spring-projects / spring-projects/spring-security
Use micrometer context-propagation to propagate auth between threadlocal and reactor ops
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
In spring mvc with reactive API, it uses a custom reactor subscriber, SecurityReactorContextSubscriber, to propagate the authentication and servlet request and response to the reactor operation chain. (Defined in SecurityReactorContextConfiguration imported by OAuth2ImportSelector)
The micrometer context-propagation library provides support for propagating such objects between threadlocal and reactor operation chains.
It is nice to migrate to it which aligns how micrometer observations are propagated as well as avoiding reactor corner cases that may not able to propagate by Hooks.onLastOperator.
cc @sjohnr, @chemicL
relates to https://github.com/spring-projects/spring-security/issues/11973
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with SecurityReactorContextConfiguration.java, especially SecurityReactorContextSubscriber, and trace how OAuth2ImportSelector imports it for Spring MVC with reactive APIs. Review the micrometer context-propagation library and the existing authentication and servlet request/response propagation paths. Done means the custom propagation approach is migrated without losing those contexts or the behavior covered by the existing tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, backend
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100