Closed glennvdv closed 6 months ago
@glennvdv thanks for reaching out with your detailed dependencies and configuration.
Configuring a refresh-token client manager is a default not only for spring-cloud-gateway auto-configuration: spring-boot-starter-oauth2-client does it and it was intended that PerRegistrationReactiveOAuth2AuthorizedClientProvider
does it too (but it was poorly implemented).
So yes, this is a bug and I think I spotted it: around line 50, the new RefreshTokenReactiveOAuth2AuthorizedClientProvider()
should be added at the same time the authorization-code one is added (at least if offline_access
scope is present).
Maybe, all the providers should be added in case some new client registrations are added at runtime. Let's say we have only client-credentials registrations at configuration time and add registrations with authorization-code after the app started. With current logic, the client-providers for authorization-code and refresh-token won't be registered and things will go very bad.
Will fix soon (probably within the next 24h).
@glennvdv This should be fixed in 7.5.3
which is available from maven central already.
Would you please confirm and close?
fix confirmed
Describe the bug I have spring cloud gateway + addons in my configuration. I notice that my token is not refreshed before sending it downstream. I debugged and found out that the default GatewayReactiveOAuth2AutoConfiguration is not used (which has token refresh enabled), because a bean of type PerRegistrationReactiveOAuth2AuthorizedClientProvider is configured. This last one lacks the refresh ability.
I'm i missing a configuration or is this indeed a bug? dependencies
application,yaml