Spring Security および Angular

import { Component } from '@angular/core';

@Component({
  selector: 'app-root',
  standalone: true,
  templateUrl: './app.component.html',
  styleUrls: ['./app.component.css']
})
export class AppComponent {
  title = 'Demo';
  greeting = {'id': 'XXX', 'content': 'Hello World'};
}

<div style="text-align:center"class="container">
  <h1>
    Welcome {{title}}!
  </h1>
  <div class="container">
    <p>Id: <span>{{greeting.id}}</span></p>
    <p>Message: <span>{{greeting.content}}</span></p>
  </div>
</div>

@SpringBootApplication
@RestController
public class UiApplication {

	@RequestMapping("/resource")
	public Map<String,Object> home() {
		Map<String,Object> model = new HashMap<String,Object>();
		model.put("id", UUID.randomUUID().toString());
		model.put("content", "Hello World");
		return model;
	}

$ curl localhost:8080/resource
{"timestamp":1420442772928,"status":401,"error":"Unauthorized","message":"Full authentication is required to access this resource","path":"/resource"}

Authorization: Basic dXNlcjpwYXNzd29yZA==

<div class="container">
  <ul class="nav nav-pills">
    <li class="nav-item"><a class="nav-link" routerLinkActive="active" routerLink="/home">Home</a></li>
    <li class="nav-item"><a class="nav-link" routerLinkActive="active" routerLink="/login">Login</a></li>
    <li class="nav-item"><a class="nav-link" (click)="logout()">Logout</a></li>
  </ul>
</div>
<div class="container">
  <router-outlet></router-outlet>
</div>

import { bootstrapApplication } from '@angular/platform-browser';
import { provideRouter, Routes } from '@angular/router';
import { provideHttpClient, withInterceptors } from '@angular/common/http';
import { AppComponent } from './app/app.component';
import { HomeComponent } from './app/home.component';
import { LoginComponent } from './app/login.component';
import { xhrInterceptor } from './app/xhr.interceptor';

const routes: Routes = [
  { path: '', pathMatch: 'full', redirectTo: 'home' },
  { path: 'home', component: HomeComponent },
  { path: 'login', component: LoginComponent }
];

bootstrapApplication(AppComponent, {
  providers: [
    provideRouter(routes),
    provideHttpClient(withInterceptors([xhrInterceptor]))
  ]
}).catch(err => console.error(err));

import { Component, inject } from '@angular/core';
import { Router, RouterLink, RouterLinkActive, RouterOutlet } from '@angular/router';
import { HttpClient } from '@angular/common/http';
import { AppService } from './app.service';
import { finalize } from 'rxjs/operators';

@Component({
  selector: 'app-root',
  standalone: true,
  imports: [RouterOutlet, RouterLink, RouterLinkActive],
  templateUrl: './app.component.html',
  styleUrls: ['./app.component.css']
})
export class AppComponent {
  private app = inject(AppService);
  private http = inject(HttpClient);
  private router = inject(Router);

  constructor() {
    this.app.authenticate(undefined, undefined);
  }

  logout(): void {
    this.http.post('logout', {}).pipe(
      finalize(() => {
        this.app.authenticated = false;
        this.router.navigateByUrl('/login');
      })
    ).subscribe();
  }
}

import { Injectable, inject } from '@angular/core';
import { HttpClient, HttpHeaders } from '@angular/common/http';

@Injectable({ providedIn: 'root' })
export class AppService {
  authenticated = false;
  private http = inject(HttpClient);

  authenticate(credentials: { username: string; password: string } | undefined, callback?: () => void): void {
    const headers = new HttpHeaders(credentials ? {
      authorization: 'Basic ' + btoa(credentials.username + ':' + credentials.password)
    } : {});

    this.http.get<{ name?: string }>('user', { headers }).subscribe({
      next: (response) => {
        this.authenticated = !!response?.name;
        if (callback) {
          callback();
        }
      },
      error: () => {
        this.authenticated = false;
      }
    });
  }
}

import { HttpInterceptorFn } from '@angular/common/http';

export const xhrInterceptor: HttpInterceptorFn = (req, next) => {
  const xhr = req.clone({
    headers: req.headers.set('X-Requested-With', 'XMLHttpRequest')
  });
  return next(xhr);
};

bootstrapApplication(AppComponent, {
  providers: [
    provideRouter(routes),
    provideHttpClient(withInterceptors([xhrInterceptor]))
  ]

POST /logout HTTP/1.1
...
Content-Type: application/x-www-form-urlencoded

username=user&password=password

HTTP/1.1 403 Forbidden
Set-Cookie: JSESSIONID=3941352C51ABB941781E1DF312DA474E; Path=/; HttpOnly
Content-Type: application/json;charset=UTF-8
Transfer-Encoding: chunked
...

