OAuth2AuthorizationCodeGrantWebFilter should not restrict redirect-uri

OAuth2AuthorizationCodeGrantWebFilter currently matches the Authorization Response using the pattern /{action}/oauth2/code/{registrationId}, which is too restrictive.

We should allow the client to configure the redirect-uri to be any URI within the application. The Authorization Response matching should follow the same logic found in OAuth2AuthorizationCodeGrantFilter.shouldProcessAuthorizationResponse().

[jgrandja]

@clementkng

If I create a new ClientRegistration.Builder method (ie ClientRegistration.Builder clientRegistration3()…

It’s not necessary to create a new method. Just re-use what’s there like this

ClientRegistration registration = TestClientRegistrations.clientRegistration().redirectUriTemplate("/callback") .build();
OAuth2AuthorizationExchange exchange = TestOAuth2AuthorizationExchanges.success();
OAuth2AuthorizationCodeAuthenticationToken authenticationToken = new OAuth2AuthorizationCodeAuthenticationToken(registration, exchange);

Yes, you will need to change get("/authorize/oauth2/code/registration-id") to get("/callback")

[jgrandja]

@clementkng I would recommend reviewing the Authorization Code Grant flow in the spec. The section Authorization Response is implemented by OAuth2AuthorizationCodeGrantFilter and OAuth2AuthorizationCodeGrantWebFilter.

After you review the spec and gain a solid understanding of the authorization_code grant flow than I believe the code will be more clear.

How would a client be able to set the redirect-URI to be any in the application

Go through these steps for oauth2Login() and you’ll see how to configure the redirect-uri for the client. The same steps apply for oauth2Client().authorizationGrant()