From acd78ee407887dc6d0f869f1d905c1638bc994c6 Mon Sep 17 00:00:00 2001 From: Mohammad Rezai Date: Tue, 23 May 2017 12:30:48 +0430 Subject: [PATCH] KEYCLOAK-4956: Fix incorrect PKCE S256 code challenge generation --- .../protocol/oidc/endpoints/TokenEndpoint.java | 10 +++------- .../oauth/OAuthProofKeyForCodeExchangeTest.java | 12 ++++-------- 2 files changed, 7 insertions(+), 15 deletions(-) diff --git a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java index 83570efd75..f642da1a0d 100644 --- a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java +++ b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java @@ -543,13 +543,9 @@ public class TokenEndpoint { // https://tools.ietf.org/html/rfc7636#section-4.6 private String generateS256CodeChallenge(String codeVerifier) throws Exception { MessageDigest md = MessageDigest.getInstance("SHA-256"); - md.update(codeVerifier.getBytes()); - StringBuilder sb = new StringBuilder(); - for (byte b : md.digest()) { - String hex = String.format("%02x", b); - sb.append(hex); - } - String codeVerifierEncoded = Base64Url.encode(sb.toString().getBytes()); + md.update(codeVerifier.getBytes("ISO_8859_1")); + byte[] digestBytes = md.digest(); + String codeVerifierEncoded = Base64Url.encode(digestBytes); return codeVerifierEncoded; } diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthProofKeyForCodeExchangeTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthProofKeyForCodeExchangeTest.java index a72aa3a8d0..20757c170d 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthProofKeyForCodeExchangeTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthProofKeyForCodeExchangeTest.java @@ -444,14 +444,10 @@ public class OAuthProofKeyForCodeExchangeTest extends AbstractKeycloakTest { private String generateS256CodeChallenge(String codeVerifier) throws Exception { MessageDigest md = MessageDigest.getInstance("SHA-256"); - md.update(codeVerifier.getBytes()); - StringBuilder sb = new StringBuilder(); - for (byte b : md.digest()) { - String hex = String.format("%02x", b); - sb.append(hex); - } - String codeChallenge = Base64Url.encode(sb.toString().getBytes()); - return codeChallenge; + md.update(codeVerifier.getBytes("ISO_8859_1")); + byte[] digestBytes = md.digest(); + String codeChallenge = Base64Url.encode(digestBytes); + return codeChallenge; } private void expectSuccessfulResponseFromTokenEndpoint(String codeId, String sessionId, String code) throws Exception {