spring-security-oauth2

Can / should I refresh an OAuth2 token with every request in spring security

家住魔仙堡 提交于 2019-12-05 01:22:16
问题 We use the username-password grant to connect our JS client to our REST server. In a way the token returned by oauth/token is our session, as it allows access to the backend for a limited time. We would like to refresh that session/token every time we make a request to the backend using the token. I know there is this refresh token issued by the server and I could use it to refresh my token after it has expired. The thing is: I don't want to make it the client responsiblity to catch token

Unsupported Media Type in postman

你。 提交于 2019-12-05 01:20:19
I am implementing spring security with oauth2 and jwt. the below is my login function function doLogin(loginData) { $.ajax({ url : back+"/auth/secret", type : "POST", data : JSON.stringify(loginData), contentType : "application/json; charset=utf-8", dataType : "json", async : false, success : function(data, textStatus, jqXHR) { setJwtToken(data.token); }, error : function(jqXHR, textStatus, errorThrown) { alert("an unexpected error occured: " + errorThrown); window.location.href= back+'/login_page.html'; } }); } And down I have the Controller @RequestMapping(value = "auth/secret", method =

Authorization header not passed by ZuulProxy starting with Brixton.RC1

我与影子孤独终老i 提交于 2019-12-04 20:07:30
问题 In switching from Spring Cloud Brixton.M5 to Brixton.RC1 my ZuulProxy no longer passes Authorization headers downstream to my proxied services. There's various actors in play in my setup, but most all of them are fairly simple: - AuthorizationServer: runs separately; hands out JWTs to clients - Clients: get JWTs from OAuth server; each with access to a subset of resources. - ResourceServers: consume JWTs for access decisions - MyZuulProxy: proxies various resource servers; should relay JWTs.

CSRF issue with Spring + Angular 2 + Oauth2 + CORS

安稳与你 提交于 2019-12-04 17:56:35
问题 I am developing a client-server application based on Spring 4.3 and Angular (TypeScript) 4.3, in a CORS scenario where, in production, server and client are on different domains. Client ask for REST server APIs via http requests. 1. REST AND OAUTH CONFIGURATION: The server exposes REST APIs: @RestController @RequestMapping("/my-api") public class MyRestController{ @RequestMapping(value = "/test", method = RequestMethod.POST) public ResponseEntity<Boolean> test() { return new ResponseEntity

Using WebSecurityConfigurerAdapter with Spring OAuth2 and user-info-uri

点点圈 提交于 2019-12-04 16:57:50
I have created an Authorization service as follows @SpringBootApplication @EnableAuthorizationServer public class AuthorizationApplication { ... } With this application.properties . server.port=9000 security.oauth2.client.client-id=monederobingo security.oauth2.client.client-secret=monederobingosecret security.oauth2.client.authorized-grant-types=authorization_code,refresh_token,password,client_credentials security.oauth2.client.scope=company,client Then, in a separate spring boot project I have created a Resource Server. @SpringBootApplication @EnableResourceServer public class App { ... }

Spring @FeignClient , OAuth2 and @Scheduled not working

旧街凉风 提交于 2019-12-04 16:52:21
Added OAuth2FeignRequestInterceptor to handle OAuth2 @FeignClient request and I'm now seeing the following exception: *org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'scopedTarget.oauth2ClientContext': Scope 'session' is not active for the current thread; consider defining a scoped proxy for this bean if you intend to refer to it from a singleton; nested exception is java.lang.IllegalStateException: No thread-bound request found: Are you referring to request attributes outside of an actual web request, or processing a request outside of the originally

How to inject WebResponseExceptionTranslator in TokenEndPoint Spring oAuth2

蹲街弑〆低调 提交于 2019-12-04 16:33:29
I am trying to customize the way the Spring Security oAuth TokenEndpoint class handles exceptions. I want to return a more customized JSON response than the DefaultWebResponseExceptionTranslator currently does. I cannot figure out how to inject a custom Translator via XML. Here are my code snippets: spring-security.xml <oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices" user-approval-handler-ref="userApprovalHandler" request-validator-ref="requestValidator" > <oauth:client-credentials /> <oauth:password /> </oauth:authorization-server> Here

Implementing authentication and authorization using Zuul Proxy, Oauth2 on REST Microservices

喜夏-厌秋 提交于 2019-12-04 14:32:41
问题 I am trying to implement the above architecture in the workflow with Spring Boot. Web client makes a request to Resource Server (Microservices Endpoints) through Zuul Proxy. Zuul Proxy redirects to oauth2 server for authentication. Oauth2 redirects to Zuul Proxy if the request is authenticated or not. If not authenticated, Zuul redirects Web client with an unauthenticated response. If Authenticated, Zull proxy redirects to the requested microservice endpoint. Microservice endpoint checks if

RestAssured oAuth2 http status code 401

最后都变了- 提交于 2019-12-04 13:46:37
I'm trying to implement integration test using RestAssured library and Spring MVC REST oAuth2 secured endpoint. This is my test: @Test public void testCreateDecision() throws Exception { File createDecisionJsonFile = ResourceUtils.getFile(getClass().getResource("/json/decisions/create-decision.json")); // @formatter:off final String createDecisionRequest = FileUtils.readFileToString(createDecisionJsonFile) .replace("{{name}}", "Test decision name") .replace("{{description}}", "Test decision description"); // @formatter:on String accessToken = getAccessToken("user", "user"); // @formatter:off

Spring OAuth2 JDBCTokenStore performance and database schema

扶醉桌前 提交于 2019-12-04 12:48:26
I use MySQL5.5 + REST(Jersey) + Spring Security + Spring OAuth2. Right now I'm doing performance testing and noticed that org.springframework.security.oauth2.provider.token.store.JdbcTokenStore.readAuthentication method is working really slow.. especialy this part of the method: authentication = jdbcTemplate.queryForObject(selectAccessTokenAuthenticationSql, new RowMapper<OAuth2Authentication>() { public OAuth2Authentication mapRow(ResultSet rs, int rowNum) throws SQLException { return deserializeAuthentication(rs.getBytes(2)); } }, extractTokenKey(token)); In order to improve performance I'm