Merge pull request #4671 from owncloud/fix/set_authorization_header_when_necessary

[FIX] Set authorization header only when necessary

Author: joragua

CHANGELOG.md

@@ -39,6 +39,7 @@ ownCloud admins and users.
 
 ## Summary
 
+* Bugfix - Set authorization header for token request only when necessary: [#4575](https://github.com/owncloud/android/issues/4575)
 * Bugfix - Add explicit permission to Detekt workflow: [#4675](https://github.com/owncloud/android/pull/4675)
 * Change - SBOM workflow runs on dependabot PRs: [#4664](https://github.com/owncloud/android/pull/4664)
 * Enhancement - New layout for spaces list: [#4604](https://github.com/owncloud/android/issues/4604)
@@ -48,6 +49,15 @@ ownCloud admins and users.
 
 ## Details
 
+* Bugfix - Set authorization header for token request only when necessary: [#4575](https://github.com/owncloud/android/issues/4575)
+
+   A new field has been added to the token request to indicate whether the
+   authorization header should be applied in case `client_secret_post` method is
+   supported or not.
+
+   https://github.com/owncloud/android/issues/4575
+   https://github.com/owncloud/android/pull/4671
+
 * Bugfix - Add explicit permission to Detekt workflow: [#4675](https://github.com/owncloud/android/pull/4675)
 
    Read permission has been added to the Detekt workflow. Without this explicit

changelog/unreleased/4671

@@ -0,0 +1,7 @@
+Bugfix: Set authorization header for token request only when necessary
+
+A new field has been added to the token request to indicate whether the authorization
+header should be applied in case `client_secret_post` method is supported or not.
+
+https://github.com/owncloud/android/issues/4575
+https://github.com/owncloud/android/pull/4671

owncloudApp/src/main/java/com/owncloud/android/presentation/authentication/AccountAuthenticator.java

@@ -346,6 +346,7 @@ private String refreshToken(
 
         String clientIdForRequest = null;
         String clientSecretForRequest = null;
+        Boolean useAuthorizationHeader = true;
 
         boolean isKiteworksServer = Boolean.parseBoolean(accountManager.getUserData(account, AccountUtils.Constants.KEY_IS_KITEWORKS_SERVER));
 
@@ -377,6 +378,7 @@ private String refreshToken(
             oidcServerConfigurationUseCaseResult.getDataOrNull().isTokenEndpointAuthMethodSupportedClientSecretPost()) {
                 clientIdForRequest = clientId;
                 clientSecretForRequest = clientSecret;
+                useAuthorizationHeader = false;
             }
         } else {
             Timber.d("OIDC Discovery failed. Server discovery info: [ %s ]",
@@ -401,6 +403,7 @@ private String refreshToken(
                 scope,
                 clientIdForRequest,
                 clientSecretForRequest,
+                useAuthorizationHeader,
                 refreshToken
         );
 

owncloudApp/src/main/java/com/owncloud/android/presentation/authentication/LoginActivity.kt

@@ -662,6 +662,7 @@ class LoginActivity : AppCompatActivity(), SslUntrustedCertDialog.OnSslUntrusted
 
         var clientId: String? = null
         var clientSecret: String? = null
+        var useAuthorizationHeader = true
 
         val serverInfo = authenticationViewModel.serverInfo.value?.peekContent()?.getStoredData()
         if (serverInfo is ServerInfo.OIDCServer) {
@@ -672,6 +673,7 @@ class LoginActivity : AppCompatActivity(), SslUntrustedCertDialog.OnSslUntrusted
 
                 clientId = clientRegistrationInfo?.clientId ?: contextProvider.getString(defaultClientId)
                 clientSecret = clientRegistrationInfo?.clientSecret ?: contextProvider.getString(defaultClientSecret)
+                useAuthorizationHeader = false
             }
         } else {
             tokenEndPoint = "$serverBaseUrl${File.separator}${contextProvider.getString(R.string.oauth2_url_endpoint_access)}"
@@ -686,7 +688,8 @@ class LoginActivity : AppCompatActivity(), SslUntrustedCertDialog.OnSslUntrusted
             clientSecret = clientSecret,
             authorizationCode = authorizationCode,
             redirectUri = OAuthUtils.buildRedirectUri(applicationContext, isKiteworksServer).toString(),
-            codeVerifier = authenticationViewModel.codeVerifier
+            codeVerifier = authenticationViewModel.codeVerifier,
+            useAuthorizationHeader = useAuthorizationHeader
         )
 
         authenticationViewModel.requestToken(requestToken)

owncloudComLibrary/src/main/java/com/owncloud/android/lib/resources/oauth/TokenRequestRemoteOperation.kt

