spring-projects / spring-projects/spring-security
Reactive Security OAuth2 client doesn't propagate traces and baggage's in Spring Boot 3
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
The current version of Reactive OAuth Security doesn't follow all Observability documentation recommendations, therefore it doesn't propagate trace and baggage's over network. See: Docs Spring.io - 8.4. Propagating Traces
Where WebClient.Builder() is used statically - therefore it has NOOP ObservationRegistry and doesn't register Request Observations, and doesn't allow propagating traces (for example B3 Brave Zipkin Baggage's propagation).
To Reproduce
Creating Reactive OAuth client and trying to send traces and baggage's to authentication server.
Expected behavior
OAuth calls from client to server in Reactive Security and Spring Boot 3 start proper request observations and propagate baggage's.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/AbstractWebClientReactiveOAuth2AccessTokenResponseClient.java and review how its WebClient.Builder is created and configured. Reproduce a reactive OAuth2 token request with tracing enabled, then verify that request observations and trace/baggage propagation reach the authentication server.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring, spring-boot
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100