PKCE configuration - enabled by default #17507

rohan-naik07 · 2025-07-10T15:53:23Z

PKCE enabled by default for confidential as well as public clients.
Client Authentication method won't affect the PKCE customizer.
PKCE can be disabled using isRequireProofKey() client setting.

rohan-naik07 · 2025-07-17T15:55:52Z

Hi @jgrandja ,

Thank you for reviewing my pull request. I noticed that you marked it as "breaks passivity" and self-assigned the related issue.

I want to understand this better so I can improve future contributions. Could you please clarify what aspect of the PR breaks passivity, and how you envision the correct approach? I'm eager to align with the design principles of the project and contribute effectively.

Thanks again for your time and guidance!

Best regards,
Rohan

jgrandja · 2025-07-18T10:56:44Z

Hi @rohan-naik07. I haven't had time to review your PR but I plan on it next week.

Our process is to self-assign PR's when we review it and the user who submitted the PR is assigned the original issue.

The reason I marked this "breaks-passivity" is because it is a breaking change that needs to be applied. For example, since the required change is for the OAuth2 Client to send PKCE parameters by default, it's possible that the authorization server does not support PKCE and therefore the flow will fail. So what was working previously might stop working with the upgrade to 7.0 because of this change. Does that make sense?

FYI, the reason for this change is OAuth 2.1 recommends/requires PKCE.

rohan-naik07 · 2025-07-19T08:01:25Z

Ok, that makes sense. Thanks for clarifying my doubts.

jgrandja

Thanks for the PR @rohan-naik07. Please see review comments.

Also, please rebase off of main and ensure there is only 1 commit with the changes. Thanks.

jgrandja · 2025-08-13T09:04:33Z

...rc/main/java/org/springframework/security/oauth2/client/registration/ClientRegistration.java

 			clientRegistration.clientName = StringUtils.hasText(this.clientName) ? this.clientName
 					: this.registrationId;
 			clientRegistration.clientSettings = this.clientSettings;
+			if (this.clientSettings.requireProofKey) {


Please remove this since clientRegistration.clientSettings is set in previous line with this.clientSettings and only the clientSettings should be used.

jgrandja · 2025-08-13T09:06:52Z

...rc/main/java/org/springframework/security/oauth2/client/registration/ClientRegistration.java

-		private ClientSettings() {
-
-		}
+		private ClientSettings() {}


Please revert this formatting change as only required changes should be applied

jgrandja · 2025-08-13T09:09:48Z

...rc/main/java/org/springframework/security/oauth2/client/registration/ClientRegistration.java

 			private boolean requireProofKey;

 			private Builder() {
+				this.requireProofKey = true;


Please move this to variable initialization private boolean requireProofKey = true;

jgrandja · 2025-08-13T09:14:02Z

...rg/springframework/security/oauth2/client/web/DefaultOAuth2AuthorizationRequestResolver.java

 			}
-			if (ClientAuthenticationMethod.NONE.equals(clientRegistration.getClientAuthenticationMethod())
-					|| clientRegistration.getClientSettings().isRequireProofKey()) {
+			if (clientRegistration.getClientSettings().isRequireProofKey()) {


Public Clients (indicated with ClientAuthenticationMethod.NONE) always require PKCE but with this change it's possible to disable PKCE for Public Clients. Please revert this as the original logic is still correct.

jgrandja · 2025-08-13T09:20:07Z

...ework/security/oauth2/client/web/server/DefaultServerOAuth2AuthorizationRequestResolver.java

 			}
-			if (ClientAuthenticationMethod.NONE.equals(clientRegistration.getClientAuthenticationMethod())
-					|| clientRegistration.getClientSettings().isRequireProofKey()) {
+			if (clientRegistration.getClientSettings().isRequireProofKey()) {


Public Clients (indicated with ClientAuthenticationMethod.NONE) always require PKCE but with this change it's possible to disable PKCE for Public Clients. Please revert this as the original logic is still correct.

jgrandja · 2025-08-13T09:26:11Z

docs/modules/ROOT/pages/servlet/oauth2/client/client-authentication.adoc

 ====
-Public Clients are supported using https://tools.ietf.org/html/rfc7636[Proof Key for Code Exchange] (PKCE).
-PKCE will automatically be used when `client-authentication-method` is set to "none" (`ClientAuthenticationMethod.NONE`).
+https://tools.ietf.org/html/rfc7636[Proof Key for Code Exchange] (PKCE) will be enabled by default for public as well as confidential clients. Refer https://docs.spring.io/spring-security/reference/servlet/oauth2/client/client-authentication.html#oauth2-client-authentication-public[this


Please revert this as the original content is still valid

jgrandja · 2025-08-13T09:31:41Z

docs/modules/ROOT/pages/servlet/oauth2/client/core.adoc

 The supported values are *header*, *form*, and *query*.
 <16> `userNameAttributeName`: The name of the attribute returned in the UserInfo Response that references the Name or Identifier of the end-user.
-<17> [[oauth2Client-client-registration-requireProofKey]]`requireProofKey`: If `true` or if `authorizationGrantType` is `none`, then PKCE will be enabled by default.
+<17> [[oauth2Client-client-registration-requireProofKey]]`requireProofKey`: This will by default be `true`, as PKCE will be enabled by default.


