spring-projects / spring-projects/spring-security

Spring Webflex - reactor core exception - accessing endpoint with http: basic auth

Open
#15,348 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

in: web status: feedback-provided
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

I'm sure this shouldn't happen, but when I try to access an endpoint requiring basic http authentication, from postman, but in postman set authetication to none, instead of getting not authenticated / not authorized back, Spring Boot throws an exception and crashes,

2024-07-02T21:54:33.799+01:00 WARN 79450 --- [ parallel-1] reactor.core.Exceptions : throwIfFatal detected a jvm fatal exception, which is thrown and logged below:

java.lang.StackOverflowError: null
	at reactor.core.publisher.InnerOperator.currentContext(InnerOperator.java:33) ~[reactor-core-3.5.11.jar:3.5.11]
	at reactor.core.publisher.MonoFlatMap$FlatMapInner.currentContext(MonoFlatMap.java:270) ~[reactor-core-3.5.11.jar:3.5.11]
	at reactor.core.publisher.InnerOperator.currentContext(InnerOperator.java:33) ~[reactor-core-3.5.11.jar:3.5.11]
	at reactor.core.publisher.InnerOperator.currentContext(InnerOperator.java:33) ~[reactor-core-3.5.11.jar:3.5.11]
	at reactor.core.publisher.InnerOperator.currentContext(InnerOperator.java:33) ~[reactor-core-3.5.11.jar:3.5.11]
	at reactor.core.publisher.InnerOperator.currentContext(InnerOperator.java:33) ~[reactor-core-3.5.11.jar:3.5.11]
	at reactor.core.publisher.InnerOperator.currentContext(InnerOperator.java:33) ~[reactor-core-3.5.11.jar:3.5.11

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior.

Expected behavior
A clear and concise description of what you expected to happen.

Sample

A link to a GitHub repository with a minimal, reproducible sample.

Reports that include a sample will take priority over reports that do not.
At times, we may require a sample, so it is good to try and include a sample up front.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the reported Spring WebFlux endpoint request with HTTP basic authentication enabled and no credentials in Postman, then inspect the Reactor stack trace showing repeated InnerOperator.currentContext calls. Done means the unauthenticated request returns an authentication or authorization response without a StackOverflowError or application crash.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring-boot
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.