OAuth2AuthorizationRequestRedirectFilter redirect should support Ajax request

[rigofunc]

Summary

I need OAuth2AuthorizationRequestRedirectFilter redirect to support Ajax request

Background

I before using spring-security-oauth2 jar, I can provide custom RedirectStrategy to support Ajax request. Currently, I update my code to using spring-security-oauth2-client, one issue is the OAuth2AuthorizationRequestRedirectFilter cannot custom RedirectStrategy, private final RedirectStrategy authorizationRedirectStrategy = new DefaultRedirectStrategy();

Version

5.1.4.RELEASE

[jgrandja]

@xyting Please provide more information as I don't quite understand what you are trying to achieve. NOTE: Exposing the authorizationRedirectStrategy will not necessarily be the right solution for you.

Please provide detailed information on the oauth client you need to configure and the flow / use case you are trying to acheive.

[rigofunc]

@jgrandja Thanks your reply!

Static Resouces, such as SPA, hosted in Nginx

Loading Data by AJAX Request

Because all the data loading by AJAX request, and then Nginx request RESTful API servers to get data, RESTful API using Spring Security, it will redirect the end user to CAS, but the AJAX cannot handle the 302 respone

[jgrandja]

@xyting Diagrams do not provide the detailed information that I need to help you troubleshoot. In the future, it would be very helpful if you could provide a complete and minimal sample that reproduces the issue and share it via a GitHub repository. This will allow us to efficiently troubleshoot and help resolve the issue. The sample should contain the minimum amount of code to reproduce the issue along with detailed steps on how to reproduce.

Having said that, the main purpose of the OAuth2AuthorizationRequestRedirectFilter is to create the Authorization Request and redirect the user-agent to the Authorization Server for authorization. Please review the Authorization Code Grant as per spec for these details.

I'm going to close this issue as OAuth2AuthorizationRequestRedirectFilter is working as designed.

[rigofunc]

Recently, I read the source code. I know what you say. However, if have an Nginx between User-Agent and backend Spring Security server, many cases, such as Authorization Code Grant get the redirect url will be wrong.

[jgrandja]

@xyting

if have an Nginx between User-Agent and backend Spring Security server, many cases, such as Authorization Code Grant get the redirect url will be wrong

This seems to be a separate issue? Please keep issues separate going forward. Looks like you need to configure the ForwardedHeaderFilter. Here is the Spring Security reference and Spring Boot reference.

[rigofunc]

@jgrandja Thanks!

[simpleway]

@jgrandja I bump into the same issue as @xyting I did not use customized RedirectStrategy, but use google OpenIDC IdP with OAuth2Login Sample.

After tracing the code a little bit, and found the request matcher logic in OAuth2LoginConfigurer might contribute to this behavior:

		RequestMatcher loginPageMatcher = new AntPathRequestMatcher(this.getLoginPage());
		RequestMatcher faviconMatcher = new AntPathRequestMatcher("/favicon.ico");
		RequestMatcher defaultEntryPointMatcher = this.getAuthenticationEntryPointMatcher(http);
		RequestMatcher defaultLoginPageMatcher = new AndRequestMatcher(
				new OrRequestMatcher(loginPageMatcher, faviconMatcher), defaultEntryPointMatcher);

		LinkedHashMap<RequestMatcher, AuthenticationEntryPoint> entryPoints = new LinkedHashMap<>();
		entryPoints.put(new NegatedRequestMatcher(defaultLoginPageMatcher),
				new LoginUrlAuthenticationEntryPoint(providerLoginPage));

		DelegatingAuthenticationEntryPoint loginEntryPoint = new DelegatingAuthenticationEntryPoint(entryPoints);

The defaultEntryPointMatcher will filter out XMLHttpRequest. Should the entryPoints be something like

entryPoints.put(new OrRequestMatcher(new NegatedRequestMatcher(defaultLoginPageMatcher), defaultEntryPointMatcher),
				new LoginUrlAuthenticationEntryPoint(providerLoginPage));

Then the AJAX call to data will simply got 401 instead of a redirect, which the browser will block since it will be a cross domain redirect.

[rigofunc]

@simpleway

Then the AJAX call to data will simply got 401 instead of a redirect, which the browser will block since it will be a cross domain redirect.

maybe as following will be better:

1. http status: 401;
2. custom header, such as redirectUrl = redirect url