spring-projects / spring-projects/spring-security

OAuth2Login behaves differently in MVC and Reactive

Open
#16,941 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

in: oauth2 type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Expected Behavior

When switching between MVC and Reactive variants, the behavior of the oauth2login should likely be the same, when using token relay with Spring Cloud Gateway.

Current Behavior

the DefaultOAuth2AuthorizationRequestResolver doesn't alter the defaultAction when the client grant is authorization code, the reactive stack changes the action urimap variable.
Context
https://github.com/spring-projects/spring-security/blob/62c5a25d5e713a7631d80eec266170eecc490fbd/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/server/DefaultServerOAuth2AuthorizationRequestResolver.java#L253-L255

so when I'm using my tokenRelay in reactive spring cloud gateway, everything works as expected, but when working with MVC, the generated url, which starts here
https://github.com/spring-projects/spring-security/blob/62c5a25d5e713a7631d80eec266170eecc490fbd/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/DefaultOAuth2AuthorizationRequestResolver.java#L120

generates an "invalid" URL, because the code doesn't interfere:
https://github.com/spring-projects/spring-security/blob/62c5a25d5e713a7631d80eec266170eecc490fbd/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/DefaultOAuth2AuthorizationRequestResolver.java#L250

when calling "authorize" signature generates this url:
/authorize/oauth2/code/{registrationId}......
while calling "login" generates a "valid" one:
/login/oauth2/code/{registrationId}....

*of course modifying manually the redirect-uri of the client solves the issue, but would be nice if the behavior is coherent in both technologies

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing DefaultOAuth2AuthorizationRequestResolver.java around lines 120 and 250 with DefaultServerOAuth2AuthorizationRequestResolver.java around lines 253-255. Trace how the MVC authorize and login paths construct their redirect URIs, then verify that MVC OAuth2 login and reactive OAuth2 login produce coherent valid URLs without manually changing the client redirect URI.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.