{"timestamp":1420467113764,"status":403,"error":"Forbidden","message":"Expected CSRF token not found. Has your session expired?","path":"/login"}

.csrf(csrf -> csrf
    .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()));

@RequestMapping("/")
@CrossOrigin(origins="*", maxAge=3600)
public Message home() {
	return new Message("Hello World");
}

import { Component, inject } from '@angular/core';
import { HttpClient, HttpHeaders } from '@angular/common/http';
import { AppService } from './app.service';

interface Greeting {
  id?: number;
  content?: string;
}

interface TokenResponse {
  token?: string;
}

@Component({
  selector: 'app-home',
  standalone: true,
  templateUrl: './home.component.html'
})
export class HomeComponent {
  title = 'Demo';
  greeting: Greeting = {};

  private app = inject(AppService);
  private http = inject(HttpClient);

  constructor() {
    this.http.get<TokenResponse>('token').subscribe({
      next: (data) => {
        const token = data.token;
        if (token) {
          this.http.get<Greeting>('http://localhost:9000', {
            headers: new HttpHeaders().set('X-Auth-Token', token)
          }).subscribe(response => this.greeting = response);
        }
      },
      error: () => {}
    });
  }

  authenticated(): boolean {
    return this.app.authenticated;
  }
}

@GetMapping("/token")
@ResponseBody
public Map<String, String> token(HttpSession session) {
    return Collections.singletonMap("token", session.getId());
}

@RequestMapping("/")
@CrossOrigin(origins = "*", maxAge = 3600, allowedHeaders = { "x-auth-token", "x-requested-with", "x-xsrf-token" })
public Message home() {
	return new Message("Hello World");
}

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
	http.cors(Customizer.withDefaults())
		.authorizeHttpRequests(authorize -> authorize.anyRequest().authenticated());
	return http.build();
}

@Bean
HttpSessionIdResolver sessionStrategy() {
	return HeaderHttpSessionIdResolver.xAuthToken();
}

server.address: 127.0.0.1

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-security</artifactId>
</dependency>

<dependency>
  <groupId>org.springframework.session</groupId>
  <artifactId>spring-session-data-redis</artifactId>
</dependency>
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>

package demo;

import java.util.UUID;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@RestController
public class ResourceApplication {

	@RequestMapping("/")
	public Message home() {
		return new Message("Hello World");
	}

	@Bean
	public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
		http.httpBasic(httpBasic -> httpBasic.disable());
		http.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.NEVER));
		http.authorizeHttpRequests(authorize -> authorize.anyRequest().authenticated());
		return http.build();
	}

	public static void main(String[] args) {
		SpringApplication.run(ResourceApplication.class, args);
	}

}

class Message {
	private String id = UUID.randomUUID().toString();
	private String content;

	Message() {
	}

	public Message(String content) {
		this.content = content;
	}

	public String getId() {
		return id;
	}

	public String getContent() {
		return content;
	}
}

package demo;

import java.security.Principal;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.ResponseBody;

@SpringBootApplication
@Controller
public class UiApplication {

    @GetMapping("/user")
    @ResponseBody
    public Principal user(Principal user) {
        return user;
    }

    @GetMapping(value = "/{path:[^\\.]*}")
    public String redirect() {
        return "forward:/";
    }

    public static void main(String[] args) {
        SpringApplication.run(UiApplication.class, args);
    }

    @Configuration
    protected static class SecurityConfiguration {
        @Bean
        public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
            http
                .httpBasic(httpBasic -> httpBasic
                    .securityContextRepository(new HttpSessionSecurityContextRepository()))
                .logout(Customizer.withDefaults())
                .authorizeHttpRequests(authorize -> authorize
                    .requestMatchers("/index.html", "/", "/home", "/login").permitAll()
                    .anyRequest().authenticated()
                )
                .csrf(csrf -> csrf
                    .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()));
            return http.build();
        }
    }

