ServletBearerExchangeFilterFunction should propagate Authentication #7418
Labels
in: oauth2
An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)
type: enhancement
A general enhancement
Milestone
Related to #7353 (comment)
ServletBearerExchangeFilterFunction
consults theSecurityContextHolder
directly when looking up the currentAuthentication
. This is because it was initially designed to only read from the main thread.This is limiting, however, in situations where the
Authentication
may be needed off of the main thread. Consider the toy example below:With this setup, the
ServletBearerExchangeFilterFunction
will not be executed on the main thread, meaning thatSecurityContextHolder
will not be available.ServletBearerExchangeFilterFunction
could be enhanced, though, by introducing aHooks.onLastOperator
that adds theAuthentication
to the reactor context so that more complex scenarios like the above work.The text was updated successfully, but these errors were encountered: