如何使用Rest Assured从Location响应头中提取授权码

我有一套授权流程用于获取access token，目前已能从授权请求的响应中提取Location头，但仅需提取其中位于code=和&之间的授权码部分（示例中为12WVUcPyFbmTZUOcgaluGl98r08），该授权码将用于后续获取access token的POST请求体中。现有相关方法如下，求Rest Assured或纯Java的实现方案：

示例Location头内容：

https://something.url.com/myapp/auth/token?code=**12WVUcPyFbmTZUOcgaluGl98r08**&iss=https%3A%2F%2Fsomething.url.com%3A8443%2Fam%2Foauth2%2Fvendors&client_id=5c1d7ex3-g3rc-4a64-9855-074a57cc1570

现有代码：

private static void getAuthorizeCode() throws JsonException {

    response = given()
                .config(RestAssured.config()
                    .encoderConfig(EncoderConfig.encoderConfig()
                            .encodeContentTypeAs("x-www-form-urlencoded",
                                    ContentType.URLENC)))
            .cookies(cookies)
            .header("Accept-Encoding", "gzip, deflate, br")
            .formParam("redirect_uri", devRedirectUrl)
            .formParam("response_type", responseType)
            .formParam("client_id", userClientID)
            .formParam("client_secret", userClientSecrets)
            .formParam("decision", decision)
            .formParam("csrf", tokenId)
            .post(urlProps.getProperty("devVGWAuthorizeUrl"))
            .then()
            .assertThat()
            .statusCode(302)
            .extract().response();

    locationHeaderForAuthCode = response.getHeader("Location");

}

private static void getAccToken() throws JsonException {
    response = given()
            .log().all().config(RestAssured.config()
                    .encoderConfig(EncoderConfig.encoderConfig()
                            .encodeContentTypeAs("x-www-form-urlencoded",
                                    ContentType.URLENC)))
            .cookies(cookies)
            .header("Accept-Encoding", "gzip, deflate, br")
            .formParam("grant_type", "authorization_code")
            .formParam("client_id", userClientID)
            .formParam("client_secret", userClientSecrets)
            .formParam("redirect_uri", devRedirectUrl)
            .formParam("code", locationHeaderForAuthCode)
            .post(urlProps.getProperty("devVGWAccessTokenUrl"))
            .then()
//                .assertThat()
//                .statusCode(200)
            .log().all()
            .extract().response();

    accToken = response.jsonPath().getString("access_token");
    System.out.println("Access token is " + accToken);
}

方案1：使用Rest Assured内置工具解析 #

Rest Assured提供了直接解析URL查询参数的能力，无需手动处理字符串。修改getAuthorizeCode方法，提取Location头后直接解析code参数：

private static void getAuthorizeCode() throws JsonException {

    response = given()
                .config(RestAssured.config()
                    .encoderConfig(EncoderConfig.encoderConfig()
                            .encodeContentTypeAs("x-www-form-urlencoded",
                                    ContentType.URLENC)))
            .cookies(cookies)
            .header("Accept-Encoding", "gzip, deflate, br")
            .formParam("redirect_uri", devRedirectUrl)
            .formParam("response_type", responseType)
            .formParam("client_id", userClientID)
            .formParam("client_secret", userClientSecrets)
            .formParam("decision", decision)
            .formParam("csrf", tokenId)
            .post(urlProps.getProperty("devVGWAuthorizeUrl"))
            .then()
            .assertThat()
            .statusCode(302)
            .extract().response();

    // 提取Location头并解析code参数
    String locationHeader = response.getHeader("Location");
    authCode = RestAssured.from(locationHeader).queryParam("code");
}

之后在getAccToken方法中，将formParam("code", locationHeaderForAuthCode)替换为formParam("code", authCode)即可。

方案2：纯Java实现（三种方式） #

如果不想依赖Rest Assured的解析工具，可使用纯Java方式提取授权码：

方式1：原生URL参数拆分 #

无需第三方库，手动拆分查询字符串：

private static void getAuthorizeCode() throws JsonException, URISyntaxException {

    // ... 原有请求代码不变

    String locationHeader = response.getHeader("Location");
    // 解析URL查询字符串
    String queryString = new URI(locationHeader).getQuery();
    String[] params = queryString.split("&");
    for (String param : params) {
        if (param.startsWith("code=")) {
            authCode = param.substring("code=".length());
            break;
        }
    }
}

方式2：正则表达式匹配 #

通过正则直接匹配code=到下一个&之间的内容：

import java.util.regex.Matcher;
import java.util.regex.Pattern;

private static void getAuthorizeCode() throws JsonException {

    // ... 原有请求代码不变

    String locationHeader = response.getHeader("Location");
    Pattern pattern = Pattern.compile("code=([^&]+)");
    Matcher matcher = pattern.matcher(locationHeader);
    if (matcher.find()) {
        authCode = matcher.group(1);
    }
}

方式3：借助Apache HttpClient工具类 #

如果项目中已依赖Apache HttpClient，可使用URLEncodedUtils简化解析：

import java.net.URI;
import java.net.URISyntaxException;
import java.util.List;
import org.apache.http.NameValuePair;
import org.apache.http.client.utils.URLEncodedUtils;

private static void getAuthorizeCode() throws JsonException, URISyntaxException {

    // ... 原有请求代码不变

    String locationHeader = response.getHeader("Location");
    URI uri = new URI(locationHeader);
    List<NameValuePair> params = URLEncodedUtils.parse(uri, "UTF-8");
    for (NameValuePair param : params) {
        if ("code".equals(param.getName())) {
            authCode = param.getValue();
            break;
        }
    }
}

内容的提问来源于stack exchange，提问作者wheelerlc64