spring-projects / spring-projects/spring-security

Add request to Observation Context at creation to enable filtering by the request

Open
#12,854 12 comments 0 reactions 1 assignee View on GitHub

@jzheaux is already working on this.

Since Mar 9, 2023.

in: web type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

This issue was originally discussed in https://github.com/spring-projects/spring-boot/issues/34400.
The scenario is the following: if Spring Security is used and users want to ignore /actuator endpoints, there is no easy way to ignore Observations created by Spring Security because the details to make this decision are missing when the ObservationPredicate is tested.

One potential solution would be adding the request to the Context before the Observation is created, one example here: https://github.com/spring-projects/spring-security/blob/ac1d269e731275cef4ba2739cae6abe092a66234/web/src/main/java/org/springframework/security/web/ObservationFilterChainDecorator.java#L195-L202

Would be something like:

FilterChainObservationContext beforeContext = FilterChainObservationContext.before(request);
FilterChainObservationContext afterContext = FilterChainObservationContext.after(request);

Expected behavior: having extra details on the Observations created by Spring Security that allows the users to ignore these Observation based on the request.

There is a reproducer in the issue mentioned above.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.