@@ -2,7 +2,7 @@
  *
  *   @author Abel García de Prada
  *
- *   Copyright (C) 2020 ownCloud GmbH.
+ *   Copyright (C) 2025 ownCloud GmbH.
  *
  *   Permission is hereby granted, free of charge, to any person obtaining a copy
  *   of this software and associated documentation files (the "Software"), to deal
@@ -54,7 +54,9 @@ class TokenRequestRemoteOperation(
 
             val postMethod = PostMethod(URL(tokenRequestParams.tokenEndpoint), requestBody)
 
-            postMethod.addRequestHeader(AUTHORIZATION_HEADER, tokenRequestParams.clientAuth)
+            if (tokenRequestParams.useAuthorizationHeader) {
+                postMethod.addRequestHeader(AUTHORIZATION_HEADER, tokenRequestParams.clientAuth)
+            }
 
             val status = client.executeHttpMethod(postMethod)
 

owncloudComLibrary/src/main/java/com/owncloud/android/lib/resources/oauth/params/TokenRequestParams.kt

@@ -1,6 +1,6 @@
 /* ownCloud Android Library is available under MIT license
  *
- *   Copyright (C) 2024 ownCloud GmbH.
+ *   Copyright (C) 2025 ownCloud GmbH.
  *
  *   Permission is hereby granted, free of charge, to any person obtaining a copy
  *   of this software and associated documentation files (the "Software"), to deal
@@ -35,6 +35,7 @@ sealed class TokenRequestParams(
     val scope: String,
     val clientId: String?,
     val clientSecret: String?,
+    val useAuthorizationHeader: Boolean,
 ) {
     abstract fun toRequestBody(): RequestBody
 
@@ -45,10 +46,11 @@ sealed class TokenRequestParams(
         scope: String,
         clientId: String?,
         clientSecret: String?,
+        useAuthorizationHeader: Boolean,
         val authorizationCode: String,
         val redirectUri: String,
         val codeVerifier: String,
-    ) : TokenRequestParams(tokenEndpoint, clientAuth, grantType, scope, clientId, clientSecret) {
+    ) : TokenRequestParams(tokenEndpoint, clientAuth, grantType, scope, clientId, clientSecret, useAuthorizationHeader) {
 
         override fun toRequestBody(): RequestBody =
             FormBody.Builder().apply {
@@ -70,8 +72,9 @@ sealed class TokenRequestParams(
         scope: String,
         clientId: String?,
         clientSecret: String?,
+        useAuthorizationHeader: Boolean,
         val refreshToken: String? = null
-    ) : TokenRequestParams(tokenEndpoint, clientAuth, grantType, scope, clientId, clientSecret) {
+    ) : TokenRequestParams(tokenEndpoint, clientAuth, grantType, scope, clientId, clientSecret, useAuthorizationHeader) {
 
         override fun toRequestBody(): RequestBody =
             FormBody.Builder().apply {

owncloudData/src/main/java/com/owncloud/android/data/oauth/datasources/implementation/OCRemoteOAuthDataSource.kt

@@ -112,7 +112,8 @@ class OCRemoteOAuthDataSource(
                     clientSecret = this.clientSecret,
                     redirectUri = this.redirectUri,
                     clientAuth = this.clientAuth,
-                    codeVerifier = this.codeVerifier
+                    codeVerifier = this.codeVerifier,
+                    useAuthorizationHeader = this.useAuthorizationHeader
                 )
             is TokenRequest.RefreshToken ->
                 TokenRequestParams.RefreshToken(
@@ -122,7 +123,8 @@ class OCRemoteOAuthDataSource(
                     clientId = this.clientId,
                     clientSecret = this.clientSecret,
                     clientAuth = this.clientAuth,
-                    refreshToken = this.refreshToken
+                    refreshToken = this.refreshToken,
+                    useAuthorizationHeader = this.useAuthorizationHeader
                 )
         }
 

owncloudData/src/test/java/com/owncloud/android/data/oauth/RemoteOAuthUtils.kt

@@ -2,7 +2,9 @@
  * ownCloud Android client application
  *
  * @author Abel García de Prada
- * Copyright (C) 2021 ownCloud GmbH.
+ * @author Jorge Aguado Recio
+ *
+ * Copyright (C) 2025 ownCloud GmbH.
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2,
@@ -52,7 +54,8 @@ val OC_REMOTE_TOKEN_REQUEST_PARAMS_ACCESS = TokenRequestParams.Authorization(
     clientSecret = null,
     authorizationCode = OC_TOKEN_REQUEST_ACCESS.authorizationCode,
     redirectUri = OC_TOKEN_REQUEST_ACCESS.redirectUri,
-    codeVerifier = OC_TOKEN_REQUEST_ACCESS.codeVerifier
+    codeVerifier = OC_TOKEN_REQUEST_ACCESS.codeVerifier,
+    useAuthorizationHeader = true
 )
 
