Skip to content

Commit 9d442c1

Browse files
sjohnrsjohnr
committed
Mark password grant for removal
This commit also updates link to the document "Best Current Practice for OAuth 2.0 Security" to point to RFC 9700. Closes gh-16913
1 parent 197ee38 commit 9d442c1

9 files changed

+58
-63
lines changed

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/OAuth2AuthorizedClientProviderBuilder.java

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -138,13 +138,12 @@ public OAuth2AuthorizedClientProviderBuilder clientCredentials(
138138
/**
139139
* Configures support for the {@code password} grant.
140140
* @return the {@link OAuth2AuthorizedClientProviderBuilder}
141-
* @deprecated The latest OAuth 2.0 Security Best Current Practice disallows the use
142-
* of the Resource Owner Password Credentials grant. See reference
143-
* <a target="_blank" href=
144-
* "https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-19#section-2.4">OAuth
145-
* 2.0 Security Best Current Practice.</a>
141+
* @deprecated The OAuth 2.0 Security Best Current Practice disallows the use of the
142+
* Resource Owner Password Credentials grant. See reference <a target="_blank" href=
143+
* "https://datatracker.ietf.org/doc/html/rfc9700#section-2.4">OAuth 2.0 Security Best
144+
* Current Practice.</a>
146145
*/
147-
@Deprecated
146+
@Deprecated(since = "5.8", forRemoval = true)
148147
public OAuth2AuthorizedClientProviderBuilder password() {
149148
this.builders.computeIfAbsent(PasswordOAuth2AuthorizedClientProvider.class, (k) -> new PasswordGrantBuilder());
150149
return OAuth2AuthorizedClientProviderBuilder.this;
@@ -155,13 +154,12 @@ public OAuth2AuthorizedClientProviderBuilder password() {
155154
* @param builderConsumer a {@code Consumer} of {@link PasswordGrantBuilder} used for
156155
* further configuration
157156
* @return the {@link OAuth2AuthorizedClientProviderBuilder}
158-
* @deprecated The latest OAuth 2.0 Security Best Current Practice disallows the use
159-
* of the Resource Owner Password Credentials grant. See reference
160-
* <a target="_blank" href=
161-
* "https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-19#section-2.4">OAuth
162-
* 2.0 Security Best Current Practice.</a>
157+
* @deprecated The OAuth 2.0 Security Best Current Practice disallows the use of the
158+
* Resource Owner Password Credentials grant. See reference <a target="_blank" href=
159+
* "https://datatracker.ietf.org/doc/html/rfc9700#section-2.4">OAuth 2.0 Security Best
160+
* Current Practice.</a>
163161
*/
164-
@Deprecated
162+
@Deprecated(since = "5.8", forRemoval = true)
165163
public OAuth2AuthorizedClientProviderBuilder password(Consumer<PasswordGrantBuilder> builderConsumer) {
166164
PasswordGrantBuilder builder = (PasswordGrantBuilder) this.builders
167165
.computeIfAbsent(PasswordOAuth2AuthorizedClientProvider.class, (k) -> new PasswordGrantBuilder());

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/PasswordOAuth2AuthorizedClientProvider.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -40,12 +40,12 @@
4040
* @since 5.2
4141
* @see OAuth2AuthorizedClientProvider
4242
* @see DefaultPasswordTokenResponseClient
43-
* @deprecated The latest OAuth 2.0 Security Best Current Practice disallows the use of
44-
* the Resource Owner Password Credentials grant. See reference <a target="_blank" href=
45-
* "https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-19#section-2.4">OAuth
46-
* 2.0 Security Best Current Practice.</a>
43+
* @deprecated The OAuth 2.0 Security Best Current Practice disallows the use of the
44+
* Resource Owner Password Credentials grant. See reference <a target="_blank" href=
45+
* "https://datatracker.ietf.org/doc/html/rfc9700#section-2.4">OAuth 2.0 Security Best
46+
* Current Practice.</a>
4747
*/
48-
@Deprecated
48+
@Deprecated(since = "5.8", forRemoval = true)
4949
public final class PasswordOAuth2AuthorizedClientProvider implements OAuth2AuthorizedClientProvider {
5050

5151
private OAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> accessTokenResponseClient = new DefaultPasswordTokenResponseClient();

