Fixes to refresh tokens. #15508
Fixes to refresh tokens. #15508
Conversation
|
@mraible I couldn't get to work reactive to redirect to oauth2 login url. |
| .authorizationCode() | ||
| .refreshToken(builder -> builder.clockSkew(Duration.ofMinutes(1))) | ||
| .clientCredentials() | ||
| .password() |
There was a problem hiding this comment.
This looks strange. Why do we need a password here and where does it come from?
@bdemers Can you have a look at this? We're trying to get refresh tokens working in JHipster.
There was a problem hiding this comment.
It's the default for the DefaultOAuth2AuthorizedClientManager
https://github.com/spring-projects/spring-security/blob/006b9b960797d279b31cf8c8d16f1549c5632b2c/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/DefaultOAuth2AuthorizedClientManager.java#L91-L96
I've added to let the user easily change clockSkew, but can be removed.
| @@ -46,6 +46,7 @@ public class OAuth2ReactiveRefreshTokensWebFilter implements WebFilter { | |||
| .filter(principal -> principal instanceof OAuth2AuthenticationToken) | |||
| .cast(OAuth2AuthenticationToken.class) | |||
| .flatMap(authentication -> authorizedClient(exchange, authentication)) | |||
| .onErrorResume(e -> Mono.empty()) | |||
There was a problem hiding this comment.
It should redirect to the oauth2 login here.
If the token is expired, an error is returned.
|
Merging. Reverts the old behavior of expired tokens for reactive and redirect to oauth2 login for non-reactive. discussion can continue. |
| } | ||
|
|
||
| @Override | ||
| public void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException, ServletException { | ||
| public void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) | ||
| throws IOException, ServletException { | ||
| Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); | ||
| if ((authentication instanceof OAuth2AuthenticationToken)) { |
There was a problem hiding this comment.
can remove the doubled parenthesis
Please make sure the below checklist is followed for Pull Requests.
When you are still working on the PR, consider converting it to Draft (bellow reviewers) and adding
skip-cilabel, you can still see CI build result at your branch.