Skip to content

Clarify that spring.security.filter properties only apply to servlet-based web apps #33551

@tgeens

Description

@tgeens

Should it be documented (or fixed) that spring.security.filter.order is ignored in the reactive stack ?

Context: I'm trying to convert an auto-configuration-enabled library to the reactive-stack. It uses a filter that should be registered before the spring-security-filter. The servlet variant is using SecurityProperties.getFilter().getOrder() as a best-effort attempt to find out the order of the spring-security-filter.

WebFluxSecurityConfiguration uses a fixed @Order(WEB_FILTER_CHAIN_FILTER_ORDER) - but the WEB_FILTER_CHAIN_FILTER_ORDER is a magic number, with only package visiblity.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions