spring-cloud / spring-cloud/spring-cloud-openfeign

Replacement for OAuth2FeignRequestInterceptor from spring-cloud-security?

Open
#417 14 comments 12 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Java
Stars
1.3k
Forks
838
Avg merge
2d 11h
Merged PRs (30d)
13

Description

Is your feature request related to a problem? Please describe.
For my Feign Clients I need to add an RequestInterceptor which enhances the requests with an OAuth Bearer Token. I still use the OAuth2FeignRequestInterceptor. But it simply states @deprecated will move to Spring Cloud Openfeign in next major release

I need quite it's features as the oAuth provider Auth0 requires a non standard attribute "audience" - so I configure the interceptor with customized versions of DefaultOAuth2ClientContext, DefaultAccessTokenRequest, DefaultRequestEnhancer, ClientCredentialsAccessTokenProvider (which themselves all get @Deprecated - but the Migration Guide doesn't really help me yet)

Describe the solution you'd like
A 1:1 replacement for the OAuth2FeignRequestInterceptor
or an equivalent which can handle additional attributes in the token request needed for Auth0 ("audience").

Describe alternatives you've considered
I stay with the deprecated OAuth2FeignRequestInterceptor and ignore all the Warnings in the logs and IDE 👎

Additional context
There is also a question on StackOverflow addressing this issue from somebody else - but no answers or ideas yet.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the deprecated OAuth2FeignRequestInterceptor in spring-cloud-security and the referenced OAuth client classes: DefaultOAuth2ClientContext, DefaultAccessTokenRequest, DefaultRequestEnhancer, and ClientCredentialsAccessTokenProvider. Review the OAuth 2.0 Migration Guide and the existing issue discussion first. Done means documenting or providing a supported replacement that preserves Feign bearer-token behavior and supports Auth0's audience attribute.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
api, authentication, backend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.