CODEWITHSUNDEEP
springspring-authorization-serverauthorization-server
nucle
nucle

Reputation: 31

Password Reset Spring Authorization Server

I implemented the password reset flow in the spring authorization server with an email token. The implementation is similar to the OWASP Forgot Password The problem is that I do not know how to get the registered client when clicking the reset password link on the login form. It is possible to call this reset password URL without the client, and this shouldn't be possible.

When I open this URL in the browser, I get redirected to the login form.

http://localhost:8083/oauth2/authorize?response_type=code &client_id=client
   &scope=openid
   &redirect_uri=http://example.com
   &code_challenge=MyChallengeCode
   &code_challenge_method=S256

Login Form: enter image description here

When I click the reset password link, the flow starts. enter image description here

My Questions:

Upvotes: 0

Views: 696

Answers (1)

Steve Riesenberg
Steve Riesenberg

Reputation: 6158

The question is not 100% clear on your goal but based on clarifying questions in comments, it seems you are trying to access to query parameters that were submitted with the authorization request. Using your example:

http://localhost:8083/oauth2/authorize?response_type=code &client_id=client
   &scope=openid
   &redirect_uri=http://example.com
   &code_challenge=MyChallengeCode
   &code_challenge_method=S256

Let's say we want to access the client_id parameter during the Forgot Password flow. The easiest way to accomplish this would be to use the RequestCache, since this is what stores the original URL in order to replay the request after the user authenticates successfully. Here is a simplified example:

@Controller
public class ForgotPasswordController {

    private final RequestCache requestCache = new HttpSessionRequestCache();

    @GetMapping("/password/forgot")
    public String forgot(HttpServletRequest request, HttpServletResponse response) {
        var savedRequest = this.requestCache.getRequest(request, response);
        var clientId = savedRequest.getParameterValues("client_id")[0];
        // ...
    }

}

See also this related answer for an additional example.

Upvotes: 0

Related Questions