/**
 *       Copyright 2010 Newcastle University
 *
 *          http://research.ncl.ac.uk/smart/
 *
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.apache.amber.oauth2.rs.extractor;

import javax.servlet.http.HttpServletRequest;

import org.apache.amber.oauth2.common.OAuth;

/**
 * @author Maciej Machulak (m.p.machulak@ncl.ac.uk)
 * @author Lukasz Moren (lukasz.moren@ncl.ac.uk)
 * @author Aad van Moorsel (aad.vanmoorsel@ncl.ac.uk)
 */
public class BearerQueryTokenExtractor implements TokenExtractor {

    @Override
    public String getAccessToken(HttpServletRequest request) {
        String token = request.getParameter(OAuth.OAUTH_BEARER_TOKEN);
        if (token == null) {
            token = request.getParameter(OAuth.OAUTH_TOKEN);
        }
        return token;
    }

    @Override
    public String getAccessToken(HttpServletRequest request, String tokenName) {
        return request.getParameter(tokenName);
    }

}

/**
 *       Copyright 2010 Newcastle University
 *
 *          http://research.ncl.ac.uk/smart/
 *
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.apache.amber.oauth2.rs.extractor;

import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;

import javax.servlet.http.HttpServletRequest;

import org.apache.amber.oauth2.common.OAuth;

/**
 * @author Maciej Machulak (m.p.machulak@ncl.ac.uk)
 * @author Lukasz Moren (lukasz.moren@ncl.ac.uk)
 * @author Aad van Moorsel (aad.vanmoorsel@ncl.ac.uk)
 */
public class BearerQueryTokenExtractor implements TokenExtractor {

    @Override
    public String getAccessToken(HttpServletRequest request) {
        String token = getQueryParameter(request, OAuth.OAUTH_BEARER_TOKEN);
        if (token == null) {
            token = getQueryParameter(request, OAuth.OAUTH_TOKEN);
        }
        return token;
    }

    @Override
    public String getAccessToken(HttpServletRequest request, String tokenName) {
        return getQueryParameter(request, tokenName);
    }

    /**
     * A replacement for HttpServletRequest.getParameter() as it will mess up with HTTP POST body
     * @param request
     * @param name
     * @return
     */
    private String getQueryParameter(HttpServletRequest request, String name) {
        String query = request.getQueryString();
        if (query == null) {
            return null;
        }
        String[] params = query.split("&");
        for (String param : params) {
            try {
                param = URLDecoder.decode(param, "UTF-8");
            } catch (UnsupportedEncodingException e) {
                // Ignore
            }
            int index = param.indexOf('=');
            String key = param;
            String value = null;
            if (index != -1) {
                key = param.substring(0, index);
                value = param.substring(index + 1);
            }
            if (key.equals(name)) {
                return value;
            }
        }
        return null;
    }

}

Fix the code to not mess up with HTTP POST body