Fixes exception thrown on missing access token

The resource server was throwing an ArgumentException when an HTTP
Authorization header appeared with a value of "Bearer " but no access
token. We now throw a ProtocolException that can produce the appropriate
error to the client.

Fixes #230

3 files changed, 48 insertions, 0 deletions

diff --git a/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/StandardAccessTokenAnalyzer.cs b/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/StandardAccessTokenAnalyzer.cs
index 54d86ff..bd28821 100644
--- a/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/StandardAccessTokenAnalyzer.cs
+++ b/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/StandardAccessTokenAnalyzer.cs
@@ -49,6 +49,7 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// <returns>The deserialized, validated token.</returns>
 		/// <exception cref="ProtocolException">Thrown if the access token is expired, invalid, or from an untrusted authorization server.</exception>
 		public virtual AccessToken DeserializeAccessToken(IDirectedProtocolMessage message, string accessToken) {
+			ErrorUtilities.VerifyProtocol(!string.IsNullOrEmpty(accessToken), ResourceServerStrings.MissingAccessToken);
 			var accessTokenFormatter = AccessToken.CreateFormatter(this.AuthorizationServerPublicSigningKey, this.ResourceServerPrivateEncryptionKey);
 			var token = new AccessToken();
 			accessTokenFormatter.Deserialize(token, message, accessToken, Protocol.access_token);
diff --git a/src/DotNetOpenAuth.Test/DotNetOpenAuth.Test.csproj b/src/DotNetOpenAuth.Test/DotNetOpenAuth.Test.csproj
index b58aa17..189a569 100644
--- a/src/DotNetOpenAuth.Test/DotNetOpenAuth.Test.csproj
+++ b/src/DotNetOpenAuth.Test/DotNetOpenAuth.Test.csproj
@@ -249,6 +249,7 @@
     <Compile Include="Mocks\TestMessageFactory.cs" />
     <Compile Include="OAuth2\AuthorizationServerTests.cs" />
     <Compile Include="OAuth2\MessageFactoryTests.cs" />
+    <Compile Include="OAuth2\ResourceServerTests.cs" />
     <Compile Include="OAuth2\UserAgentClientAuthorizeTests.cs" />
     <Compile Include="OAuth2\OAuth2Coordinator.cs" />
     <Compile Include="OAuth2\OAuth2TestBase.cs" />
diff --git a/src/DotNetOpenAuth.Test/OAuth2/ResourceServerTests.cs b/src/DotNetOpenAuth.Test/OAuth2/ResourceServerTests.cs
new file mode 100644
index 0000000..e9a5921
--- /dev/null
+++ b/src/DotNetOpenAuth.Test/OAuth2/ResourceServerTests.cs
@@ -0,0 +1,46 @@
+//-----------------------------------------------------------------------
+// <copyright file="ResourceServerTests.cs" company="Andrew Arnott">
+//     Copyright (c) Andrew Arnott. All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace DotNetOpenAuth.Test.OAuth2 {
+	using System;
+	using System.Collections.Generic;
+	using System.Collections.Specialized;
+	using System.Linq;
+	using System.Security.Cryptography;
+	using System.Text;
+
+	using DotNetOpenAuth.Messaging;
+	using DotNetOpenAuth.OAuth2;
+
+	using NUnit.Framework;
+
+	[TestFixture]
+	public class ResourceServerTests : OAuth2TestBase {
+		[Test]
+		public void GetAccessTokenWithMissingAccessToken() {
+			var rsa = new RSACryptoServiceProvider();
+			var resourceServer = new ResourceServer(new StandardAccessTokenAnalyzer(rsa, rsa));
+
+			var requestHeaders = new NameValueCollection {
+				{ "Authorization", "Bearer " },
+			};
+			var request = new HttpRequestInfo("GET", new Uri("http://localhost/resource"), headers: requestHeaders);
+			Assert.That(() => resourceServer.GetAccessToken(request), Throws.InstanceOf<ProtocolException>());
+		}
+
+		[Test]
+		public void GetPrincipalWithMissingAccessToken() {
+			var rsa = new RSACryptoServiceProvider();
+			var resourceServer = new ResourceServer(new StandardAccessTokenAnalyzer(rsa, rsa));
+
+			var requestHeaders = new NameValueCollection {
+				{ "Authorization", "Bearer " },
+			};
+			var request = new HttpRequestInfo("GET", new Uri("http://localhost/resource"), headers: requestHeaders);
+			Assert.That(() => resourceServer.GetPrincipal(request), Throws.InstanceOf<ProtocolException>());
+		}
+	}
+}