spring-projects / spring-projects/spring-security
Allow to provide a `ClientHttpRequestInterceptor` for the RestClient used by OAuth2 client
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
Allow to provide a ClientHttpRequestInterceptor for the RestClient used by OAuth2 client.
Current Behavior
Not possible to provide or set a ClientHttpRequestInterceptor.
Context
In the RestClient used by the Spring Security OAuth2 client I would like to provide a custom ClientHttpRequestInterceptor.
I solved it with a custom OAuth2AccessTokenResponseClient bean, but this requires to duplicate the internal AbstractRestClientOAuth2AccessTokenResponseClient to create the RestClient with the neccessary message converters and error repsonse handler.
@Bean
OAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> clientCredentialsTokenResponseClient(
LogbookClientHttpRequestInterceptor logbookInterceptor) {
// Copied from
// https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/AbstractRestClientOAuth2AccessTokenResponseClient.java#L65-L71
var restClient = RestClient.builder()
.configureMessageConverters(converters -> converters
.disableDefaults()
.addCustomConverter(new FormHttpMessageConverter())
.addCustomConverter(new OAuth2AccessTokenResponseHttpMessageConverter()))
// .messageConverters(converters -> {
// converters.clear();
// converters.add(new FormHttpMessageConverter());
// converters.add(new OAuth2AccessTokenResponseHttpMessageConverter());
// })
.defaultStatusHandler(new OAuth2ErrorResponseErrorHandler())
// Apply the logbook request interceptor.
.requestInterceptor(logbookInterceptor)
.build();
var client = new RestClientClientCredentialsTokenResponseClient();
client.setRestClient(restClient);
return client;
}
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/AbstractRestClientOAuth2AccessTokenResponseClient.java and review how its RestClient is built. Trace the RestClientClientCredentialsTokenResponseClient usage and existing configuration points; done means callers can provide a ClientHttpRequestInterceptor without duplicating the internal client setup or changing its message converters and error handling.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100