Please update the text to:

If true or if clientAuthenticationMethod is none, then PKCE will be enabled.

Aren't we stressing enough on the point that PKCE will be also enabled for confidential clients?... Or we don't want to for now

jgrandja · 2025-08-13T09:36:11Z

...st/java/org/springframework/security/oauth2/client/registration/TestClientRegistrations.java

 		// @formatter:on
 	}

+	public static ClientRegistration.Builder publicClientRegistrationWithNoPkce() {


Please remove this as TestClientRegistrations.clientRegistration() can be used and the caller can simply change builder.clientSettings(updatedClientSettings)

rohan-naik07 · 2025-09-02T16:35:33Z

Hi @jgrandja , just wanted to kindly follow up on this PR. Please let me know if there are any changes or clarifications I can make to help move it forward.

jgrandja · 2025-09-02T18:02:35Z

Hi @rohan-naik07. Really apologize for the delay. I was at SpringOne last week and I was very busy leading up to that. I have a little more breathing room now and need to catch up on quite a bit. I'm planning on reviewing your PR later this week or early next week. Thanks for your patience.

jgrandja

Thanks for your patience @rohan-naik07. Please see review comments.

I noticed there were a lot of changes made that were not relevant to the enhancement this PR addresses, especially in DefaultOAuth2AuthorizationRequestResolverTests.

In general, PR's should only add/update the minimal amount of code necessary to fulfill the enhancement requirements. No other code should change, especially if it's not relevant to the enhancement.

I would recommend going through all the code again and reverting everything that is not needed as part of this enhancement. There is quite a bit of updates in DefaultOAuth2AuthorizationRequestResolverTests that should be reverted.

Thanks.

jgrandja · 2025-09-16T15:41:16Z

docs/modules/ROOT/pages/servlet/oauth2/client/core.adoc

 The supported values are *header*, *form*, and *query*.
 <16> `userNameAttributeName`: The name of the attribute returned in the UserInfo Response that references the Name or Identifier of the end-user.
-<17> [[oauth2Client-client-registration-requireProofKey]]`requireProofKey`: If `true` or if `authorizationGrantType` is `none`, then PKCE will be enabled by default.
+<17> [[oauth2Client-client-registration-requireProofKey]]`requireProofKey`: If `true` or if `authorizationGrantType` is `none`, then PKCE will be enabled.


As mentioned in this comment, please update to:

If true or if clientAuthenticationMethod is none, then PKCE will be enabled.

jgrandja · 2025-09-16T15:43:21Z

...rc/main/java/org/springframework/security/oauth2/client/registration/ClientRegistration.java

 			clientRegistration.clientName = StringUtils.hasText(this.clientName) ? this.clientName
 					: this.registrationId;
 			clientRegistration.clientSettings = this.clientSettings;
+			if (clientRegistration.clientSettings.requireProofKey) {


I'm not understanding the reason for this but I believe it should be removed.

jgrandja · 2025-09-16T15:48:28Z

...rc/main/java/org/springframework/security/oauth2/client/registration/ClientRegistration.java

 							"AuthorizationGrantType: %s does not match the pre-defined constant %s and won't match a valid OAuth2AuthorizedClientProvider",
 							this.authorizationGrantType, authorizationGrantType));
 				}
-				if (!AuthorizationGrantType.AUTHORIZATION_CODE.equals(this.authorizationGrantType)


We should add a new validation check as follows:

If authorization_code and client_authentication_method equals none then pkce must be true else invalid

jgrandja · 2025-09-16T15:48:51Z

...rc/main/java/org/springframework/security/oauth2/client/registration/ClientRegistration.java

 		private static final long serialVersionUID = 7495627155437124692L;

-		private boolean requireProofKey;
+		private boolean requireProofKey = true;


This can be reverted since it will be set by the Builder

jgrandja · 2025-09-16T15:49:47Z

...st/java/org/springframework/security/oauth2/client/registration/ClientRegistrationTests.java

-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
-import static org.assertj.core.api.Assertions.assertThatIllegalStateException;
+import static org.assertj.core.api.Assertions.*;


Please revert this as wildcard imports are not allowed

jgrandja · 2025-09-16T16:05:29Z

...ringframework/security/oauth2/client/web/DefaultOAuth2AuthorizationRequestResolverTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2025 the original author or authors.


