Preserve resource path in resource metadata challenge

Closes gh-19639

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>

Author: ngocnhan-tran1996

oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/BearerTokenAuthenticationEntryPoint.java

@@ -115,16 +115,13 @@ public void setResourceMetadataParameterResolver(
 	}
 
 	private static String getResourceMetadataParameter(HttpServletRequest request) {
-		String path = request.getContextPath()
-				+ OAuth2ProtectedResourceMetadataFilter.DEFAULT_OAUTH2_PROTECTED_RESOURCE_METADATA_ENDPOINT_URI;
-		// @formatter:off
-		return UriComponentsBuilder.fromUriString(UrlUtils.buildFullRequestUrl(request))
-				.replacePath(path)
-				.replaceQuery(null)
-				.fragment(null)
-				.build()
-				.toUriString();
-		// @formatter:on
+
+		UriComponentsBuilder builder = UriComponentsBuilder.fromUriString(UrlUtils.buildFullRequestUrl(request));
+		String[] pathSegments = builder.build().getPathSegments().toArray(String[]::new);
+		return builder.replacePath(request.getContextPath())
+			.path(OAuth2ProtectedResourceMetadataFilter.DEFAULT_OAUTH2_PROTECTED_RESOURCE_METADATA_ENDPOINT_URI)
+			.pathSegment(pathSegments)
+			.toUriString();
 	}
 
 	private static String computeWWWAuthenticateHeaderValue(Map<String, String> parameters) {

oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/BearerTokenAuthenticationEntryPointTests.java

@@ -19,13 +19,18 @@
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+import org.junit.jupiter.params.provider.NullAndEmptySource;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.springframework.http.HttpStatus;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
 import org.springframework.security.oauth2.server.resource.BearerTokenError;
 import org.springframework.security.oauth2.server.resource.BearerTokenErrorCodes;
+import org.springframework.util.StringUtils;
 
 import static org.assertj.core.api.Assertions.assertThat;
 
@@ -90,6 +95,34 @@ public void commenceWhenNoBearerTokenErrorAndResourceMetadataResolverSetThenStat
 			.isEqualTo("Bearer resource_metadata=\"https://example.com/resource-from-request\"");
 	}
 
+	// gh-19639
+	@ParameterizedTest
+	@CsvSource(
+			textBlock = """
+					 , , http://example.com/.well-known/oauth-protected-resource,
+					'', '', http://example.com/.well-known/oauth-protected-resource,
+					/, /, http://example.com/.well-known/oauth-protected-resource,
+					requestUri, contextPath, http://example.com/contextPath/.well-known/oauth-protected-resource/requestUri,
+					/requestUri, /contextPath, http://example.com/contextPath/.well-known/oauth-protected-resource/requestUri,
+					requestUri/, contextPath/, http://example.com/contextPath/.well-known/oauth-protected-resource/requestUri,
+					/requestUri/, /contextPath/, http://example.com/contextPath/.well-known/oauth-protected-resource/requestUri,
+					//requestUri//, //contextPath//, http://example.com/contextPath/.well-known/oauth-protected-resource/requestUri
+					""")
+	public void commenceShouldIncludeContextPathAndRequestUriInResourceMetadata(String requestUri, String contextPath,
+			String expected) {
+
+		MockHttpServletRequest request = new MockHttpServletRequest("GET", requestUri);
+		request.setScheme("http");
+		request.setServerName("example.com");
+		request.setContextPath(contextPath);
+		MockHttpServletResponse response = new MockHttpServletResponse();
+
+		this.authenticationEntryPoint.commence(request, response, new BadCredentialsException("test"));
+		assertThat(response.getStatus()).isEqualTo(401);
+		assertThat(response.getHeader("WWW-Authenticate"))
+			.isEqualTo("Bearer resource_metadata=\"%s\"".formatted(expected));
+	}
+
 	@Test
 	public void commenceWhenInvalidRequestErrorThenStatus400AndHeaderWithError() throws Exception {
 		MockHttpServletRequest request = new MockHttpServletRequest();

web/src/main/java/org/springframework/security/web/util/UrlUtils.java

@@ -21,6 +21,7 @@
 
 import jakarta.servlet.http.HttpServletRequest;
 import org.jspecify.annotations.Nullable;
+import org.springframework.util.StringUtils;
 
 /**
  * Provides static methods for composing URLs.
@@ -67,7 +68,12 @@ else if ("https".equals(scheme)) {
 		}
 		// Use the requestURI as it is encoded (RFC 3986) and hence suitable for
 		// redirects.
-		url.append(requestURI);
+		if (StringUtils.hasText(requestURI)) {
+			if (requestURI.charAt(0) != '/') {
+				url.append("/");
+			}
+			url.append(requestURI);
+		}
 		if (queryString != null) {
 			url.append("?").append(queryString);
 		}

web/src/test/java/org/springframework/security/web/util/UrlUtilsTests.java

@@ -17,14 +17,41 @@
 package org.springframework.security.web.util;
 
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+import org.junit.jupiter.params.provider.NullAndEmptySource;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.util.StringUtils;
 
 import static org.assertj.core.api.Assertions.assertThat;
 
 /**
+ * Test for {@link UrlUtils}
+ *
  * @author Luke Taylor
  */
 public class UrlUtilsTests {
 
+	@ParameterizedTest
+	@CsvSource(textBlock = """
+			 , http://example.com,
+			'', http://example.com,
+			/, http://example.com/,
+			requestUri, http://example.com/requestUri,
+			/requestUri, http://example.com/requestUri,
+			requestUri/, http://example.com/requestUri/,
+			/requestUri/, http://example.com/requestUri/,
+			//requestUri//, http://example.com//requestUri//
+			""")
+	public void buildFullRequestUrl(String requestUri, String expected) {
+
+		MockHttpServletRequest request = new MockHttpServletRequest("GET", requestUri);
+		request.setScheme("http");
+		request.setServerName("example.com");
+		assertThat(UrlUtils.buildFullRequestUrl(request)).isEqualTo(expected);
+	}
+
 	@Test
 	public void absoluteUrlsAreMatchedAsAbsolute() {
 		assertThat(UrlUtils.isAbsoluteUrl("https://something/")).isTrue();