}

logging:
  level:
    org.springframework.cloud.gateway: DEBUG

GET /resource/ HTTP/1.1
Host: localhost:8080
Accept: application/json, text/plain, */*
X-Requested-With: XMLHttpRequest
X-XSRF-TOKEN: 542c7005-309c-4f50-8a1d-d6c74afe8260
Cookie: SESSION=c18846b5-f805-4679-9820-cd13bd83be67; XSRF-TOKEN=542c7005-309c-4f50-8a1d-d6c74afe8260

Response:
Content-Type: application/json;charset=UTF-8
Status: 200

DEBUG o.s.c.g.s.m.HandlerFunctions : Matched route: resource
DEBUG o.s.c.g.s.m.HandlerFunctions : Mapping [/resource/] to http://localhost:9000

Forwarded Request:
  method: GET
  path: /
  headers:
    accept: application/json, text/plain, */*
    x-xsrf-token: 542c7005-309c-4f50-8a1d-d6c74afe8260
    cookie: SESSION=c18846b5-f805-4679-9820-cd13bd83be67; XSRF-TOKEN=542c7005-309c-4f50-8a1d-d6c74afe8260
    x-forwarded-prefix: /resource
    x-forwarded-host: localhost:8080

Response:
  Content-Type: application/json;charset=UTF-8
  Status: 200

$ curl https://start.spring.io/starter.tgz -d dependencies=web,security -d name=authserver | tar -xzvf -

<dependency>
  <groupId>org.springframework.session</groupId>
  <artifactId>spring-session</artifactId>
</dependency>
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-redis</artifactId>
</dependency>

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>

package demo;

import java.util.UUID;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@RestController
public class ResourceApplication {

	@RequestMapping("/")
	public Message home() {
		return new Message("Hello World");
	}

	@Bean
	public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
		http
			.authorizeHttpRequests(authorize -> authorize
				.anyRequest().authenticated())
			.oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()));
		return http.build();
	}

	public static void main(String[] args) {
		SpringApplication.run(ResourceApplication.class, args);
	}

}

class Message {
	private String id = UUID.randomUUID().toString();
	private String content;

	Message() {
	}

	public Message(String content) {
		this.content = content;
	}

	public String getId() {
		return id;
	}

	public String getContent() {
		return content;
	}
}

server.port: 9000
server.address: 127.0.0.1
spring.security.oauth2.resourceserver.jwt.jwk-set-uri: http://localhost:9999/oauth2/jwks

$ curl -v localhost:9000
> GET / HTTP/1.1
> User-Agent: curl/7.35.0
> Host: localhost:9000
> Accept: */*
>
< HTTP/1.1 401 Unauthorized
...
< WWW-Authenticate: Bearer
...

@SpringBootApplication
@RestController
public class AuthserverApplication {

  @RequestMapping("/user")
  public Principal user(Principal user) {
    return user;
  }

  ...

}

$ TOKEN=eyJra...
$ curl -H "Authorization: Bearer $TOKEN" localhost:9000
{"id":"03af8be3-2fc3-4d75-acf7-c484d9cf32b1","content":"Hello World"}
$ curl -H "Authorization: Bearer $TOKEN" localhost:9999/user
{"details":...,"principal":{"username":"user",...},"name":"user"}

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-oauth2-client</artifactId>
</dependency>
<dependency>
  <groupId>org.springframework.cloud</groupId>
  <artifactId>spring-cloud-starter-gateway-server-webmvc</artifactId>
</dependency>

package demo;

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
import org.springframework.security.web.csrf.CsrfToken;
import org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler;
import org.springframework.web.filter.OncePerRequestFilter;

@SpringBootApplication
public class UiApplication {

    public static void main(String[] args) {
        SpringApplication.run(UiApplication.class, args);
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        CsrfTokenRequestAttributeHandler requestHandler = new CsrfTokenRequestAttributeHandler();
        http
            .oauth2Login(Customizer.withDefaults())
            .logout(logout -> logout.logoutSuccessUrl("/"))
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/index.html", "/", "/login", "/*.js", "/*.css", "/assets/**", "/favicon.ico").permitAll()
                .anyRequest().authenticated())
            .csrf(csrf -> csrf
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
                .csrfTokenRequestHandler(requestHandler))
            .addFilterAfter(new CsrfCookieFilter(), BasicAuthenticationFilter.class);
        return http.build();
    }

