search

spring-projects / spring-security

Spring Security
http://spring.io/projects/spring-security
Apache License 2.0
8.81k stars 5.9k forks source link

OidcBackChannelLogoutTokenValidator should not throw an NPE when issuer is missing #15771

Closed jzheaux closed 1 month ago

jzheaux commented 2 months ago

Related to https://github.com/spring-projects/spring-boot/issues/42172#issue-2510291998, when ClientRegistration does not have an issuerUri configured, it should give a better error than an NPE.

This needs to be addressed for both the imperative and reactive versions of the class.

Please base this change off the 6.2.x branch so it can be forward-ported when merged.

wapkch commented 1 month ago

Hi @jzheaux , may i work on this?

jzheaux commented 1 month ago

Yes, please. :) Thanks for offering, the issue is yours.