spring-projects / spring-projects/spring-security

Allow to provide a `ClientHttpRequestInterceptor` for the RestClient used by OAuth2 client

Open
#19,417 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Expected Behavior

Allow to provide a ClientHttpRequestInterceptor for the RestClient used by OAuth2 client.

Current Behavior

Not possible to provide or set a ClientHttpRequestInterceptor.

Context

In the RestClient used by the Spring Security OAuth2 client I would like to provide a custom ClientHttpRequestInterceptor.

I solved it with a custom OAuth2AccessTokenResponseClient bean, but this requires to duplicate the internal AbstractRestClientOAuth2AccessTokenResponseClient to create the RestClient with the neccessary message converters and error repsonse handler.

    @Bean
    OAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> clientCredentialsTokenResponseClient(
            LogbookClientHttpRequestInterceptor logbookInterceptor) {

        // Copied from
        // https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/AbstractRestClientOAuth2AccessTokenResponseClient.java#L65-L71
        var restClient = RestClient.builder()
                .configureMessageConverters(converters -> converters
                        .disableDefaults()
                        .addCustomConverter(new FormHttpMessageConverter())
                        .addCustomConverter(new OAuth2AccessTokenResponseHttpMessageConverter()))
                //                .messageConverters(converters -> {
                //                    converters.clear();
                //                    converters.add(new FormHttpMessageConverter());
                //                    converters.add(new OAuth2AccessTokenResponseHttpMessageConverter());
                //                })
                .defaultStatusHandler(new OAuth2ErrorResponseErrorHandler())
                // Apply the logbook request interceptor.
                .requestInterceptor(logbookInterceptor)
                .build();

        var client = new RestClientClientCredentialsTokenResponseClient();
        client.setRestClient(restClient);

        return client;
    }

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/AbstractRestClientOAuth2AccessTokenResponseClient.java and review how its RestClient is built. Trace the RestClientClientCredentialsTokenResponseClient usage and existing configuration points; done means callers can provide a ClientHttpRequestInterceptor without duplicating the internal client setup or changing its message converters and error handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.