[java-oidfed-common] 01/05: Remove the content-type header check, as it's not mandated by the spec.
Codeberg
noreply at shibboleth.net
Wed Sep 23 07:34:30 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-oidfed-common.
View the commit online:
https://codeberg.org/Shibboleth/java-oidfed-common/commit/7db3f5b4f1d5aec6260f5e42d2042f7b17a7de2c
commit 7db3f5b4f1d5aec6260f5e42d2042f7b17a7de2c
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Sep 23 09:57:00 2026 +0300
Remove the content-type header check, as it's not mandated by the spec.
- Spec only mandates the parameters to be encoded in application/x-www-form-urlencoded format.
---
.../oidfed/flow/ResolveEntityFlowTest.java | 32 ++++------------------
.../decoding/impl/ResolveEntityRequestDecoder.java | 3 --
2 files changed, 6 insertions(+), 29 deletions(-)
diff --git a/oidfed-common-conf-impl/src/test/java/net/shibboleth/oidfed/flow/ResolveEntityFlowTest.java b/oidfed-common-conf-impl/src/test/java/net/shibboleth/oidfed/flow/ResolveEntityFlowTest.java
index ef70d12..356d39b 100644
--- a/oidfed-common-conf-impl/src/test/java/net/shibboleth/oidfed/flow/ResolveEntityFlowTest.java
+++ b/oidfed-common-conf-impl/src/test/java/net/shibboleth/oidfed/flow/ResolveEntityFlowTest.java
@@ -72,16 +72,12 @@ public class ResolveEntityFlowTest extends AbstractFederationFlowTest {
}
@Test
- public void testInvalidMethod() throws Exception {
- setJsonRequest("POST", "{}");
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertErrorCode(result, "invalid_request");
- }
-
- @Test
- public void testNoContentType() throws Exception {
- request.setMethod("GET");
- request.setQueryString("sub=mockClientId&trust_anchor=" + anchorId + "&entity_type=openid_relying_party");
+ public void testPostWithoutAuthentication() throws Exception {
+ final Map<String, String> requestParams = new HashMap<>();
+ requestParams.put("sub", "mockClientId");
+ requestParams.put("trust_anchor", anchorId);
+ requestParams.put("entity_type", "openid_relying_party");
+ setHttpFormRequest(request, "POST", requestParams);
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertErrorCode(result, "invalid_request");
}
@@ -89,7 +85,6 @@ public class ResolveEntityFlowTest extends AbstractFederationFlowTest {
@Test
public void testInvalidSubject() throws Exception {
request.setMethod("GET");
- request.setContentType("application/x-www-form-urlencoded");
request.setQueryString("sub=mockClientId&trust_anchor=" + anchorId + "&entity_type=openid_relying_party");
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertErrorCode(result, "invalid_subject");
@@ -100,7 +95,6 @@ public class ResolveEntityFlowTest extends AbstractFederationFlowTest {
request.setMethod("GET");
final String clientId = uniqueClientId();
rpConfigureMockHttpClient(clientId);
- request.setContentType("application/x-www-form-urlencoded");
request.setQueryString("sub=" + clientId + "&trust_anchor=mockAnchors&entity_type=openid_relying_party");
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertErrorCode(result, "invalid_trust_anchor");
@@ -111,7 +105,6 @@ public class ResolveEntityFlowTest extends AbstractFederationFlowTest {
request.setMethod("GET");
final String clientId = uniqueClientId();
rpConfigureMockHttpClient(clientId);
- request.setContentType("application/x-www-form-urlencoded");
request.setQueryString("sub=" + clientId + "&trust_anchor=" + anchorId + "&entity_type=openid_relying_party");
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
final ResolveEntityResponse parsedResponse =
@@ -147,7 +140,6 @@ public class ResolveEntityFlowTest extends AbstractFederationFlowTest {
} catch (UnsupportedOperationException | IOException e) {
Assert.fail("Could not initialize mock HTTP client", e);
}
- request.setContentType("application/x-www-form-urlencoded");
request.setQueryString("sub=" + clientId + "&trust_anchor=" + anchorId + "&entity_type=openid_relying_party");
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
final ResolveEntityResponse parsedResponse =
@@ -168,7 +160,6 @@ public class ResolveEntityFlowTest extends AbstractFederationFlowTest {
request.setMethod("GET");
final String clientId = uniqueClientId();
rpConfigureMockHttpClient(clientId, initializeNewJwk("RSA", 2048, "mockNewLeafKey"));
- request.setContentType("application/x-www-form-urlencoded");
request.setQueryString("sub=" + clientId + "&trust_anchor=" + anchorId + "&entity_type=openid_relying_party");
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertErrorCode(result, "invalid_request");
@@ -180,7 +171,6 @@ public class ResolveEntityFlowTest extends AbstractFederationFlowTest {
request.setMethod("GET");
final String clientId = uniqueClientId();
rpConfigureMockHttpClient(clientId, new JSONObject(Map.of("response_types", "invalid")));
- request.setContentType("application/x-www-form-urlencoded");
request.setQueryString("sub=" + clientId + "&trust_anchor=" + anchorId + "&entity_type=openid_relying_party");