 val OC_REMOTE_TOKEN_REQUEST_PARAMS_REFRESH = TokenRequestParams.RefreshToken(
@@ -62,7 +65,8 @@ val OC_REMOTE_TOKEN_REQUEST_PARAMS_REFRESH = TokenRequestParams.RefreshToken(
     scope = OC_TOKEN_REQUEST_REFRESH.scope,
     clientId = null,
     clientSecret = null,
-    refreshToken = OC_TOKEN_REQUEST_REFRESH.refreshToken
+    refreshToken = OC_TOKEN_REQUEST_REFRESH.refreshToken,
+    useAuthorizationHeader = true
 )
 
 val OC_REMOTE_TOKEN_RESPONSE = TokenResponse(

owncloudDomain/src/main/java/com/owncloud/android/domain/authentication/oauth/model/TokenRequest.kt

@@ -3,8 +3,9 @@
  *
  * @author Abel García de Prada
  * @author Juan Carlos Garrote Gascón
+ * @author Jorge Aguado Recio
  *
- * Copyright (C) 2024 ownCloud GmbH.
+ * Copyright (C) 2025 ownCloud GmbH.
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2,
@@ -29,6 +30,7 @@ sealed class TokenRequest(
     val scope: String,
     val clientId: String?,
     val clientSecret: String?,
+    val useAuthorizationHeader: Boolean,
 ) {
     class AccessToken(
         baseUrl: String,
@@ -37,10 +39,11 @@ sealed class TokenRequest(
         scope: String,
         clientId: String? = null,
         clientSecret: String? = null,
+        useAuthorizationHeader: Boolean,
         val authorizationCode: String,
         val redirectUri: String,
         val codeVerifier: String
-    ) : TokenRequest(baseUrl, tokenEndpoint, clientAuth, GrantType.ACCESS_TOKEN.string, scope, clientId, clientSecret)
+    ) : TokenRequest(baseUrl, tokenEndpoint, clientAuth, GrantType.ACCESS_TOKEN.string, scope, clientId, clientSecret, useAuthorizationHeader)
 
     class RefreshToken(
         baseUrl: String,
@@ -49,8 +52,9 @@ sealed class TokenRequest(
         scope: String,
         clientId: String? = null,
         clientSecret: String? = null,
+        useAuthorizationHeader: Boolean,
         val refreshToken: String? = null
-    ) : TokenRequest(baseUrl, tokenEndpoint, clientAuth, GrantType.REFRESH_TOKEN.string, scope, clientId, clientSecret)
+    ) : TokenRequest(baseUrl, tokenEndpoint, clientAuth, GrantType.REFRESH_TOKEN.string, scope, clientId, clientSecret, useAuthorizationHeader)
 
     enum class GrantType(val string: String) {
         /** Request access token. [More info](https://tools.ietf.org/html/rfc6749#section-4.1.3) */

owncloudTestUtil/src/main/java/com/owncloud/android/testutil/oauth/TokenRequest.kt

@@ -2,7 +2,9 @@
  * ownCloud Android client application
  *
  * @author Abel García de Prada
- * Copyright (C) 2021 ownCloud GmbH.
+ * @author Jorge Aguado Recio
+ *
+ * Copyright (C) 2025 ownCloud GmbH.
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2,
@@ -31,7 +33,8 @@ val OC_TOKEN_REQUEST_REFRESH = TokenRequest.RefreshToken(
     tokenEndpoint = OC_TOKEN_ENDPOINT,
     clientAuth = OC_CLIENT_AUTH,
     scope = OC_SCOPE,
-    refreshToken = OC_REFRESH_TOKEN
+    refreshToken = OC_REFRESH_TOKEN,
+    useAuthorizationHeader = true
 )
 
 val OC_TOKEN_REQUEST_ACCESS = TokenRequest.AccessToken(
@@ -41,5 +44,6 @@ val OC_TOKEN_REQUEST_ACCESS = TokenRequest.AccessToken(
     scope = OC_SCOPE,
     authorizationCode = "4uth0r1z4t10nC0d3",
     redirectUri = OC_REDIRECT_URI,
-    codeVerifier = "A high-entropy cryptographic random STRING using the unreserved characters"
+    codeVerifier = "A high-entropy cryptographic random STRING using the unreserved characters",
+    useAuthorizationHeader = true
 )