-projects / spring-projects/spring-security
Add custom or generic request validator for refresh token grant
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
Similar to OAuth2ClientCredentialsAuthenticationValidator there should be a validator for Refresh token grant
Current Behavior
Currently there is no support for validating the request parameters for the RefreshToken grant.
Context
In our particular use case, I would like to validate the scopes that are passed in the request as params, against the registered client's scopes during the flow.
Not only scopes, we also want to validate several other request params which are needed for our use-cases like - validating the tenant information of refresh token so that I can prevent cross-tenant refresh token exchange.
That is the reason I am looking for a request validator similar to what you have shared above.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the OAuth2ClientCredentialsAuthenticationValidator API linked in the issue and tracing the refresh-token grant request flow in Spring Security. The work is complete when refresh-token requests support a custom or generic validator that can validate scopes and other request parameters, including tenant information, with appropriate tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authorization, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100