github
/
OpenID-Connect-Java-Spring-Server
mirror of https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

removed state parameter from claims. added way to create random nonce value

pull/166/merge
Mike Derryberry 2012-08-08 16:18:52 -04:00 committed by Justin Richer
parent 8e95734f22
commit c0d353d7ce
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
openid-connect-client/src/main/java/org/mitre/openid/connect/client/OIDCSignedRequestFilter.java
View File

@ -1,11 +1,14 @@
package org.mitre.openid.connect.client; package org.mitre.openid.connect.client;
import java.io.IOException; import java.io.IOException;
import java.math.BigInteger;
import java.security.NoSuchAlgorithmException; import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.util.HashMap; import java.util.HashMap;
import java.util.Map; import java.util.Map;
import javax.servlet.ServletException; import javax.servlet.ServletException;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpServletResponse;
@ -113,8 +116,12 @@ public class OIDCSignedRequestFilter extends AbstractOIDCAuthenticationFilter {
claims.setClaim("client_id", serverConfiguration.getClientId()); claims.setClaim("client_id", serverConfiguration.getClientId());
claims.setClaim("scope", scope); claims.setClaim("scope", scope);
claims.setClaim("redirect_uri", AbstractOIDCAuthenticationFilter.buildRedirectURI(request, null)); claims.setClaim("redirect_uri", AbstractOIDCAuthenticationFilter.buildRedirectURI(request, null));
claims.setClaim("nonce", NONCE_SIGNATURE_COOKIE_NAME);
claims.setClaim("state", "af0ifjsldkj"); //create random nonce
String nonce = new BigInteger(50, new SecureRandom()).toString(16);
Cookie nonceCookie = new Cookie(NONCE_SIGNATURE_COOKIE_NAME, sign(signer, privateKey, nonce.getBytes()));
claims.setClaim("nonce", nonceCookie);
try { try {
signingAndValidationService.signJwt(jwt); signingAndValidationService.signJwt(jwt);