spring-projects / spring-projects/spring-security

OAuth2 Authorization Code redirect not working when using webflux.base-path

Open
#8,967 10 comments 2 reactions 1 assignee View on GitHub

@parikshitdutta is already working on this.

Since Apr 19, 2021.

in: oauth2 type: bug
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Describe the bug
I am running spring-boot 2.3.1 with spring-boot-starter-oauth2-client, after adding a context-path, everything breaks

To Reproduce
I have the following configuration

@Bean
SecurityWebFilterChain securityFilter(ServerHttpSecurity http) {
    var logoutHandler = new OidcClientInitiatedServerLogoutSuccessHandler(repository);
    logoutHandler.setPostLogoutRedirectUri("{baseUrl}");
    var authenticationEntryPoint = new RedirectServerAuthenticationEntryPoint("/oauth2/authorization/keycloak");
    http.authorizeExchange(exchange 
           -> exchange.matchers(PathRequest.toStaticResources().atCommonLocations()).permitAll() //
        .anyExchange().authenticated()) //
        .logout(logout -> logout.logoutSuccessHandler(logoutHandler) //
        .requiresLogout(new PathPatternParserServerWebExchangeMatcher("/logout"))) //
        .oauth2Login(Customizer.withDefaults()) //
        .oauth2ResourceServer(oauth2ResourceServer -> oauth2ResourceServer.jwt())
        .exceptionHandling(exception -> exception.authenticationEntryPoint(authenticationEntryPoint));
    return http.build();
}

And my yaml has the following

spring:
  webflux:
    base-path: /path  # Breaks once this is added
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: http://keycloak/auth/realms/app
      client:
        registration:
          keycloak:
            client-id: client
            client-secret: ea898a70-84f2-408f-9d79-ab6e9eab0aa4
        provider:
          keycloak:
            issuer-uri: http://keycloak/auth/realms/app

Looking at the browser network tab, the final request looks like this

Request URL: http://localhost:8082/path/login/oauth2/code/keycloak?state=KCmpLGwuYQnwEc-mufrJ15LJX8D7LVQsesdDOuDO4Aw%3D&session_state=4a79ae1f-d587-4131-b972-9c740e94cd29&code=03ddb325-11ac-48ff-80b4-5fa97dd72e45.4a79ae1f-d587-4131-b972-9c740e94cd29.6145d626-fbb2-4a78-a04b-977fc60223f2
Request Method: GET
Status Code: 302 Found
Remote Address: 127.0.0.1:8082
Referrer Policy: no-referrer-when-downgrade

HTTP/1.1 302 Found
Location:  # location is blank
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1 ; mode=block
Referrer-Policy: no-referrer
Set-Cookie: SESSION=74b437e4-a788-481c-918e-faab6e3da29d; Path=/path/; HttpOnly; SameSite=Lax
content-length: 0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: keep-alive
Cookie: SESSION=055f12b8-3f4c-4be6-95c3-b8126f733086; SESSION=200328fd-c13e-4887-91c1-d6846a5eae92
Host: localhost:8082
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36

Expected behavior
Application should redirect me to initially requested page

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.