spring-projects
Prevent JwtAuthenticationProvider from setting authentication details when jwtAuthenticationConverter returned an authentication instance with non null details
@ch4mpy, thanks for asking! I don't think so, but I'm heads down on a few other things and will circle back to this a bit later.
@sjohnr rebased on main and updated copyright.
P.S. Well, the scenario in which one sets detail in authentication converter and this details being overriden by the framework is the exact one a team I know went through and none expected to have details "lost". Reason for me opening the ticket as a "bug". Of course, whith my recent contribution on introspection and the discussions we had about this behavior, it didn't take me long to spot their problem and provide them with a work around.
I hadn't considered it an expected "feature", which is why I initialy based the PR on 5.8
Any plan to merge this sometime?
This would allow me to use immutable Authentication implementations in servlets with JWT decoder (can currently do it in reactive apps only).
Hi @ch4mpy!
Any plan to merge this sometime?
Apologies, I wasn't able to circle back to this in time for RC1. I'm going to schedule this for 6.1 as I'd prefer to hold off on any code enhancements in the RC phase of 6.0. I'll merge this after the GA release.