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/PasswordReactiveOAuth2AuthorizedClientProvider.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -40,12 +40,12 @@
4040
* @since 5.2
4141
* @see ReactiveOAuth2AuthorizedClientProvider
4242
* @see WebClientReactivePasswordTokenResponseClient
43-
* @deprecated The latest OAuth 2.0 Security Best Current Practice disallows the use of
44-
* the Resource Owner Password Credentials grant. See reference <a target="_blank" href=
45-
* "https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-19#section-2.4">OAuth
46-
* 2.0 Security Best Current Practice.</a>
43+
* @deprecated The OAuth 2.0 Security Best Current Practice disallows the use of the
44+
* Resource Owner Password Credentials grant. See reference <a target="_blank" href=
45+
* "https://datatracker.ietf.org/doc/html/rfc9700#section-2.4">OAuth 2.0 Security Best
46+
* Current Practice.</a>
4747
*/
48-
@Deprecated
48+
@Deprecated(since = "5.8", forRemoval = true)
4949
public final class PasswordReactiveOAuth2AuthorizedClientProvider implements ReactiveOAuth2AuthorizedClientProvider {
5050

5151
private ReactiveOAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> accessTokenResponseClient = new WebClientReactivePasswordTokenResponseClient();

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/ReactiveOAuth2AuthorizedClientProviderBuilder.java

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2021 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -139,13 +139,12 @@ public ReactiveOAuth2AuthorizedClientProviderBuilder clientCredentials(
139139
/**
140140
* Configures support for the {@code password} grant.
141141
* @return the {@link ReactiveOAuth2AuthorizedClientProviderBuilder}
142-
* @deprecated The latest OAuth 2.0 Security Best Current Practice disallows the use
143-
* of the Resource Owner Password Credentials grant. See reference
144-
* <a target="_blank" href=
145-
* "https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-19#section-2.4">OAuth
146-
* 2.0 Security Best Current Practice.</a>
142+
* @deprecated The OAuth 2.0 Security Best Current Practice disallows the use of the
143+
* Resource Owner Password Credentials grant. See reference <a target="_blank" href=
144+
* "https://datatracker.ietf.org/doc/html/rfc9700#section-2.4">OAuth 2.0 Security Best
145+
* Current Practice.</a>
147146
*/
148-
@Deprecated
147+
@Deprecated(since = "5.8", forRemoval = true)
149148
public ReactiveOAuth2AuthorizedClientProviderBuilder password() {
150149
this.builders.computeIfAbsent(PasswordReactiveOAuth2AuthorizedClientProvider.class,
151150
(k) -> new PasswordGrantBuilder());
@@ -157,13 +156,12 @@ public ReactiveOAuth2AuthorizedClientProviderBuilder password() {
157156
* @param builderConsumer a {@code Consumer} of {@link PasswordGrantBuilder} used for
158157
* further configuration
159158
* @return the {@link ReactiveOAuth2AuthorizedClientProviderBuilder}
160-
* @deprecated The latest OAuth 2.0 Security Best Current Practice disallows the use
161-
* of the Resource Owner Password Credentials grant. See reference
162-
* <a target="_blank" href=
163-
* "https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-19#section-2.4">OAuth
164-
* 2.0 Security Best Current Practice.</a>
159+
* @deprecated The OAuth 2.0 Security Best Current Practice disallows the use of the
160+
* Resource Owner Password Credentials grant. See reference <a target="_blank" href=
161+
* "https://datatracker.ietf.org/doc/html/rfc9700#section-2.4">OAuth 2.0 Security Best
162+
* Current Practice.</a>
165163
*/
166-
@Deprecated
164+
@Deprecated(since = "5.8", forRemoval = true)
167165
public ReactiveOAuth2AuthorizedClientProviderBuilder password(Consumer<PasswordGrantBuilder> builderConsumer) {
168166
PasswordGrantBuilder builder = (PasswordGrantBuilder) this.builders
169167
.computeIfAbsent(PasswordReactiveOAuth2AuthorizedClientProvider.class, (k) -> new PasswordGrantBuilder());

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/DefaultPasswordTokenResponseClient.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -52,12 +52,12 @@
5252
* @see <a target="_blank" href=
5353
* "https://tools.ietf.org/html/rfc6749#section-4.3.3">Section 4.3.3 Access Token Response
5454
* (Resource Owner Password Credentials Grant)</a>
55-
* @deprecated The latest OAuth 2.0 Security Best Current Practice disallows the use of
56-
* the Resource Owner Password Credentials grant. See reference <a target="_blank" href=
57-
* "https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-19#section-2.4">OAuth
58-
* 2.0 Security Best Current Practice.</a>
55+
* @deprecated The OAuth 2.0 Security Best Current Practice disallows the use of the
56+
* Resource Owner Password Credentials grant. See reference <a target="_blank" href=
57+
* "https://datatracker.ietf.org/doc/html/rfc9700#section-2.4">OAuth 2.0 Security Best
58+
* Current Practice.</a>
5959
*/
60-
@Deprecated
60+
@Deprecated(since = "5.8", forRemoval = true)
6161
public final class DefaultPasswordTokenResponseClient
6262
implements OAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> {
6363

