Skip to content

RequestCacheSpec not used on RedirectServerAuthenticationEntryPoint for OAuth2LoginSpec.configure #7721

Closed
@sdoxsee

Description

@sdoxsee

Summary

The RequestCache set in the RequestCacheSpec is not used on RedirectServerAuthenticationEntryPoint for OAuth2LoginSpec.configure

Actual Behavior

From ServerHttpSecurity

public class OAuth2LoginSpec {

        //...

	protected void configure(ServerHttpSecurity http) {

                //...

		oauthRedirectFilter.setRequestCache(http.requestCache.requestCache);

                //...

		MediaTypeServerWebExchangeMatcher htmlMatcher = new MediaTypeServerWebExchangeMatcher(
				MediaType.TEXT_HTML);
		htmlMatcher.setIgnoredMediaTypes(Collections.singleton(MediaType.ALL));
		Map<String, String> urlToText = http.oauth2Login.getLinks();
		if (urlToText.size() == 1) {
			http.defaultEntryPoints.add(new DelegateEntry(htmlMatcher, new RedirectServerAuthenticationEntryPoint(urlToText.keySet().iterator().next())));
		} else {
			http.defaultEntryPoints.add(new DelegateEntry(htmlMatcher, new RedirectServerAuthenticationEntryPoint("/login")));
		}

		http.addFilterAt(oauthRedirectFilter, SecurityWebFiltersOrder.HTTP_BASIC);
		http.addFilterAt(authenticationFilter, SecurityWebFiltersOrder.AUTHENTICATION);
	}

RedirectServerAuthenticationEntryPoint's RequestCache remains the default WebSessionServerRequestCache rather than the one set on the RequestCacheSpec for ServerHttpSecurity

Expected Behavior

I would think that RedirectServerAuthenticationEntryPoint should use the RequestCacheSpec's RequestCache

Configuration

See sample below

Version

Spring Security 5.2.1

Sample

See README and sample code on https://github.com/sdoxsee/gateway-sample

Metadata

Metadata

Assignees

Labels

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)status: backportedAn issue that has been backported to maintenance branchestype: bugA general bug

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions