Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

using webflux in the controllers breaks mvc spring security SecurityFilterChain #486

Open
dev-wealthpilot opened this issue Nov 15, 2024 · 0 comments

Comments

@dev-wealthpilot
Copy link

Describe the bug
Some of the controllers return a ResponseEntity<Flux<...>> object. This makes the whole call asynchronous which then leads to the problem that the SecurityFilterChain loses the authentication information.
Normally this is mitigated by enabling @EnableWebFluxSecurity - but this breaks mvc applications.

To Reproduce
Steps to reproduce the behavior:

use mvc application and create SecurityFilterChain that requires login, then try to protect ff4j REST calls

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
        ...configure authentication 
        .authorizeHttpRequests(authorize -> authorize
                                        ...
                                        .requestMatchers("/api/ff4j/**").hasAuthority("ROLE_ADMIN")
                                        ...
                                        );

Expected behavior
when logged in with ROLE_ADMIN then access to /api/ff4j/** should be granted.
Actual behaviour is that access is always denied because of webflux usage in the ff4j rest apis

this worked in pre 2.x versions

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant