spring-projects / spring-projects/spring-security
Reactive Bearer Token request form POST support
Open
Nobody has claimed this yet.
in: oauth2
type: enhancement
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Add support for sending bearer token in the POST body.
Note that reading the request body would be a blocking operation, so this should likely be configured behind a flag of sorts as opposed to being default behavior.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with RFC 6750 section 2.2 and inspect Spring Security's existing reactive bearer-token request handling. Determine how POST-body token reading can be gated behind configuration, then verify that enabled handling accepts the token while default behavior avoids blocking body reads.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100