Skip to content

JwtIssuerAuthenticationManagerResolver should not resolve the bearer token #9186

Closed
@jzheaux

Description

@jzheaux

Current Behavior

Each of JwtIssuerAuthenticationManagerResolver and JwtIssuerReactiveAuthenticationManagerResolver uses either BearerTokenResolver or ServerBearerTokenAuthenticationConverter, respectfully, to resolve the bearer token from the HttpServletRequest or ServerWebExchange.

This has the downsides that, first, the bearer token is resolved from the request multiple times - once by BearerTokenAuthenticationFilter and again by the resolver - and second, it creates the need to expose the BearerTokenResolver when it is being customized in other places in the application.

Expected Behavior

Since JwtIssuerAuthenticationManagerResolver's role is to resolve an AuthenticationManager, it should just return an AuthenticationManager that reads the already-resolved token from a BearerTokenAuthenticationToken.

The same is true for JwtIssuerReactiveAuthenticationManagerResolver.

Making this change will make these authentication manager resolvers more widely usable since it will remove their dependency on BearerTokenResolver and ServerBearerTokenAuthenticationConverter.

Metadata

Metadata

Assignees

Labels

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)type: enhancementA general enhancement

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions