Merge remote-tracking branch 'origin/6.5.x'

web/src/main/java/org/springframework/security/web/authentication/ott/GenerateOneTimeTokenFilter.java

@@ -30,7 +30,6 @@ import org.springframework.security.authentication.ott.OneTimeTokenService;
 import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.Assert;
-import org.springframework.util.StringUtils;
 import org.springframework.web.filter.OncePerRequestFilter;
 
 /**
@@ -68,11 +67,6 @@ public final class GenerateOneTimeTokenFilter extends OncePerRequestFilter {
 			filterChain.doFilter(request, response);
 			return;
 		}
-		String username = request.getParameter("username");
-		if (!StringUtils.hasText(username)) {
-			filterChain.doFilter(request, response);
-			return;
-		}
 		GenerateOneTimeTokenRequest generateRequest = this.requestResolver.resolve(request);
 		if (generateRequest == null) {
 			filterChain.doFilter(request, response);

web/src/test/java/org/springframework/security/web/authentication/ott/GenerateOneTimeTokenFilterTests.java

@@ -113,4 +113,22 @@ public class GenerateOneTimeTokenFilterTests {
 		// @formatter:on
 	}
 
+	@Test
+	void filterWhenUsernameFormParamIsEmptyButRequestResolverCanResolveThenSuccess()
+			throws ServletException, IOException {
+		GenerateOneTimeTokenRequestResolver requestResolver = mock();
+		given(this.oneTimeTokenService.generate(ArgumentMatchers.any(GenerateOneTimeTokenRequest.class)))
+			.willReturn((new DefaultOneTimeToken(TOKEN, USERNAME, Instant.now())));
+		given(requestResolver.resolve(this.request)).willReturn(new GenerateOneTimeTokenRequest(USERNAME));
+
+		GenerateOneTimeTokenFilter filter = new GenerateOneTimeTokenFilter(this.oneTimeTokenService,
+				this.successHandler);
+		filter.setRequestResolver(requestResolver);
+
+		filter.doFilter(this.request, this.response, this.filterChain);
+
+		verify(this.oneTimeTokenService).generate(ArgumentMatchers.any(GenerateOneTimeTokenRequest.class));
+		assertThat(this.response.getRedirectedUrl()).isEqualTo("/login/ott");
+	}
+
 }