Source:
<code>protected void doPostAuthorizationSubmit(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException { String authKeyForm = request.getParameter(AUTHORIZATION_KEY); AuthorizationRequest authRequest = AuthorizationRequest.get(authKeyForm); if (authRequest == null) { handleError(OAuth2Error.invalidRequest(), request, response); return; } AuthorizationRequest.remove(authRequest.getAuthorizationKey()); OAuth2Error error = authRequest.checkError(); if (error != null) { handleError(error, request, response); return; } String grantAccess = request.getParameter(GRANT_ACCESS_PARAM); if (!authRequest.getAuthorizationKey().equals(authKeyForm)) { handleError(OAuth2Error.accessDenied(), request, response); return; <START> } <END> if (grantAccess == null) { error = OAuth2Error.accessDenied(); Map<String, String> params = new HashMap<>(); params.put(ERROR_PARAM, error.getId()); String errorDescription = error.getDescription(); if (StringUtils.isNotBlank(errorDescription)) { params.put(ERROR_DESCRIPTION_PARAM, errorDescription); } String state = request.getParameter(STATE_PARAM); if (StringUtils.isNotBlank(state)) { params.put(STATE_PARAM, state); } sendRedirect(response, authRequest.getRedirectUri(), params); return; } String authorizationCode = authRequest.getAuthorizationCode(); AuthorizationRequest.store(authorizationCode, authRequest); Map<String, String> params = new HashMap<>(); params.put(AUTHORIZATION_CODE_PARAM, authorizationCode); if (StringUtils.isNotBlank(authRequest.getState())) { params.put(STATE_PARAM, authRequest.getState()); } request.getSession().invalidate(); sendRedirect(response, authRequest.getRedirectUri(), params); }</code><technical_language>removed, code is stored in session anymore request</technical_language>

Target:
protected void doPostAuthorizationSubmit(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException { String authKeyForm = request.getParameter(AUTHORIZATION_KEY); AuthorizationRequest authRequest = AuthorizationRequest.get(authKeyForm); if (authRequest == null) { handleError(OAuth2Error.invalidRequest(), request, response); return; } AuthorizationRequest.remove(authRequest.getAuthorizationKey()); OAuth2Error error = authRequest.checkError(); if (error != null) { handleError(error, request, response); return; } String grantAccess = request.getParameter(GRANT_ACCESS_PARAM); if (grantAccess == null) { error = OAuth2Error.accessDenied(); Map<String, String> params = new HashMap<>(); params.put(ERROR_PARAM, error.getId()); String errorDescription = error.getDescription(); if (StringUtils.isNotBlank(errorDescription)) { params.put(ERROR_DESCRIPTION_PARAM, errorDescription); } String state = request.getParameter(STATE_PARAM); if (StringUtils.isNotBlank(state)) { params.put(STATE_PARAM, state); } sendRedirect(response, authRequest.getRedirectUri(), params); return; } String authorizationCode = authRequest.getAuthorizationCode(); AuthorizationRequest.store(authorizationCode, authRequest); Map<String, String> params = new HashMap<>(); params.put(AUTHORIZATION_CODE_PARAM, authorizationCode); if (StringUtils.isNotBlank(authRequest.getState())) { params.put(STATE_PARAM, authRequest.getState()); } request.getSession().invalidate(); sendRedirect(response, authRequest.getRedirectUri(), params); }