spring-projects / spring-projects/spring-security
WebFluxSecurityConfiguration prevents access to WEB_FILTER_CHAIN_FILTER_ORDER
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
The issue https://github.com/spring-projects/spring-security/issues/4475 introduced the WEB_FILTER_CHAIN_FILTER_ORDER constant with public static visibility to org.springframework.security.config.annotation.web.reactive.WebFluxSecurityConfiguration.
The problem is that the WebFluxSecurityConfiguration class itself is package visible, so that this constant cannot be accessed from other user-defined Filter beans.
Besides that:
With org.springframework.boot.autoconfigure.security.SecurityProperties.DEFAULT_FILTER_ORDER a similar constant already exists, why is there a separate constant for the reactive WebFlux security configuration?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting org.springframework.security.config.annotation.web.reactive.WebFluxSecurityConfiguration and its WEB_FILTER_CHAIN_FILTER_ORDER visibility. Compare that constant with org.springframework.boot.autoconfigure.security.SecurityProperties.DEFAULT_FILTER_ORDER to establish whether the reactive constant should be exposed or removed. Done means the intended public API and any required compatibility or test changes are clear.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100