spring-projects / spring-projects/spring-security
Add support for requesting protected resources with `RestClient` similar to `ServletBearerExchangeFilterFunction`
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
It would be nice if the RestClient supported an equivalent of ServletBearerExchangeFilterFunction. This would allow us to easily grab a user's bearer token and pass that on to subsequent client calls without having to explicitly grab the header and token etc.
Current Behavior
Currently I can implement this very easily for a WebClient like this:
@Bean
public WebClient profileServiceWebClient(WebClient.Builder webClientBuilder) {
return webClientBuilder.filter(new ServletBearerExchangeFilterFunction()).baseUrl(profileServiceBaseUrl)
.defaultHeader(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE).build();
}
As far as I know there is no equivalent implementation for the new RestClient.
Context
This issue is seen as a pretty large blocker for code bases that have to pull a dependency on Spring Boot Starter Webflux (or equivalent) to use WebClient when they are not using a reactive code base. It would be much more preferable to not have to pull that dependency and not have to use reactive code inside a non-reactive code base.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the RestClient API and the ServletBearerExchangeFilterFunction named in the issue, then compare how the existing WebClient example obtains and forwards the bearer token. The work is done when RestClient offers an equivalent way to propagate the current user's token without manual header extraction, with behavior verified by appropriate tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- api, authentication
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100