1

So I've been trying to create a stateless resource server using oauth2. I created empty spring boot app with only two dependencies org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-oauth2-resource-server. Then I created docker-compose file with keycloak so that I would have some out of the box solution for authentication. After theat I configured my realm and added one property to application.yml:

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: http://localhost:40000/auth/realms/myrealm

After that I configured Postman to get token from keycloak before accessing my application. And all works like a charm, but tere is one tiny problem that bugs me. So when I call my application for the first time it returs 401 when I won't send the token and that is so cool, then I send request with token and it respondes with code 200 and that is also very cool. The problem is that when I send 3rd request without token I still get 200. Now I think the issue is JSESSIONID, since when I remove it I get 401 again. How can I make my application truly stateless? I would like my app to require token with every request. Also why this stateless behaviour is not default with oauth2?

apologiessirnoclue
  • 196
  • 8
  • Does this answer your question? [How can I use Spring Security without sessions?](https://stackoverflow.com/questions/2504590/how-can-i-use-spring-security-without-sessions) – xerx593 Dec 19 '21 at 22:18
  • 1
    Thank you, it fixes my problem, but does not answer why it is not default behaviour for oauth2 resource server? Also where can I found default implementation of WebSecurityConfigurerAdapter that is used if I won't provide one in my configuration? – apologiessirnoclue Dec 19 '21 at 22:45
  • #default_behavior: you name it - it is a *web* security adapter? #default_impl: [open source](https://github.com/spring-projects/spring-security/blob/main/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter.java)! L. 221f is the default config – xerx593 Dec 19 '21 at 22:52

0 Answers0