[CXF-5712] OAuth2 SessionAuthenticityTokenProvider must be able to validate user form data

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0
• Component/s: JAX-RS, JAX-RS Security
• Estimated Complexity: Unknown
• Assignee: Sergey Beryozkin
• Reporter: Sergey Beryozkin
• Created: 25/Apr/14 11:41
• Updated: 11/Jul/14 12:50
• Resolved: 25/Apr/14 11:45

Description

SessionAuthenticityTokenProvider accepts only CXF MessageContext which is not sufficient for validating data like temporarily codes, etc.
For example, when the user is redirected to AuthorizationService to authorize a grant request the service will challenge the user with the authorization form, at this point custom SessionAuthenticityTokenProvider should be able to send a temp code to the user's mobile/email and request the user to enter this code into the form and then validate it on the user confirmation.