Skip to content

Add reactive protected resource metadata discovery - #19493

Open
therepanic wants to merge 1 commit into
spring-projects:mainfrom
therepanic:gh-19446
Open

Add reactive protected resource metadata discovery#19493
therepanic wants to merge 1 commit into
spring-projects:mainfrom
therepanic:gh-19446

Conversation

@therepanic

@therepanic therepanic commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

We support RFC 9728 Protected Resource Metadata discovery for servlet-based applications, but have not done so for reactive resource servers. We should make this behavior consistent across both stacks.

Closes: gh-19446

@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Aug 1, 2026
Comment on lines +127 to +136
@SuppressWarnings("unchecked")
private static @Nullable HttpMessageWriter<Object> getJsonMessageWriter() {
return ServerCodecConfigurer.create()
.getWriters()
.stream()
.filter((writer) -> writer.canWrite(STRING_OBJECT_MAP, MediaType.APPLICATION_JSON))
.map((writer) -> (HttpMessageWriter<Object>) writer)
.findFirst()
.orElse(null);
}

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps there is a workaround on the Spring side like this for servlets to replace OAuth2ProtectedResourceMetadataFilter#HttpMessageConverters

@therepanic

therepanic commented Aug 1, 2026

Copy link
Copy Markdown
Contributor Author

OAuth2ProtectedResourceMetadataWebFilterTests contains tests similar to the servet alternative. OAuth2ProtectedResourceMetadataTests too.

We support RFC 9728 Protected Resource Metadata discovery for servlet-based applications, but have not done so for reactive resource servers. We should make this behavior consistent across both stacks.

Closes: spring-projectsgh-19446

Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

status: waiting-for-triage An issue we've not yet triaged

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Align Reactive BearerTokenServerAuthenticationEntryPoint with Servlet RFC 9728 WWW-Authenticate behavior

2 participants