You are not doing anything wrong just that you need a small update to your properties file because Twitter OAuth 2.0 only supports Authorization Code Flow with PKCE. This was a known issue with the Twitter authorization request URL generated by Spring. For Twitter, they require these two request parameters to come along with the request URL code_challenge and code_challenge_method.

A sample URL from Twitter developer page looks like

https://twitter.com/i/oauth2/authorize?response_type=code&client_id=TWITTER_OAUTH_CLIENT_ID&redirect_uri=https://www.example.com&scope=tweet.read%20users.read%20follows.read%20offline.access&state=state&code_challenge=challenge&code_challenge_method=plain

In your own case with Spring, in the properties file (your YAML file), update the authorization-URI under the provider for twitter to append those two parameters code_challenge=challenge&code_challenge_method=plain to look like this

spring:
  security:
    oauth2:
      client:
        registration:
          twitter:
            client-id: ${TWITTER_OAUTH_CLIENT_ID}
            client-secret: ${TWITTER_OAUTH_CLIENT_SECRET}
            authorization-grant-type: authorization_code
            redirect-uri: ${BASE_URL}/login/oauth2/code/twitter
            scope:
            - tweet.read
        provider:
          twitter:
            authorization-uri: https://twitter.com/i/oauth2/authorize?code_challenge=challenge&code_challenge_method=plain
            token-uri: https://api.twitter.com/2/oauth2/token

ALTERNATIVE: This requires Spring Boot 2.7 and above.

Instantiate a bean of ServerOAuth2AuthorizationRequestResolver

@Bean
public ServerOAuth2AuthorizationRequestResolver auth2RequestWithPKCE(ReactiveClientRegistrationRepository repo) {
  var resolver = new DefaultServerOAuth2AuthorizationRequestResolver(repo); 
  resolver .setAuthorizationRequestCustomizer(OAuth2AuthorizationRequestCustomizers.withPkce());

  return resolver;
}

Then in the security config, inject the above bean and add it to the oauth2Login http security config settings as follows

http
  *** //other settings
  .oauth2Login(oauth2 -> oauth2.authorizationRequestResolver(INJECTED_BEAN_HERE));

Note, your redirect_uri needs to match whatever you put on the Twitter developer settings page. For development purposes, don't use localhost for the redirect_uri, use 127.0.0.1 instead on the Twitter developer settings page and your yaml redirect_uri.

Hope this help

0

0

0

David Spencer

0

0

About Me

Questions (0)

David Spencer's Top Tags

Blogs (0)