GrpcClientRegistry was responsible for both, which causes lifecycle
issues when users don't follow recommendations. This change
pushes the bean registration firmly down a level into an
ImportBeanDefinitionRegistrar. Also helps with AOT because the AOT
processor only runs the IBDR at build time.
If the user has explicitly disabled CSRF protection in a custom
SecurityFilterChain, we should be able to back off and not try
to disable it just for the gRPC endpoints (accidentally switching
it back on for the other endpoints).
Fixes gh-142
In an app with servlets *and* a native gRPC server for instance,
the global AuthenticationManagerBuilder (the @Bean) should be
treated as a parent for the one used by GrpcSecurity. It's the
same in HttpSecurity. Slightly more complicated than necessary
when there is only native gRPC security, but at least it now
works, and makes it easier to introduce multiple GrpcSecurity
instances in future if necessary (like with HttpSecurity it
could be a prototype).
This adds a coarse-grained conditional guard that will disable the
server autoconfiguration if `spring.grpc.server.enabled` is set to
false or `BindableService` class is not available on the classpath.
Signed-off-by: Chris Bono <chris.bono@gmail.com>
This adds a coarse-grained conditional guard that will disable the
client autoconfiguration if `spring.grpc.client.enabled` is set to
false or the `io.grpc:grpc-stub` module is not on the classpath.
Signed-off-by: Chris Bono <chris.bono@gmail.com>
This adds a starter module that includes the Spring gRPC
core module and the grpc-stub dependency.
Also, makes the `grpc-stub` dependency optional in Spring
gRPC core module.
Signed-off-by: Chris Bono <chris.bono@gmail.com>
Currently the spring-grpc-core imposes an opinion on Netty.
The core module should not have an opinion, but rather the
starter enforces the opinion.
Also, makes spring-grpc-core optional in the autconfigure
module as the autoconfigure will eventually be moved into
Spring Boot and at that time everything is optional.
Signed-off-by: Chris Bono <chris.bono@gmail.com>
This renames the `spring.grpc.security.csrf.enabled` property
to `spring.grpc.server.security.csrf.enabled` to signal that
it is a server configuration property.
Signed-off-by: Chris Bono <chris.bono@gmail.com>
This removes the `@ConditionalOnProperty` guard that was in place to force a
native gRPC server to be used when the running application is a Reactive
based web application. This is not needed because a Reactive based web
application can not be used as Servlet gRPC server.
Signed-off-by: Chris Bono <chris.bono@gmail.com>
This adds the following entries to additional-spring-configuration-metadata.json:
- `spring.grpc.security.csrf.enabled`
- `spring.grpc.server.servlet.enabled`
They are not present in first class `@ConfigurationProperties` so need to be
manually added.
Signed-off-by: Chris Bono <chris.bono@gmail.com>
