grpc-ecosystem / grpc-ecosystem/grpc-spring

Disable `SecurityFilterChain` for `@GrpcService` by default

Open
#776 9 comments 0 reactions 0 assignees View on GitHub
bug feedback required
Dominant language
Java
Stars
3.7k
Forks
858
PR merge metrics
No merged PRs in 30d

Description

I'm facing problems with disabling `SecurityFilterChain` for the gRPC service.
I wanted to integrate gRPC service into the existing Spring Web server project, but it failed to start due to the following:
` Found WebSecurityConfigurerAdapter as well as SecurityFilterChain. Please select just one.`

The project I'm trying to integrate with contains `WebSecurityConfigurerAdapter` already. We use it for authentications.
I tried to disable `spring-security` in the `grpc-spring-boot-starter` like this but unsuccessfully:

```

net.devh
grpc-spring-boot-starter
2.13.1.RELEASE


org.springframework.security
spring-security-web


org.springframework.security
spring-security-config

```

The server is executed as `grpc-netty-shaded`.

I don't understand why your starter insists on initializing the filter chain and there is no way to disable it?
Is there any way to disable security for grpc starter?

### Project dependencies
Spring Boot Starter Parent: 2.6.7
gRPC Spring Boot Starter: 2.13.1.RELEASE
io.grpc: 1.50.2
Google Protobuf: 3.21.8

Contributor guide

Open the contributing guide

Research direction

Start by tracing the starter's security auto-configuration and how it applies to @GrpcService, using the reported Spring Boot 2.6.7 and grpc-spring-boot-starter 2.13.1.RELEASE setup as a reproduction. Identify the configuration point that creates the SecurityFilterChain and verify that an application can disable it while retaining its existing WebSecurityConfigurerAdapter.

Written by the indexing model from the issue text.

Assessment

Tech stack
grpc, java, spring, spring-boot
Domain
api, backend, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.