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/OAuth2PasswordGrantRequest.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -35,12 +35,12 @@
3535
* @see <a target="_blank" href=
3636
* "https://tools.ietf.org/html/rfc6749#section-1.3.3">Section 1.3.3 Resource Owner
3737
* Password Credentials</a>
38-
* @deprecated The latest OAuth 2.0 Security Best Current Practice disallows the use of
39-
* the Resource Owner Password Credentials grant. See reference <a target="_blank" href=
40-
* "https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-19#section-2.4">OAuth
41-
* 2.0 Security Best Current Practice.</a>
38+
* @deprecated The OAuth 2.0 Security Best Current Practice disallows the use of the
39+
* Resource Owner Password Credentials grant. See reference <a target="_blank" href=
40+
* "https://datatracker.ietf.org/doc/html/rfc9700#section-2.4">OAuth 2.0 Security Best
41+
* Current Practice.</a>
4242
*/
43-
@Deprecated
43+
@Deprecated(since = "5.8", forRemoval = true)
4444
public class OAuth2PasswordGrantRequest extends AbstractOAuth2AuthorizationGrantRequest {
4545

4646
private final String username;

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/OAuth2PasswordGrantRequestEntityConverter.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -38,7 +38,7 @@
3838
* @see RequestEntity
3939
* @deprecated Use {@link DefaultOAuth2TokenRequestParametersConverter} instead
4040
*/
41-
@Deprecated(since = "6.4")
41+
@Deprecated(since = "6.4", forRemoval = true)
4242
public class OAuth2PasswordGrantRequestEntityConverter
4343
extends AbstractOAuth2AuthorizationGrantRequestEntityConverter<OAuth2PasswordGrantRequest> {
4444

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/WebClientReactivePasswordTokenResponseClient.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -37,12 +37,12 @@
3737
* @see <a target="_blank" href=
3838
* "https://tools.ietf.org/html/rfc6749#section-4.3.3">Section 4.3.3 Access Token Response
3939
* (Resource Owner Password Credentials Grant)</a>
40-
* @deprecated The latest OAuth 2.0 Security Best Current Practice disallows the use of
41-
* the Resource Owner Password Credentials grant. See reference <a target="_blank" href=
42-
* "https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-19#section-2.4">OAuth
43-
* 2.0 Security Best Current Practice.</a>
40+
* @deprecated The OAuth 2.0 Security Best Current Practice disallows the use of the
41+
* Resource Owner Password Credentials grant. See reference <a target="_blank" href=
42+
* "https://datatracker.ietf.org/doc/html/rfc9700#section-2.4">OAuth 2.0 Security Best
43+
* Current Practice.</a>
4444
*/
45-
@Deprecated
45+
@Deprecated(since = "5.8", forRemoval = true)
4646
public final class WebClientReactivePasswordTokenResponseClient
4747
extends AbstractWebClientReactiveOAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> {
4848

‎oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/AuthorizationGrantType.java

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -48,13 +48,12 @@ public final class AuthorizationGrantType implements Serializable {
4848
public static final AuthorizationGrantType CLIENT_CREDENTIALS = new AuthorizationGrantType("client_credentials");
4949

5050
/**
51-
* @deprecated The latest OAuth 2.0 Security Best Current Practice disallows the use
52-
* of the Resource Owner Password Credentials grant. See reference
53-
* <a target="_blank" href=
54-
* "https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-19#section-2.4">OAuth
55-
* 2.0 Security Best Current Practice.</a>
51+
* @deprecated The OAuth 2.0 Security Best Current Practice disallows the use of the
52+
* Resource Owner Password Credentials grant. See reference <a target="_blank" href=
53+
* "https://datatracker.ietf.org/doc/html/rfc9700#section-2.4">OAuth 2.0 Security Best
54+
* Current Practice.</a>
5655
*/
57-
@Deprecated
56+
@Deprecated(since = "5.8", forRemoval = true)
5857
public static final AuthorizationGrantType PASSWORD = new AuthorizationGrantType("password");
5958

6059
/**

0 commit comments

Comments
 (0)