spring-projects / spring-projects/spring-security

Add support for requesting protected resources with `RestClient` similar to `ServletBearerExchangeFilterFunction`

Open
#15,820 2 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

in: oauth2 type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Expected Behavior
It would be nice if the RestClient supported an equivalent of ServletBearerExchangeFilterFunction. This would allow us to easily grab a user's bearer token and pass that on to subsequent client calls without having to explicitly grab the header and token etc.

Current Behavior
Currently I can implement this very easily for a WebClient like this:

@Bean
  public WebClient profileServiceWebClient(WebClient.Builder webClientBuilder) {
    return webClientBuilder.filter(new ServletBearerExchangeFilterFunction()).baseUrl(profileServiceBaseUrl)
        .defaultHeader(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE).build();
  }

As far as I know there is no equivalent implementation for the new RestClient.
Context
This issue is seen as a pretty large blocker for code bases that have to pull a dependency on Spring Boot Starter Webflux (or equivalent) to use WebClient when they are not using a reactive code base. It would be much more preferable to not have to pull that dependency and not have to use reactive code inside a non-reactive code base.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the RestClient API and the ServletBearerExchangeFilterFunction named in the issue, then compare how the existing WebClient example obtains and forwards the bearer token. The work is done when RestClient offers an equivalent way to propagate the current user's token without manual header extraction, with behavior verified by appropriate tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
api, authentication
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.