Added an error for missing redirect uri in a token request
when it has been included in the authorization request.
Change-Id: I8e5df06825d86802fbdc5c7b4d57f7ed76889772
diff --git a/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2AuthorizationService.java b/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2AuthorizationService.java
index ff4565b..8da5caa 100644
--- a/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2AuthorizationService.java
+++ b/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2AuthorizationService.java
@@ -163,9 +163,14 @@
String authorizedUri = authorization.getRedirectURI();
if (authorizedUri != null && !authorizedUri.isEmpty()) {
- if (!authorizedUri.equals(redirectURI))
+ if (redirectURI == null || redirectURI.isEmpty()) {
+ throw new KustvaktException(StatusCodes.INVALID_REDIRECT_URI,
+ "Missing redirect URI", OAuth2Error.INVALID_GRANT);
+ }
+ if (!authorizedUri.equals(redirectURI)) {
throw new KustvaktException(StatusCodes.INVALID_REDIRECT_URI,
"Invalid redirect URI", OAuth2Error.INVALID_GRANT);
+ }
}
else if (redirectURI != null && !redirectURI.isEmpty()) {
throw new KustvaktException(StatusCodes.INVALID_REDIRECT_URI,