    private static final class CsrfCookieFilter extends OncePerRequestFilter {
        @Override
        protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
                FilterChain filterChain) throws ServletException, IOException {
            CsrfToken csrfToken = (CsrfToken) request.getAttribute(CsrfToken.class.getName());
            if (csrfToken != null) {
                csrfToken.getToken();
            }
            filterChain.doFilter(request, response);
        }
    }
}

spring:
  aop:
    proxy-target-class: true
  web:
    resources:
      static-locations: classpath:/static/browser/
  security:
    oauth2:
      client:
        registration:
          acme:
            client-id: acme
            client-secret: acmesecret
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
            scope: openid
        provider:
          acme:
            authorization-uri: http://localhost:9999/oauth2/authorize
            token-uri: http://localhost:9999/oauth2/token
            jwk-set-uri: http://localhost:9999/oauth2/jwks
            user-info-uri: http://localhost:9999/userinfo
  cloud:
    gateway:
      mvc:
        routes:
          - id: resource
            uri: http://localhost:9000
            predicates:
              - Path=/resource/**
            filters:
              - StripPrefix=1
              - TokenRelay
          - id: user
            uri: http://localhost:9999
            predicates:
              - Path=/user/**
            filters:
              - TokenRelay

logging:
  level:
    org.springframework.security: DEBUG
    org.springframework.web: DEBUG

docker run -p 6379:6379 redis

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
	http
		// No httpBasic - rely on shared session from Gateway
		.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.NEVER))
		.csrf(csrf -> csrf
			.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
			.csrfTokenRequestHandler(new CsrfTokenRequestAttributeHandler())
		)
		.authorizeHttpRequests(authorize -> authorize
			.requestMatchers(HttpMethod.POST, "/**").hasRole("WRITER")
			.anyRequest().authenticated());
	return http.build();
}

import { Component, inject } from '@angular/core';
import { FormsModule } from '@angular/forms';
import { HttpClient, HttpHeaders } from '@angular/common/http';

@Component({
  selector: 'app-root',
  standalone: true,
  imports: [FormsModule],
  templateUrl: './app.component.html',
  styleUrls: ['./app.component.css']
})
export class AppComponent {
  private http = inject(HttpClient);

  admin = false;
  user = '';
  title = 'Demo';
  credentials = { username: '', password: '' };
  authenticated = false;
  error = false;

  constructor() {
    this.login();
  }

  login() {
    const headers = this.credentials.username
      ? new HttpHeaders().set('authorization', 'Basic ' + btoa(this.credentials.username + ':' + this.credentials.password))
      : new HttpHeaders();

    this.http.get<{ name?: string; roles?: string[] }>('user', { headers }).subscribe({
      next: (data) => {
        this.authenticated = !!(data && data['name']);
        this.user = this.authenticated ? data['name'] || '' : '';
        this.admin = this.authenticated && !!data['roles'] && data['roles'].indexOf('ROLE_ADMIN') > -1;
        this.error = false;
      },
      error: () => {
        this.authenticated = false;
        this.admin = false;
        this.error = true;
      }
    });
    return false;
  }

  logout() {
    this.http.post('logout', {}).subscribe({
      next: () => {
        this.authenticated = false;
        this.admin = false;
      }
    });
  }
}

<nav class="navbar navbar-light bg-light">
  <div class="container">
    <a class="navbar-brand" href='#/'>Home</a>
    <div class="ml-auto">
      <a class="btn btn-primary" href="#/login">login</a> <a
        class="btn btn-primary" [hidden]="!authenticated"
        (click)="logout(); $event.preventDefault()">logout</a>
      <span [hidden]="!authenticated">
        Signed in as <a href="#/">{{user}}</a>
      </span>
    </div>
  </div>
</nav>
<div class="alert alert-danger" [hidden]="!error">There was a
problem logging in. Please try again.</div>
<div class="container" [hidden]="authenticated">
  <form role="form" (submit)="login()">
    <div class="form-group">
      <label for="username">Username:</label> <input type="text"
        class="form-control" id="username" name="username"
        [(ngModel)]="credentials.username" />
    </div>
    <div class="form-group">
      <label for="password">Password:</label> <input type="password"
        class="form-control" id="password" name="password"
        [(ngModel)]="credentials.password" />
    </div>
    <button type="submit" class="btn btn-primary">Submit</button>
  </form>
</div>
<div class="container" [hidden]="!authenticated">
  <a class="btn btn-primary" href="/ui/">Go To User Interface</a>
</div>
<br />
<div class="container" [hidden]="!authenticated || !admin">
  <a class="btn btn-primary" href="/admin/">Go To Admin Interface</a>
</div>

