In spring-security-oauth2-client 5.1, OAuth2 client is supported fairly well with webflux's WebClient via ServerOAuth2AuthorizedClientExchangeFilterFunction.

However, there is no equivalent support for webflux's WebSocketClient. For example, I would like to:

• obtain an access token from ClientRegistration / OAuth2AuthorizedClient
• automatically refresh the token before sending it if required, similar to how tokens are automatically refreshed in ServerOAuth2AuthorizedClientExchangeFilterFunction
• include the access token in the Authorization header of the initial websocket outbound upgrade request

In my application, I'm currently debating on whether I want to copy/paste ServerOAuth2AuthorizedClientExchangeFilterFunction and it's corresponding OAuth2AuthorizedClientResolver (which is package-private) in order to provide similar support for my websocket use cases.

It's really a shame that WebSocketClient does not use ExchangeFilterFunctions, otherwise we'd get this for free. Instead, it looks like I'll have to use reactor netty's HttpClient.headersWhen method as a hook to provide headers instead.

At a minimum, it would be nice if most of the logic for obtaining an access token in ServerOAuth2AuthorizedClientExchangeFilterFunction was extracted out into a class that could be reused in

• an ExchangeFilterFunction (for WebClient),
• a "headersWhen function" (for WebSocketClient).
• any other location where an access token is needed (e.g. a different http client or 3rd party sdk)

Mono<OAuth2AuthorizedClient> OAuth2AuthorizedClientResolver.loadAuthorizedClient is almost what I need. Except it doesn't handle refreshing tokens, and it's not public.