spring-projects / spring-projects/spring-security

Allow passing a "RestClient.Builder" as constructor argument for "RestClient*TokenResponseClient"

Open
#16,731 0 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

in: oauth2 type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Expected Behavior

Instantiating a RestClient*TokenResponseClient (e.g. RestClientTokenExchangeTokenResponseClient) should allow passing a RestClient.Builder as constructor argument, in order to use an instrumented HTTP client without having to duplicate code.
The current implementation uses RestClient.builder(), thus missing the instrumentation.

Ideally, I could write something like:

var tokenExchangeTokenResponseClient = new RestClientTokenExchangeTokenResponseClient(restClientBuilder);

Current Behavior

Using an instrumented HTTP client (managed by Spring Boot application) in RestClient*TokenResponseClient requires duplicating code, as in:

var restClient = restClientBuilder
    // this code comes from AbstractRestClientOAuth2AccessTokenResponseClient
    .messageConverters(messageConverters -> {
        messageConverters.clear();
        messageConverters.add(new FormHttpMessageConverter());
        messageConverters.add(new OAuth2AccessTokenResponseHttpMessageConverter());
    })
    .defaultStatusHandler(new OAuth2ErrorResponseErrorHandler())
    .build();

var tokenExchangeTokenResponseClient = new RestClientTokenExchangeTokenResponseClient();
tokenExchangeTokenResponseClient.setRestClient(restClient);

Context

Related issue for the reactive clients due to the use of WebClient.Builder(): https://github.com/spring-projects/spring-security/issues/14946.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating AbstractRestClientOAuth2AccessTokenResponseClient and the RestClient*TokenResponseClient classes, then inspect their constructors and current RestClient.builder() usage. Check the related reactive-client issue for context and existing tests. Done means the clients can receive a RestClient.Builder while retaining the required converters and error handler configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.