Closed
Description
Summary
The RequestCache
set in the RequestCacheSpec is not used on RedirectServerAuthenticationEntryPoint for OAuth2LoginSpec.configure
Actual Behavior
From ServerHttpSecurity
public class OAuth2LoginSpec {
//...
protected void configure(ServerHttpSecurity http) {
//...
oauthRedirectFilter.setRequestCache(http.requestCache.requestCache);
//...
MediaTypeServerWebExchangeMatcher htmlMatcher = new MediaTypeServerWebExchangeMatcher(
MediaType.TEXT_HTML);
htmlMatcher.setIgnoredMediaTypes(Collections.singleton(MediaType.ALL));
Map<String, String> urlToText = http.oauth2Login.getLinks();
if (urlToText.size() == 1) {
http.defaultEntryPoints.add(new DelegateEntry(htmlMatcher, new RedirectServerAuthenticationEntryPoint(urlToText.keySet().iterator().next())));
} else {
http.defaultEntryPoints.add(new DelegateEntry(htmlMatcher, new RedirectServerAuthenticationEntryPoint("/login")));
}
http.addFilterAt(oauthRedirectFilter, SecurityWebFiltersOrder.HTTP_BASIC);
http.addFilterAt(authenticationFilter, SecurityWebFiltersOrder.AUTHENTICATION);
}
RedirectServerAuthenticationEntryPoint
's RequestCache remains the default WebSessionServerRequestCache
rather than the one set on the RequestCacheSpec
for ServerHttpSecurity
Expected Behavior
I would think that RedirectServerAuthenticationEntryPoint
should use the RequestCacheSpec
's RequestCache
Configuration
See sample below
Version
Spring Security 5.2.1
Sample
See README and sample code on https://github.com/sdoxsee/gateway-sample