Reset state for client authorization request

spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/DefaultOAuth2ClientContext.java

@@ -1,8 +1,8 @@
 package org.springframework.security.oauth2.client;
 
 import java.io.Serializable;
-import java.util.HashMap;
 import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
 
 import org.springframework.security.oauth2.client.token.AccessTokenRequest;
 import org.springframework.security.oauth2.client.token.DefaultAccessTokenRequest;
@@ -25,7 +25,7 @@ public class DefaultOAuth2ClientContext implements OAuth2ClientContext, Serializ
 
 	private AccessTokenRequest accessTokenRequest;
 
-	private Map<String, Object> state = new HashMap<String, Object>();
+	private Map<String, Object> state = new ConcurrentHashMap<String, Object>();
 
 	public DefaultOAuth2ClientContext() {
 		this(new DefaultAccessTokenRequest());
@@ -54,6 +54,7 @@ public AccessTokenRequest getAccessTokenRequest() {
 	}
 
 	public void setPreservedState(String stateKey, Object preservedState) {
+		state.clear();
 		state.put(stateKey, preservedState);
 	}
 

spring-security-oauth2/src/test/java/org/springframework/security/oauth2/client/DefaultOAuth2ClientContextTests.java

@@ -0,0 +1,21 @@
+package org.springframework.security.oauth2.client;
+
+import org.junit.Test;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+
+public class DefaultOAuth2ClientContextTests {
+
+    @Test
+    public void resetsState() {
+        DefaultOAuth2ClientContext clientContext = new DefaultOAuth2ClientContext();
+        clientContext.setPreservedState("state1", "some-state-1");
+        clientContext.setPreservedState("state2", "some-state-2");
+        clientContext.setPreservedState("state3", "some-state-3");
+        assertNull(clientContext.removePreservedState("state1"));
+        assertNull(clientContext.removePreservedState("state2"));
+        assertEquals("some-state-3", clientContext.removePreservedState("state3"));
+    }
+
+}