Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ServletBearerExchangeFilterFunction should propagate Authentication #7418

Closed
jzheaux opened this issue Sep 10, 2019 · 0 comments · Fixed by #7419
Closed

ServletBearerExchangeFilterFunction should propagate Authentication #7418

jzheaux opened this issue Sep 10, 2019 · 0 comments · Fixed by #7419
Assignees
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: enhancement A general enhancement
Milestone

Comments

@jzheaux
Copy link
Contributor

jzheaux commented Sep 10, 2019

Related to #7353 (comment)

ServletBearerExchangeFilterFunction consults the SecurityContextHolder directly when looking up the current Authentication. This is because it was initially designed to only read from the main thread.

This is limiting, however, in situations where the Authentication may be needed off of the main thread. Consider the toy example below:

ServletBearerExchangeFilterFunction bearer = new ServletBearerExchangeFilterFunction();
WebClient webClient = WebClient.builder()
		.filter((request, next) -> Mono.deferWithContext(ctx -> next.exchange(request)))
		.filter(bearer)
		.build();

return webClient.get()
		.uri("https://endpoint.example.org")
		.retrieve()
		.bodyToMono(String.class)
		.timeout(Duration.ofMillis(10000))
                .retry(3, TimeoutException.class::isInstance)
		.block();

With this setup, the ServletBearerExchangeFilterFunction will not be executed on the main thread, meaning that SecurityContextHolder will not be available.

ServletBearerExchangeFilterFunction could be enhanced, though, by introducing a Hooks.onLastOperator that adds the Authentication to the reactor context so that more complex scenarios like the above work.

@jzheaux jzheaux self-assigned this Sep 10, 2019
@jzheaux jzheaux added this to the 5.2.0 milestone Sep 10, 2019
@jzheaux jzheaux added in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: enhancement A general enhancement labels Sep 10, 2019
jzheaux added a commit to jzheaux/spring-security that referenced this issue Sep 10, 2019
jzheaux added a commit to jzheaux/spring-security that referenced this issue Sep 11, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: enhancement A general enhancement
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant