spring-projects / spring-projects/spring-security
Observable session events
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
Spring applications with sessions optionally expose an "observable" of session events (something like a WebSocket).
Context
When working with SPAs authorizing REST requests to a Spring backend with sessions, it would be nice that this Spring application expose something like a WebSocket to which the frontend(s) could subscribe to be notified with session events like a modification to the Authentication in session changes.
A few samples of when this could be useful:
- sessions expiration
- when working with an OAuth2 client, it is possible that the authorities change after an ID-token refreshing (or a new call to the
userinfoendpoint is made) - when using Back-Channel Logout
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing Spring Security's existing session and authentication event handling. Determine how an observable or WebSocket could expose session expiration, Authentication changes, OAuth2 authority updates, and Back-Channel Logout notifications to SPA clients. Done requires an agreed design and implementation scope for these session events.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100