Josh Cummings
0f6f453ea0
NimbusJwtDecoder's default RestOperations now respects the JDK's sun.net.client.defaultConnectTimeout/defaultReadTimeout system properties, falling back to 30 seconds instead of the previous 500 milliseconds, matching JwtDecoderProviderConfigurationUtils's existing behavior. Also documents this default and the RestOperations override in the reference guide and migration guide (the reference guide's existing "Configuring Timeouts" section already claimed 30 seconds -- it's been inaccurate since the 500ms default shipped and is now correct again), and documents providing a custom JwtDecoderFactory<ClientRegistration> for OAuth2 Login's ID Token decoding. Issue gh-19474 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
143 lines
4.9 KiB
Plaintext
143 lines
4.9 KiB
Plaintext
= OAuth 2.0 Migrations
|
|
|
|
== Validate `typ` Header with `JwtTypeValidator`
|
|
|
|
If when following the 6.5 preparatory steps you set `validateTypes` to `false`, you can now remove it.
|
|
You can also remove explicitly adding `JwtTypeValidator` to the list of defaults.
|
|
|
|
For example, change this:
|
|
|
|
[tabs]
|
|
======
|
|
Java::
|
|
+
|
|
[source,java,role="primary"]
|
|
----
|
|
@Bean
|
|
JwtDecoder jwtDecoder() {
|
|
NimbusJwtDecoder jwtDecoder = NimbusJwtDecoder.withIssuerLocation(location)
|
|
.validateTypes(false) <1>
|
|
// ... your remaining configuration
|
|
.build();
|
|
jwtDecoder.setJwtValidator(JwtValidators.createDefaultWithValidators(
|
|
new JwtIssuerValidator(location), JwtTypeValidator.jwt())); <2>
|
|
return jwtDecoder;
|
|
}
|
|
----
|
|
|
|
Kotlin::
|
|
+
|
|
[source,kotlin,role="secondary"]
|
|
----
|
|
@Bean
|
|
fun jwtDecoder(): JwtDecoder {
|
|
val jwtDecoder = NimbusJwtDecoder.withIssuerLocation(location)
|
|
.validateTypes(false) <1>
|
|
// ... your remaining configuration
|
|
.build()
|
|
jwtDecoder.setJwtValidator(JwtValidators.createDefaultWithValidators(
|
|
JwtIssuerValidator(location), JwtTypeValidator.jwt())) <2>
|
|
return jwtDecoder
|
|
}
|
|
----
|
|
======
|
|
<1> - Switch off Nimbus verifying the `typ`
|
|
<2> - Add the default `typ` validator
|
|
|
|
to this:
|
|
|
|
[tabs]
|
|
======
|
|
Java::
|
|
+
|
|
[source,java,role="primary"]
|
|
----
|
|
@Bean
|
|
JwtDecoder jwtDecoder() {
|
|
NimbusJwtDecoder jwtDecoder = NimbusJwtDecoder.withIssuerLocation(location)
|
|
// ... your remaining configuration <1>
|
|
.build();
|
|
jwtDecoder.setJwtValidator(JwtValidators.createDefaultWithIssuer(location)); <2>
|
|
return jwtDecoder;
|
|
}
|
|
----
|
|
|
|
Kotlin::
|
|
+
|
|
[source,kotlin,role="secondary"]
|
|
----
|
|
@Bean
|
|
fun jwtDecoder(): JwtDecoder {
|
|
val jwtDecoder = NimbusJwtDecoder.withIssuerLocation(location)
|
|
// ... your remaining configuration
|
|
.build()
|
|
jwtDecoder.setJwtValidator(JwtValidators.createDefaultWithIssuer(location)) <2>
|
|
return jwtDecoder
|
|
}
|
|
----
|
|
======
|
|
<1> - `validateTypes` now defaults to `false`
|
|
<2> - `JwtTypeValidator#jwt` is added by all `createDefaultXXX` methods
|
|
|
|
== Provide an AuthenticationConverter to BearerTokenAuthenticationFilter
|
|
|
|
In Spring Security 7, `BearerTokenAuthenticationFilter#setBearerTokenResolver` and `#setAuthenticaionDetailsSource` are deprecated in favor of configuring those on `BearerTokenAuthenticationConverter`.
|
|
|
|
The `oauth2ResourceServer` DSL addresses most use cases and you need to nothing.
|
|
|
|
If you are setting a `BearerTokenResolver` or `AuthenticationDetailsSource` directly on `BearerTokenAuthenticationFilter` similar to the following:
|
|
|
|
[tabs]
|
|
======
|
|
Java::
|
|
+
|
|
[source,java,role="primary"]
|
|
----
|
|
BearerTokenAuthenticationFilter filter = new BearerTokenAuthenticationFilter(authenticationManager);
|
|
filter.setBearerTokenResolver(myBearerTokenResolver);
|
|
filter.setAuthenticationDetailsSource(myAuthenticationDetailsSource);
|
|
----
|
|
|
|
Kotlin::
|
|
+
|
|
[source,kotlin,role="secondary"]
|
|
----
|
|
val filter = BearerTokenAuthenticationFilter(authenticationManager)
|
|
filter.setBearerTokenResolver(myBearerTokenResolver)
|
|
filter.setAuthenticationDetailsSource(myAuthenticationDetailsSource)
|
|
----
|
|
======
|
|
|
|
you are encouraged to use `BearerTokenAuthenticationConverter` to specify both:
|
|
|
|
[tabs]
|
|
======
|
|
Java::
|
|
+
|
|
[source,java,role="primary"]
|
|
----
|
|
BearerTokenAuthenticationConverter authenticationConverter =
|
|
new BearerTokenAuthenticationConverter();
|
|
authenticationConverter.setBearerTokenResolver(myBearerTokenResolver);
|
|
authenticationConverter.setAuthenticationDetailsSource(myAuthenticationDetailsSource);
|
|
BearerTokenAuthenticationFilter filter = new BearerTokenAuthenticationFilter(authenticationManager, authenicationConverter);
|
|
----
|
|
|
|
Kotlin::
|
|
+
|
|
[source,kotlin,role="secondary"]
|
|
----
|
|
val authenticationConverter = BearerTokenAuthenticationConverter()
|
|
authenticationConverter.setBearerTokenResolver(myBearerTokenResolver)
|
|
authenticationConverter.setAuthenticationDetailsSource(myAuthenticationDetailsSource)
|
|
val filter = BearerTokenAuthenticationFilter(authenticationManager, authenticationConverter)
|
|
----
|
|
|
|
== `NimbusJwtDecoder`'s Default Connect and Read Timeouts Are Now 30 Seconds
|
|
|
|
`NimbusJwtDecoder`'s default `RestOperations`, used to fetch a JWK Set when no `RestOperations` is otherwise configured, previously used a 500 millisecond connect and read timeout.
|
|
This value was too short for many deployments and is now 30 seconds, aligning with the connect and read timeouts already used elsewhere in the OAuth2 Client and Resource Server support, such as xref:servlet/oauth2/client/index.adoc[`ClientRegistrations`].
|
|
|
|
If your application relies on the previous, shorter timeout -- for example, expecting a fast failure when the authorization server is unreachable -- you can restore it either by setting the JDK's `sun.net.client.defaultConnectTimeout` and `sun.net.client.defaultReadTimeout` system properties (in milliseconds), or by providing your own `RestOperations`, as described in xref:servlet/oauth2/resource-server/jwt.adoc#oauth2resourceserver-jwt-timeouts[Configuring Timeouts].
|
|
======
|