This should not change. Please revert.

jgrandja · 2025-09-16T16:06:53Z

...ringframework/security/oauth2/client/web/DefaultOAuth2AuthorizationRequestResolverTests.java

 	}

-	@Test
-	void authorizationRequestBaseUriEqualToRedirectFilter() {


Why was this removed? Please revert.

jgrandja · 2025-09-16T16:08:38Z

...ringframework/security/oauth2/client/web/DefaultOAuth2AuthorizationRequestResolverTests.java

 	public void resolveWhenNotAuthorizationRequestThenDoesNotResolve() {
 		String requestUri = "/path";
-		MockHttpServletRequest request = get(requestUri).build();
+		MockHttpServletRequest request = new MockHttpServletRequest("GET", requestUri);


Why did this change? Please only make required changes that are needed. Please revert.

jgrandja · 2025-09-16T16:09:10Z

...ringframework/security/oauth2/client/web/DefaultOAuth2AuthorizationRequestResolverTests.java

 	public void resolveWhenNotAuthorizationRequestThenRequestBodyNotConsumed() throws IOException {
 		String requestUri = "/path";
-		MockHttpServletRequest request = post(requestUri).build();
+		MockHttpServletRequest request = new MockHttpServletRequest("POST", requestUri);


Why did this change? Please only make required changes that are needed. Please revert.

jgrandja · 2025-09-16T16:15:33Z

...ringframework/security/oauth2/client/web/DefaultOAuth2AuthorizationRequestResolverTests.java

 		assertPkceApplied(authorizationRequest, clientRegistration);
 	}

-	// gh-6548


Why was this removed? The comment gh-6548 typically (by convention) refers to a bug that was fixed previously so I don't think it should be removed.

Signed-off-by: Rohan Naik <[email protected]>

spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Jul 10, 2025

rohan-naik07 changed the base branch from main to 6.5.x July 10, 2025 16:55

rohan-naik07 marked this pull request as ready for review July 14, 2025 14:29

jgrandja added in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: breaks-passivity A change that breaks passivity with the previous release and removed status: waiting-for-triage An issue we've not yet triaged labels Jul 15, 2025

jgrandja self-assigned this Jul 15, 2025

jgrandja requested changes Aug 13, 2025

View reviewed changes

rohan-naik07 force-pushed the pkce-default-config-gh-16391 branch 3 times, most recently from abe7742 to cb7cff4 Compare August 21, 2025 18:07

rohan-naik07 requested a review from jgrandja August 23, 2025 08:35

rohan-naik07 force-pushed the pkce-default-config-gh-16391 branch 2 times, most recently from 80416c4 to 4f7a21c Compare September 2, 2025 16:20

rohan-naik07 changed the base branch from 6.5.x to main September 2, 2025 16:21

rohan-naik07 marked this pull request as draft September 16, 2025 15:49

jgrandja requested changes Sep 16, 2025

View reviewed changes

jgrandja added this to the 7.0.0-RC1 milestone Sep 16, 2025

rohan-naik07 closed this Sep 20, 2025

rohan-naik07 force-pushed the pkce-default-config-gh-16391 branch from 4f7a21c to d3b143d Compare September 20, 2025 14:34

rohan-naik07 reopened this Sep 20, 2025

rohan-naik07 force-pushed the pkce-default-config-gh-16391 branch from 5dd2b47 to a3020f9 Compare September 22, 2025 16:52

PKCE configuration - enabled by default

5efddb4

Signed-off-by: Rohan Naik <[email protected]>

rohan-naik07 force-pushed the pkce-default-config-gh-16391 branch from a3020f9 to 5efddb4 Compare September 22, 2025 16:56

PKCE configuration - enabled by default #17507

Are you sure you want to change the base?

PKCE configuration - enabled by default #17507

Conversation

rohan-naik07 commented Jul 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rohan-naik07 commented Jul 17, 2025

Uh oh!

jgrandja commented Jul 18, 2025

Uh oh!

rohan-naik07 commented Jul 19, 2025

Uh oh!

jgrandja left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rohan-naik07 commented Sep 2, 2025

Uh oh!

jgrandja commented Sep 2, 2025

Uh oh!

jgrandja left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rohan-naik07 commented Jul 10, 2025 •

edited

Loading