Skip to content

Consider logging invalid client secret #1246

Closed
Closed
Consider logging invalid client secret#1246
Assignees
fndejan
Labels
type: enhancementA general enhancement
Milestone
1.2.0-M1
@sjohnr

Description

@sjohnr
sjohnr
opened on May 30, 2023

spring-authorization-server/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/ClientSecretAuthenticationProvider.java

Lines 116 to 118 in 27a893f

if (!this.passwordEncoder.matches(clientSecret, registeredClient.getClientSecret())) {
throwInvalidClient(OAuth2ParameterNames.CLIENT_SECRET);
}

We should consider adding a log entry at DEBUG level in ClientSecretAuthenticationProvider for this case. This would allow the logging level to be tuned specifically for this logging.

Metadata

Metadata

Assignees

Labels

type: enhancementA general enhancement

Type

No type

Fields

No fields configured for issues without a type.

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions