Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Change default order of OAuth2 resource server filter chain

Browse Source 
The default is now SecurityProperties.ACCESS_OVERRIDE_ORDER-1
(instead of 3), and the user can set it with
security.oauth2.resource.filter-order (as opposed to being hard
coded). The filter is provided by Spring OAuth2 so this change is
a BeanPostProcessor to call a setter on that object.

Fixes gh-5072
This commit is contained in:
Dave Syer
2017-01-05 11:52:43 +00:00
parent ad4a53e366
commit fe344df9c5
11 changed files with 272 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc
View File

@@ -2528,6 +2528,10 @@ WARNING: If you use the `security.oauth2.resource.jwt.key-uri` the authorization
needs to be running when your application starts up. It will log a warning if it can't
find the key, and tell you what to do to fix it.
OAuth2 resources are protected by a filter chain with order
`security.oauth2.resource.filter-order` and the default is after the
filter protecting the actuator endpoints by default (so actuator
endpoints will stay on HTTP Basic unless you change the order).
[[boot-features-security-oauth2-token-type]]