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertErrorCode(result, "invalid_metadata");
@@ -191,7 +181,6 @@ public class ResolveEntityFlowTest extends AbstractFederationFlowTest {
request.setMethod("GET");
final String entityId = uniqueClientId();
opConfigureMockHttpClient(entityId);
- request.setContentType("application/x-www-form-urlencoded");
request.setQueryString("sub=" + entityId + "&trust_anchor=" + anchorId + "&entity_type=openid_provider");
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
final ResolveEntityResponse parsedResponse =
@@ -208,7 +197,6 @@ public class ResolveEntityFlowTest extends AbstractFederationFlowTest {
request.setMethod("GET");
final String entityId = uniqueClientId();
opConfigureMockHttpClient(entityId, new JSONObject(Map.of("issuer", List.of("unexpected", "values"))));
- request.setContentType("application/x-www-form-urlencoded");
request.setQueryString("sub=" + entityId + "&trust_anchor=" + anchorId + "&entity_type=openid_provider");
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertErrorCode(result, "invalid_metadata");
@@ -237,7 +225,6 @@ public class ResolveEntityFlowTest extends AbstractFederationFlowTest {
} catch (UnsupportedOperationException | IOException | URISyntaxException e) {
Assert.fail("Could not initialize mock HTTP client", e);
}
- request.setContentType("application/x-www-form-urlencoded");
request.setQueryString("sub=" + entityId + "&trust_anchor=" + anchorId + "&entity_type=openid_provider");
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
final ResolveEntityResponse parsedResponse =
@@ -270,7 +257,6 @@ public class ResolveEntityFlowTest extends AbstractFederationFlowTest {
populateClientAssertionParams(requestParams, jwt);
rpConfigureMockHttpClient(requestingClientId);
rpConfigureMockHttpClient(clientId);
- request.setContentType("application/x-www-form-urlencoded");
setHttpFormRequest(request, "POST", requestParams);
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
final ResolveEntityResponse parsedResponse =
@@ -295,7 +281,6 @@ public class ResolveEntityFlowTest extends AbstractFederationFlowTest {
setBasicAuth(registeredClientId, secret);
rpConfigureMockHttpClient(clientId);
- request.setContentType("application/x-www-form-urlencoded");
setHttpFormRequest(request, "POST", requestParams);
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
final ResolveEntityResponse parsedResponse =
@@ -320,7 +305,6 @@ public class ResolveEntityFlowTest extends AbstractFederationFlowTest {
setBasicAuth(registeredClientId, secret);
rpConfigureMockHttpClient(clientId);
- request.setContentType("application/x-www-form-urlencoded");
setHttpFormRequest(request, "POST", requestParams);
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertErrorCode(result, "unauthorized_client");
@@ -332,12 +316,9 @@ public class ResolveEntityFlowTest extends AbstractFederationFlowTest {
final String registeredClientId = "localResolveEntityClient";
final String secret = "mockClientSecret";
final String clientId = uniqueClientId();
- request.setContentType("application/x-www-form-urlencoded");
request.setQueryString("sub=" + clientId + "&trust_anchor=" + anchorId + "&entity_type=openid_relying_party");
setBasicAuth(registeredClientId, secret);
-
rpConfigureMockHttpClient(clientId);
- request.setContentType("application/x-www-form-urlencoded");
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertErrorCode(result, "invalid_request");
}
@@ -362,7 +343,6 @@ public class ResolveEntityFlowTest extends AbstractFederationFlowTest {
requestParams.put("entity_type", "openid_relying_party");
populateClientAssertionParams(requestParams, jwt);
rpConfigureMockHttpClient(requestingClientId);
- request.setContentType("application/x-www-form-urlencoded");
setHttpFormRequest(request, "POST", requestParams);
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertErrorCode(result, "invalid_client");
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/decoding/impl/ResolveEntityRequestDecoder.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/decoding/impl/ResolveEntityRequestDecoder.java
index ea07356..0926036 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/decoding/impl/ResolveEntityRequestDecoder.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/decoding/impl/ResolveEntityRequestDecoder.java
@@ -53,9 +53,6 @@ public class ResolveEntityRequestDecoder extends AbstractHttpServletRequestMessa
if (!"GET".equalsIgnoreCase(request.getMethod()) && !"POST".equalsIgnoreCase(request.getMethod())) {
throw new MessageDecodingException("This message decoder only supports the HTTP GET and POST methods");
}
- if (!"application/x-www-form-urlencoded".equals(request.getContentType())) {
- throw new MessageDecodingException("Invalid content type: " + request.getContentType());
- }
try {
final HTTPRequest httpRequest = JakartaServletUtils.createHTTPRequest(request);
//TODO: protocol logging once base-class moved to oidc-common
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list