spring-projects / spring-projects/spring-security
OAuth2 Authorization Code redirect not working when using webflux.base-path
Open
@parikshitdutta is already working on this.
Since Apr 19, 2021.
in: oauth2
type: bug
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
I am running spring-boot 2.3.1 with spring-boot-starter-oauth2-client, after adding a context-path, everything breaks
To Reproduce
I have the following configuration
@Bean
SecurityWebFilterChain securityFilter(ServerHttpSecurity http) {
var logoutHandler = new OidcClientInitiatedServerLogoutSuccessHandler(repository);
logoutHandler.setPostLogoutRedirectUri("{baseUrl}");
var authenticationEntryPoint = new RedirectServerAuthenticationEntryPoint("/oauth2/authorization/keycloak");
http.authorizeExchange(exchange
-> exchange.matchers(PathRequest.toStaticResources().atCommonLocations()).permitAll() //
.anyExchange().authenticated()) //
.logout(logout -> logout.logoutSuccessHandler(logoutHandler) //
.requiresLogout(new PathPatternParserServerWebExchangeMatcher("/logout"))) //
.oauth2Login(Customizer.withDefaults()) //
.oauth2ResourceServer(oauth2ResourceServer -> oauth2ResourceServer.jwt())
.exceptionHandling(exception -> exception.authenticationEntryPoint(authenticationEntryPoint));
return http.build();
}
And my yaml has the following
spring:
webflux:
base-path: /path # Breaks once this is added
security:
oauth2:
resourceserver:
jwt:
issuer-uri: http://keycloak/auth/realms/app
client:
registration:
keycloak:
client-id: client
client-secret: ea898a70-84f2-408f-9d79-ab6e9eab0aa4
provider:
keycloak:
issuer-uri: http://keycloak/auth/realms/app
Looking at the browser network tab, the final request looks like this
Request URL: http://localhost:8082/path/login/oauth2/code/keycloak?state=KCmpLGwuYQnwEc-mufrJ15LJX8D7LVQsesdDOuDO4Aw%3D&session_state=4a79ae1f-d587-4131-b972-9c740e94cd29&code=03ddb325-11ac-48ff-80b4-5fa97dd72e45.4a79ae1f-d587-4131-b972-9c740e94cd29.6145d626-fbb2-4a78-a04b-977fc60223f2
Request Method: GET
Status Code: 302 Found
Remote Address: 127.0.0.1:8082
Referrer Policy: no-referrer-when-downgrade
HTTP/1.1 302 Found
Location: # location is blank
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1 ; mode=block
Referrer-Policy: no-referrer
Set-Cookie: SESSION=74b437e4-a788-481c-918e-faab6e3da29d; Path=/path/; HttpOnly; SameSite=Lax
content-length: 0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: keep-alive
Cookie: SESSION=055f12b8-3f4c-4be6-95c3-b8126f733086; SESSION=200328fd-c13e-4887-91c1-d6846a5eae92
Host: localhost:8082
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36
Expected behavior
Application should redirect me to initially requested page
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.