Summary
Please provide a way to inject specific RequestCache to the OAuth2AuthorizationCodeGrantFilter.
The "sister" filter OAuth2AuthorizationRequestRedirectFilter already has a #setRequestCache method for injecting specific RequestCache, but the OAuth2AuthorizationCodeGrantFilter uses a hardcoded HttpSessionRequestCache.
Reasoning
Current setup does not allow for easy customization of redirect scenarios after successful OAuth2 Code grant authorization flow.
Two workarounds exist to my knowledge:
- Use the
HttpSessionRequestCache with a specially crafted HttpServletRequestWrapper, such that the DefaultSavedRequest created from it in the HttpSessionRequestCache will return a desired redirect uri.
- Avoid saving the request via
RequestCache's interface, and store it directly in the session via
request.getSession().setAttribute(customSavedRequest, "SPRING_SECURITY_SAVED_REQUEST")
The first one is prone to breakage and complicated to do so, because the DefaultSavedRequest#getRedirectUrl() builds a URL from multiple fields, that have to be specifically overriden in the request wrapper.
The second workaround is slightly less complicated, but even more prone to breakage, as the session attribute name is not a public constant and can change anytime.
The addition of injectable RequestCache would make the OAuth2AuthorizationCodeGrantFilter on par with OAuth2AuthorizationRequestRedirectFilter.
Version
5.2.2
Summary
Please provide a way to inject specific
RequestCacheto theOAuth2AuthorizationCodeGrantFilter.The "sister" filter
OAuth2AuthorizationRequestRedirectFilteralready has a#setRequestCachemethod for injecting specificRequestCache, but theOAuth2AuthorizationCodeGrantFilteruses a hardcodedHttpSessionRequestCache.Reasoning
Current setup does not allow for easy customization of redirect scenarios after successful OAuth2 Code grant authorization flow.
Two workarounds exist to my knowledge:
HttpSessionRequestCachewith a specially craftedHttpServletRequestWrapper, such that theDefaultSavedRequestcreated from it in theHttpSessionRequestCachewill return a desired redirect uri.RequestCache's interface, and store it directly in the session viaThe first one is prone to breakage and complicated to do so, because the
DefaultSavedRequest#getRedirectUrl()builds a URL from multiple fields, that have to be specifically overriden in the request wrapper.The second workaround is slightly less complicated, but even more prone to breakage, as the session attribute name is not a public constant and can change anytime.
The addition of injectable
RequestCachewould make theOAuth2AuthorizationCodeGrantFilteron par withOAuth2AuthorizationRequestRedirectFilter.Version
5.2.2