Cannot put parameters in body for OAuth2 POST requests in a REST service

Question

It seems I am missing something very basic here.

I made a REST Api that takes POST requests for generating tokens using the Apache Oltu OAuth2 service, that looks something like this :

@POST
@Consumes("application/x-www-form-urlencoded")
@Produces("application/json")
public Response authorize(@Context HttpServletRequest request) throws OAuthSystemException, IOException {
    try {
        OAuthTokenRequest oauthRequest = new OAuthTokenRequest(request);
        OAuthIssuer oauthIssuerImpl = new OAuthIssuerImpl(new MD5Generator());

When I use HttpRequester or Postman to test the service, it works perfectly fine on condition that I input all authentication and OAuth2 parameters as input parameters, as an example :

https://localhost:8443/rest/OAuthService/token?grant_type=password&username=userfortest&password=Johhny1é&client_id=1234

However I read, that for any POST requests, all parameters should be in the Body of the HTTP request and never sent through with the url as a simple parameter. When I try to pass it in the body of the HTTP request, so as to make the request secure (so the url is the same without parameters and all params are specified in the body), it seems like it doesn't receive anything from the body as it throws an exception, after

OAuthTokenRequest oauthRequest = new OAuthTokenRequest(request);

with the following message :

    {"error_description":"Missing grant_type parameter value","error":"invalid_request"}

Is it the intended behaviour of Oltu/OAuth2 for the parameters to be passed through with the url? Or what am I doing wrong?

Thanks in advance.

score 3 · Accepted Answer · edited May 23 '17 at 12:16

3

Your answer is here: Unable to retrive post data using ,@Context HttpServletRequest when passed to OAuthTokenRequest using Oltu

I did exactly what he said and it worked perfectly.

You need modify Response authorize() parameters.

edited May 23 '17 at 12:16

Community

1
1

answered Feb 13 '17 at 03:14

Williaan Lopes

1,177
15
11

Thanks, that is correct! Meanwhile I found a workaround by converting the body parameters received from the request to url parameters manually to pass to the OAuthTokenRequest, however the solution in your answer is more efficient and easier to implement. – WhileTrueContinue Feb 14 '17 at 11:23

Cannot put parameters in body for OAuth2 POST requests in a REST service

1 Answers1