SpringSource/spring-security-oauth — pull request #93 by aanganes (2013-09-03 21:09:42+00:00)
Title: Added extra parameter to RedirectView constructor calls; set exposeModelAttributes = false

The way the RedirectView constructors were being called in the AuthorizationEndpoint did not set the exposeModelAttributes parameter to false. This meant that if a user denied an OAuth2 request, the returned redirect URI contained many model attributes which should not be visible to the user. This patch adds parameters to the RedirectView constructor calls to set that parameter to false.

Note that redirects can also be triggered by returning a path starting with "redirect:". In this case Spring builds the RedirectView behind the scenes, and decides how to set this flag based on flags in the SecurityContext. We haven't analyzed the whole codebase to see if that pattern is being used anywhere, but if it is this issue might crop up in other spots.