Userinfo Error Response by Google not correctly parsed

Hi there,

we experienced the following behavior with your library: When sending a userinfo request to the Google userinfo endpoint (https://www.googleapis.com/oauth2/v3/userinfo) with an invalid token, the WWWAuthenticate Http header field is set to the following value by Google:

Bearer realm="https://acounts.google.com/", error=invalid_token

However your regex in BearerTokenError.java, line 125 in release 5.17.2 matches the following pattern:

/**
 * Regex pattern for matching the error parameter of a WWW-Authenticate 
 * header.
 */
private static final Pattern errorPattern = Pattern.compile("error=\"([^\"]+)");

So the error code value returned by Google doesn't match (because of missing quotes) and therefore the errorCode field of the BearerTokenError returned by BearerTokenError#parse is null.

We didn't find any detailed information on whether quotes must be used or not. The only information we found was an RFC draft (https://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-15#section-3), but the relevant part is not present in the final version (https://tools.ietf.org/html/rfc6750#section-3).

According to our interpretation, the response sent from Google without quotes does not correspond to the example in https://tools.ietf.org/html/rfc6750#section-3, but is also not explicitly wrong.

How would you see that? Should the regex in BearerTokenError.java be relaxed to also match the response from Google?

Comments (5)