Spring Security 6.5: Proxy the OAuth Authorization Code Exchange

Give Spring Security's authorization-code token response client a proxy-aware RestClient while retaining its OAuth converters and error handler.

The browser reaches the identity provider, then login fails when the application exchanges the returned authorization code. That exchange is an outbound request from the application server, with its own HTTP client.

For the RestClient-based API available in Spring Security 6.5, supply a proxy-aware request factory to the authorization-code token response client:

SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
factory.setProxy(new java.net.Proxy(
    java.net.Proxy.Type.HTTP,
    new java.net.InetSocketAddress("proxy.example", 8080)));
factory.setConnectTimeout(5000);
factory.setReadTimeout(15000);

RestClient tokenHttp = RestClient.builder()
    .requestFactory(factory)
    .messageConverters(converters -> {
        converters.clear();
        converters.add(new FormHttpMessageConverter());
        converters.add(new OAuth2AccessTokenResponseHttpMessageConverter());
    })
    .defaultStatusHandler(new OAuth2ErrorResponseErrorHandler())
    .build();

RestClientAuthorizationCodeTokenResponseClient tokenClient =
    new RestClientAuthorizationCodeTokenResponseClient();
tokenClient.setRestClient(tokenHttp);

The converter and error-handler classes preserve Spring Security's documented token-request behavior. A generic RestClient configured only for an unrelated JSON API is not an equivalent replacement.

Wire that same tokenClient into the existing security configuration:

http.oauth2Login(login -> login
    .tokenEndpoint(token -> token
        .accessTokenResponseClient(tokenClient)));

These are configuration fragments for an application that already has its client registration and SecurityFilterChain. They select an HTTP proxy without authentication; a proxy requiring credentials needs the chosen transport's matching authentication configuration. For a publicly reachable HTTPS token endpoint on an allowed public route, an HTTP entry from the HTTP proxy list can fill that no-account proxy address.

Keep the proxy host separate from its port and URL scheme. Leave the identity provider's token URI as the destination. The example does not replace certificate validation.

Later requests need their own ownership check. UserInfo retrieval, refresh-token exchanges, client-credentials grants and protected API calls can use other client objects. Configure the corresponding supported client when that operation also needs the route. For Spring Security 6.5’s reactive client_credentials flow, configure the reactive token client and its grant provider separately.

Legacy examples using OAuth2RestTemplate and AccessTokenProvider belong to the older Spring Security OAuth project. Choose the API used by the installed application before adapting code; do not mix those objects into this configuration.

Artihkkalat mat laktásit