CODEWITHSUNDEEP
spring-securityoauth-2.0
Prince
Prince

Reputation: 33

alternate to pass details as url query string in oAuth 2.0?

to get refresh token i am calling service like this

http://www.myapp.com/SampleApp/oauth/token?grant_type=password&client_id=my-trusted-client&username=admin&password=123456

now service will return refresh token and temporary access token but the problem is 'passing username and especially password over network in url is unsafe' so i want call /oauth/token and i need to pass grant_type,client_id,username,password..details either in request body or request headers.... and and to support this which filter i need to configure in security-servlet.xml

and i also want to pass access_token in reqest header to call rest service not in url like employee/list?accessToken=657gjgf3563285 how can i achive this? and how my security-servlet.xml looks like to support this? and finally how my request to /oauth/token looks like...

Upvotes: 0

Views: 1151

Answers (1)

Larry Anderson
Larry Anderson

Reputation: 593

There is support for Bearer tokens within spring oauth (see BearerTokenExtractor).

Also, if passing the username/password in the URL is considered unsafe for you, most likely putting it in the request body or headers will not be any more secure. To be more secure you'd need to encrypt the contents with PKI or use a secure transport method like HTTPS (the OAuth 2 spec says it's basically a requirement to have TLS).

Upvotes: 1

Related Questions