Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add an option to customize ServerRedirectStrategy in the OAuth2AuthorizationRequestRedirectWebFilter #11373

Closed
igorbolic opened this issue Jun 15, 2022 · 4 comments
Closed

Add an option to customize ServerRedirectStrategy in the OAuth2AuthorizationRequestRedirectWebFilter #11373

igorbolic opened this issue Jun 15, 2022 · 4 comments
Assignees
@rwinch
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) status: duplicate A duplicate of another issue type: enhancement A general enhancement

Comments

@igorbolic
Copy link
Contributor

It would be nice to be able to customize the redirect strategy within OAuth2AuthorizationRequestRedirectWebFilter, so that we are able to return to the client e.g. HTTP Status 200 OK with redirect URL in the response payload, instead of the default behavior of HTTP Status 302 Found with Location header containing redirect URL.

Our FE is SPA and BE is Spring Boot application. The FE uses XMLHttpRequests client to retrieve the redirect URL from our BE service for the OAuth authorization flow.
The current OAuth2AuthorizationRequestRedirectWebFilter's response causes the FE client library to automatically follow Location URL.
Sending the response as HTTP Status 200 OK and having redirect URL as part of the payload via custom ServerRedirectStrategy, would allow us inform the FE client of the redirect URL and use the value to send the user to the OAuth providers page for authorization.

ATM we have a custom implementation of OAuth2AuthorizationRequestRedirectWebFilter, where we have changed only the ServerRedirectStrategy to achieve the above mentioned behavior.
@igorbolic igorbolic added status: waiting-for-triage An issue we've not yet triaged type: enhancement A general enhancement labels Jun 15, 2022
@rwinch rwinch added in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) and removed status: waiting-for-triage An issue we've not yet triaged labels Jun 15, 2022
@rwinch
Copy link
Member

rwinch commented Jun 15, 2022

Thanks for reaching out @igorbolic Would you be interested in submitting a pull request for this?

@igorbolic
Copy link
Contributor Author

Of course, I'll try to find some time this week... Thanks for quick reply 👍

@igorbolic igorbolic mentioned this issue Jun 17, 2022
Closed
@igorbolic
Copy link
Contributor Author

@rwinch I've created a PR #11387 to resolve this issue

igorbolic added a commit to igorbolic/spring-security that referenced this issue Jul 6, 2022
@igorbolic
Allow customization of redirect strategy
7c30285 
The default redirect strategy will provide authorization redirect
URI within HTTP 302 response Location header.
Allowing the configuration of custom redirect strategy will provide
an option for the clients to obtain the authorization URI from e.g.
HTTP response body as JSON payload, without a need to handle
automatic redirection initiated by the HTTP Location header.

Closes spring-projectsgh-11373
rwinch pushed a commit that referenced this issue Aug 8, 2022
@igorbolic @rwinch
Allow customization of redirect strategy
efaee4e 
The default redirect strategy will provide authorization redirect
URI within HTTP 302 response Location header.
Allowing the configuration of custom redirect strategy will provide
an option for the clients to obtain the authorization URI from e.g.
HTTP response body as JSON payload, without a need to handle
automatic redirection initiated by the HTTP Location header.

Closes gh-11373
@rwinch rwinch self-assigned this Aug 8, 2022
@rwinch rwinch added the status: duplicate A duplicate of another issue label Aug 8, 2022
@rwinch
Copy link
Member

rwinch commented Aug 8, 2022

Closing this as duplicate in favor of gh-11387

@rwinch rwinch closed this as completed Aug 8, 2022
rwinch pushed a commit that referenced this issue Aug 8, 2022
@igorbolic @rwinch
Allow customization of redirect strategy
2e66b9f 
The default redirect strategy will provide authorization redirect
URI within HTTP 302 response Location header.
Allowing the configuration of custom redirect strategy will provide
an option for the clients to obtain the authorization URI from e.g.
HTTP response body as JSON payload, without a need to handle
automatic redirection initiated by the HTTP Location header.

Closes gh-11373
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@rwinch rwinch

Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) status: duplicate A duplicate of another issue type: enhancement A general enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Allow customization of redirect strategy igorbolic/spring-security
2 participants
@rwinch @igorbolic