include::basic/src/app/app.component.ts

import { TestBed, async } from '@angular/core/testing';
import { AppComponent } from './app.component';
describe('AppComponent', () => {
  beforeEach(async(() => {
    TestBed.configureTestingModule({
      imports: [],
      declarations: [
        AppComponent
      ]
    }).compileComponents();
  }));
  it('should create the app', async(() => {
    const fixture = TestBed.createComponent(AppComponent);
    const app = fixture.debugElement.componentInstance;
    expect(app).toBeTruthy();
  }));
  ...
}

Unresolved directive in testing.adoc - include::basic/src/app/app.component.spec[indent=0]

import { Component, inject } from '@angular/core';
import { HttpClient } from '@angular/common/http';
import { finalize } from 'rxjs/operators';

@Component({
  selector: 'app-root',
  standalone: true,
  templateUrl: './app.component.html',
  styleUrls: ['./app.component.css']
})
export class AppComponent {
  private http = inject(HttpClient);

  title = 'Demo';
  authenticated = false;
  greeting: { id?: string; content?: string } = {};

  constructor() {
    this.authenticate();
  }

  authenticate() {
    this.http.get<{ name?: string }>('user').subscribe({
      next: (response) => {
        if (response['name']) {
          this.authenticated = true;
          this.http.get<{ id?: string; content?: string }>('resource').subscribe(data => this.greeting = data);
        } else {
          this.authenticated = false;
        }
      },
      error: () => {
        this.authenticated = false;
      }
    });
  }

  logout() {
    this.http.post('logout', {}).pipe(
      finalize(() => {
        this.authenticated = false;
        this.http.post('http://localhost:9999/logout', {}, {})
            .subscribe(() => {
                console.log('Logged out');
        });
      })
    ).subscribe();
  }
}

		)
	*/;
	http.formLogin(Customizer.withDefaults());
	return http.build();
}

@Bean
@Order(2)
public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
	http
		.cors(cors -> cors.configurationSource(configurationSource()))
		.authorizeHttpRequests(authorize -> authorize.anyRequest().authenticated())
		.formLogin(Customizer.withDefaults())
		.oauth2ResourceServer((oauth2) -> oauth2.jwt(Customizer.withDefaults()))
		.csrf((csrf) -> csrf.ignoringRequestMatchers("/logout/**"));
	return http.build();
}

private CorsConfigurationSource configurationSource() {
	UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
	CorsConfiguration config = new CorsConfiguration();
	config.addAllowedOrigin("*");

RegisteredClient client = RegisteredClient.withId(UUID.randomUUID().toString())
    .clientId("acme")
    ...
    .clientSettings(ClientSettings.builder().requireAuthorizationConsent(false).build())
    .build();

// uncomment to invalidate session after issuing authorization code
/*
	.authorizationEndpoint((authorize) -> authorize
		.authorizationResponseHandler(new SessionInvalidatingSuccessHandler())
	)
*/;

// uncomment to invalidate session after issuing authorization code
/*
private static class SessionInvalidatingSuccessHandler implements AuthenticationSuccessHandler {
	@Override
	public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
										Authentication authentication) throws IOException, ServletException {
		OAuth2AuthorizationCodeRequestAuthenticationToken authCodeRequestAuth =
				(OAuth2AuthorizationCodeRequestAuthenticationToken) authentication;

		// Build the redirect URI with the authorization code
		UriComponentsBuilder uriBuilder = UriComponentsBuilder
				.fromUriString(authCodeRequestAuth.getRedirectUri())
				.queryParam("code", authCodeRequestAuth.getAuthorizationCode().getTokenValue());
		if (authCodeRequestAuth.getState() != null) {
			uriBuilder.queryParam("state", authCodeRequestAuth.getState());
		}
		String redirectUri = uriBuilder.build().toUriString();

		// Send the redirect
		response.sendRedirect(redirectUri);

		// Invalidate the session after the redirect is sent
		HttpSession session = request.getSession(false);
		if (session != null) {
			session.invalidate();
		}
	}
}
*/