search

spring-projects / spring-security

Spring Security
http://spring.io/projects/spring-security
Apache License 2.0
8.55k stars 5.79k forks source link

Consider configuring `OAuth2AuthorizationRequestResolver` by publishing a bean #15236

Closed sjohnr closed 1 week ago

sjohnr commented 1 week ago

We should consider adding support for configuring OAuth2AuthorizationRequestResolver by publishing a bean. This would simplify this customization and allow for the following configuration:

@Bean
public OAuth2AuthorizationRequestResolver authorizationRequestResolver(
        ClientRegistrationRepository clientRegistrationRepository) {

    var authorizationRequestResolver =
        new DefaultOAuth2AuthorizationRequestResolver(
            clientRegistrationRepository,
            OAuth2AuthorizationRequestRedirectFilter.DEFAULT_AUTHORIZATION_REQUEST_BASE_URI);
    authorizationRequestResolver.setAuthorizationRequestCustomizer(
        OAuth2AuthorizationRequestCustomizers.withPkce());

    return authorizationRequestResolver;
}

The same would apply with the reactive stack and ServerOAuth2AuthorizationRequestResolver. See this comment for additional context. cc @randomstuff