Spring Authorization Server should provide native, configurable support for hashing long-lived credentials (specifically OAuth2RefreshToken)
维护者通常 2 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 45/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
调研方向
从 OAuth2RefreshTokenAuthenticationProvider、OAuth2TokenRevocationAuthenticationProvider 和 OAuth2TokenIntrospectionAuthenticationProvider 开始，然后跟踪它们对 OAuth2AuthorizationService 的使用以及令牌比较。检查授权码和刷新令牌是如何持久化和验证的。完成的标准是，可配置的哈希处理和验证能够覆盖所述凭据，而不需要以明文存储。
由索引模型根据 Issue 内容生成。
描述
Expected Behavior
Spring Authorization Server should provide native, configurable support for hashing long-lived credentials (specifically OAuth2RefreshToken and authorization codes) at rest using a pluggable mechanism similar to PasswordEncoder. The persistence layer should store cryptographic hashes (e.g., SHA-256), and authentication providers should verify incoming tokens against these hashes without requiring plain-text storage.
Current Behavior
Authentication providers (OAuth2RefreshTokenAuthenticationProvider, OAuth2TokenRevocationAuthenticationProvider, and OAuth2TokenIntrospectionAuthenticationProvider) perform a strict plain-text .equals() comparison between the incoming token and the value retrieved from OAuth2AuthorizationService. As a result, raw tokens must be stored in plaintext within the database.
Context
How this has affected you / What you are trying to accomplish: Trying to harden the authorization server implementation against database leaks. Storing long-lived tokens in plaintext violates standard security hardening guidelines for data at rest. Additionally, indexing large plaintext token strings in relational databases creates performance bottlenecks compared to fixed-length hashes.
What other alternatives have you considered: Relying solely on short token expiration or storing tokens in an external key-value store, which increases architectural complexity.
Are you aware of any workarounds: Yes, developers currently have to implement fragile workarounds such as overriding OAuth2AuthorizationService.findByToken() to dynamically inject raw mock tokens into the domain model, or entirely unregistering and rewriting core AuthenticationProvider implementations.
- 主要语言
- Java
- 星标
- 9.7k
- 派生
- 6.4k
- 平均合并
- 7 天 12 小时
- 30 天内合并 PR
- 35
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
spring-projects/spring-security 的其他 Issue
-
type: dependency-upgrade
难度 1/5 1 小时以内 新手友好度 76/100
spring-projects/spring-security#20057 · 1 条评论 ·
维护者通常 2 天内回复
-
type: dependency-upgrade
难度 1/5 1 小时以内 新手友好度 72/100
spring-projects/spring-security#20056 ·
维护者通常 2 天内回复
-
type: dependency-upgrade
难度 1/5 1 小时以内 新手友好度 72/100
spring-projects/spring-security#20055 ·
维护者通常 2 天内回复
-
type: dependency-upgrade
难度 1/5 1 小时以内 新手友好度 65/100
spring-projects/spring-security#20054 ·
维护者通常 2 天内回复
-
type: dependency-upgrade
难度 1/5 1 小时以内 新手友好度 70/100
spring-projects/spring-security#20053 ·
维护者通常 2 天内回复
查看 spring-projects/spring-security 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 66/100
wultra/powerauth-tests#980 ·
-
account bug communication lecture
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
line/centraldogma#1397 ·
维护者通常 2 天内回复
-
[Bug]: Fixed/recurring deposit accounts are treated as savings in ownership and listings可能已有人在做 @Aana123 今天认领。 未关闭bug Triage
难度 2/5 1-3 小时 新手友好度 76/100
apache/fineract-consumer-facing#252 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 78/100
cryptomator/hub#515 ·