Reactive-Spring-Security-5.1.3.RELEASE, multiple authorizations

Question

We have some endpoints, that are secured and before to access them we're verifying that the jws is correctly. In order to do that, we've defined a SecurityContext that actually persist the Auth pojo and to manipulate it downstream into the controller. The SecurityWebFilterChain config looks like that:

@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
    return http.csrf().disable()
            .formLogin().disable()
            .logout().disable()
            .httpBasic().disable()
            .securityContextRepository(securityContext)
            .authorizeExchange()
            .anyExchange().authenticated()
            .and()
            .build();
}

The calls were internally made, and we just verified the jws token.

Right now some external clients need to integrate with us, and we need to verify a jwe token. The thing is, that somehow we need to tell spring-security to validate for the existent endpoints the jws and for the new one the jwe.

I tried by specifying multiple security matchers but it failed :( . Do you have any other suggestions ?

Answer 1

You can expose more than one bean. I recommend specifying an order:

@Bean
@Order(1)
public SecurityWebFilterChain first(ServerHttpSecurity http) {
    http
        .securityMatcher(...)
        ...

    return http.build();
}

@Bean
@Order(2)
public SecurityWebFilterChain second(ServerHttpSecurity http) {
   http
       .securityMatcher(...)
       ...

   return http.build();
}

As a side note, Spring Security does ship with support for verifying JWS tokens reactively, and you might be able to remove some boilerplate by using it.