I saw that WebSecurityConfigurerAdapter was deprecated in Spring v2.7.0, and along side with it, the class HttpRequestResponseHolder, which was used in SecurityContextRepository.

After those changes, how can I respond to a request inside from a ;SecurityContextRepository(which was done previously by getting theresponse object from inside the request response holder)? I was using that to issue to clients a custom response when their token wasn't valid, or it was expired, etc.

I saw that WebSecurityConfigurerAdapter was deprecated in Spring v2.7.0, and along side with it, the class HttpRequestResponseHolder, which was used in SecurityContextRepository.

After those changes, how can I respond to a request inside from a SecurityContextRepository (which was done previously by getting the response object from inside the request response holder)? I was using that to issue to clients a custom response when their token wasn't valid, or it was expired, etc.

I saw that WebSecurityConfigurerAdapter was deprecated in Spring v2.7.0, and along side with it, the class HttpRequestResponseHolder , which was used in SecurityContextRepository.

After those changes, how can I respond to a request inside from a SecurityContextRepository (which was done previously by getting the response object from inside the request response holder)? I was using that to issue to clients a custom response when their token wasn't valid, or it was expired, etc.

I saw that WebSecurityConfigurerAdapter was deprecated in Spring v2.7.0, and along side with it, the class HttpRequestResponseHolder , which was used in SecurityContextRepository.

After those changes, how can I respond to a request inside from a SecurityContextRepository (which was done previously by getting the response object from inside the request response holder)? I was using that to issue to clients a custom response when their token wasn't valid, or it was expired, etc.

Hello! I would like to avoid leaving a form login session open after an OAuth2 authorization code (spring-authorization-server) has been issued. Can I somehow hook into the /oauth2/authorize endpoint before it redirects back to the resource server and delete the session?

And is there a way to make this work with stateless session management? I’ve toyed with CookieRequestCache to keep track of where to go next, but I think I would need to call or do some sort of internal redirect back to spring-authorization-server within an authentication success handler so as to not lose track of the authentication?

So the chain would be:

GET /oauth2/authorize -> redirect to /login
GET /login
POST /login -> redirect to callback

rather than what's currently happening:

GET /oauth2/authorize -> redirect to /login)
GET /login
POST /login -> redirect to /oauth2/authorize (authentication lost)
GET /oauth2/authorize -> 401 (callback never happens)

Any pointers would be much appreciated :).

Hello! I would like to avoid leaving a form login session open after an OAuth2 authorization code (spring-authorization-server) has been issued. Can I somehow hook into the /oauth2/authorize endpoint before it redirects back to the resource server and delete the session?

And is there a way to make this work with stateless session management? I’ve toyed with CookieRequestCache to keep track of where to go next, but I think I would need to call or do some sort of internal redirect back to spring-authorization-server within an authentication success handler so as to not lose track of the authentication?

So the chain would be:

GET /oauth2/authorize -> redirect to /login
GET /login
POST /login -> redirect to callback

rather than what's currently happening:

GET /oauth2/authorize -> redirect to /login)
GET /login
POST /login -> redirect to /oauth2/authorize (authentication lost)
GET /oauth2/authorize -> 401 (callback never happens)

Any pointers would be much appreciated :).

In reply to @sjohnr-621e97856da0373984914e8a:gitter.im
I believe you'll want to be using Spring Boot 2.7.0 to upgrade to the latest version of Spring Security.