root
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Add refresh token expiration support 

Closes gh-9146
This commit is contained in:
Alexey Nesterov 2020-10-22 17:08:02 +01:00 committed by Joe Grandja
parent 42a787d1f6
commit 339da36878
2 changed files with 81 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/OAuth2RefreshToken.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2018 the original author or authors.
* Copyright 2002-2020 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -42,7 +42,18 @@ public class OAuth2RefreshToken extends AbstractOAuth2Token {
* @param issuedAt the time at which the token was issued
*/
public OAuth2RefreshToken(String tokenValue, Instant issuedAt) {
super(tokenValue, issuedAt, null);
this(tokenValue, issuedAt, null);
}
/**
* Constructs an {@code OAuth2RefreshToken} using the provided parameters.
* @param tokenValue the token value
* @param issuedAt the time at which the token was issued
* @param expiresAt the time at which the token expires
* @since 5.5
*/
public OAuth2RefreshToken(String tokenValue, Instant issuedAt, Instant expiresAt) {
super(tokenValue, issuedAt, expiresAt);
}
}

68
oauth2/oauth2-core/src/test/java/org/springframework/security/oauth2/core/OAuth2RefreshTokenTests.java Normal file
View File

@ -0,0 +1,68 @@
/*
* Copyright 2002-2020 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.oauth2.core;
import java.time.Instant;
import org.junit.Test;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
/**
* Tests for {@link OAuth2RefreshToken}.
*
* @author Alexey Nesterov
*/
public class OAuth2RefreshTokenTests {
private static final String TOKEN_VALUE = "refresh-token";
private static final Instant ISSUED_AT = Instant.now();
private static final Instant EXPIRES_AT = Instant.from(ISSUED_AT).plusSeconds(60);
@Test
public void constructorWhenTokenValueIsNullThenThrowIllegalArgumentException() {
assertThatIllegalArgumentException().isThrownBy(() ->
new OAuth2RefreshToken(null, ISSUED_AT, EXPIRES_AT))
.withMessage("tokenValue cannot be empty");
}
@Test
public void constructorWhenIssuedAtAfterExpiresAtThenThrowIllegalArgumentException() {
assertThatIllegalArgumentException().isThrownBy(() ->
new OAuth2RefreshToken(TOKEN_VALUE, Instant.from(EXPIRES_AT).plusSeconds(1), EXPIRES_AT))
.withMessage("expiresAt must be after issuedAt");
}
@Test
public void constructorWhenExpiresAtBeforeIssuedAtThenThrowIllegalArgumentException() {
assertThatIllegalArgumentException().isThrownBy(() ->
new OAuth2RefreshToken(TOKEN_VALUE, ISSUED_AT, Instant.from(ISSUED_AT).minusSeconds(1)))
.withMessage("expiresAt must be after issuedAt");
}
@Test
public void constructorWhenAllParametersProvidedAndValidThenCreated() {
OAuth2RefreshToken token = new OAuth2RefreshToken(TOKEN_VALUE, ISSUED_AT, EXPIRES_AT);
assertThat(token.getTokenValue()).isEqualTo(TOKEN_VALUE);
assertThat(token.getIssuedAt()).isEqualTo(ISSUED_AT);
assertThat(token.getExpiresAt()).isEqualTo(EXPIRES_AT);
}
}