From 568d716c991da79824f72bf25bae3e09b5ee3a99 Mon Sep 17 00:00:00 2001 From: Dave Syer Date: Mon, 25 Apr 2016 16:44:43 +0100 Subject: [PATCH] Move OAuth2ClientContextFilter back before the main security filter It sometimes has to catch an exception from the security filter so it needs to be before, and somehow this hasn't been a problem up to now, but probably only by some fluke. Fixes gh-5792 --- .../oauth2/client/OAuth2RestOperationsConfiguration.java | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/client/OAuth2RestOperationsConfiguration.java b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/client/OAuth2RestOperationsConfiguration.java index a5c316972b..7f0b7ffabe 100644 --- a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/client/OAuth2RestOperationsConfiguration.java +++ b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/client/OAuth2RestOperationsConfiguration.java @@ -26,6 +26,7 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean import org.springframework.boot.autoconfigure.condition.ConditionalOnNotWebApplication; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; import org.springframework.boot.autoconfigure.condition.SpringBootCondition; +import org.springframework.boot.autoconfigure.security.SecurityProperties; import org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2RestOperationsConfiguration.OAuth2ClientIdCondition; import org.springframework.boot.bind.RelaxedPropertyResolver; import org.springframework.boot.context.embedded.FilterRegistrationBean; @@ -116,10 +117,10 @@ public class OAuth2RestOperationsConfiguration { @Bean public FilterRegistrationBean oauth2ClientFilterRegistration( - OAuth2ClientContextFilter filter) { + OAuth2ClientContextFilter filter, SecurityProperties security) { FilterRegistrationBean registration = new FilterRegistrationBean(); registration.setFilter(filter); - registration.setOrder(-100); + registration.setOrder(security.getFilterOrder() - 10); return registration; }