How to get raw token from ReactiveSecurityContextHolder?

Question

I have a method:

@GetMapping("/foo")
public void> foo(JwtAuthenticationToken token) throws ExecutionException, InterruptedException {
    Object object = ReactiveSecurityContextHolder.getContext()
            .map(securityContext -> securityContext.getAuthentication().getPrincipal())
            .toFuture()
            .get();
    System.out.println(object);

JwtAuthenticationToken object which is method argument is succesfully autowired and not null but result of

Object object = ReactiveSecurityContextHolder.getContext()
                .map(securityContext -> securityContext.getAuthentication().getPrincipal())
                .toFuture()
                .get(); 

is null.

Could you please explain why ? Is there way to fix it ?

related topic: How to get jwt token value in spring webflux? (to exchange it with Minio STS token)

Answer 1

It is not necessary to use ReactiveSecurityContextHolder to get the Jwt instance. For example, if JwtAuthenticationToken is non-null, you can get the Jwt instance by doing:

public Mono<Void> foo(JwtAuthenticationToken token) throws ExecutionException, InterruptedException {
    Jwt jwt = token.getToken();
    // ...
}

Or, you can translate it with @AuthenticationPrincipal like so:

public Mono<Void> foo(@AuthenticationPrincipal Jwt jwt) throws ExecutionException, InterruptedException {
    // ...
}

Further, it is not possible to use block() with ReactiveSecurityContextHolder in the way the OP describes. block() subscribes immediately, and there is nothing immediately available in the Reactor Context at this point.

The reactive stack works somewhat in the inverse to perhaps what you are thinking. While there is a filter in Spring Security called ReactorContextWebFilter that populates the Reactor Context with the SecurityContext, its work is deferred until the HTTP response is subscribed to, for example by the browser. block() at this point states (correctly) that the Reactor Context is empty. Instead, if you participate in the existing subscription (instead of calling block()), then you are also deferring your work in the same way and will be able to use ReactiveSecurityContextHolder.

EDIT: Having read the additional context about the OP's situation from How to get jwt token value in spring webflux? (to exchange it with Minio STS token), it's clear now that the OP is aware of these ways to get the instance of a Jwt, and does not want to use them. I'll leave the answer here for completeness anyway.

Answer 2

Not really sure how token is related to the result of the bucketExists and why do you convert it to the CompletableFuture but here is an example how you can get token from the context.

@GetMapping(value = "/someEndpoint")
public Mono<Boolean> foo() {
    return ReactiveSecurityContextHolder.getContext()
            .map(ctx -> ctx.getAuthentication().getPrincipal())
            .cast(Jwt.class)
            .map(jwt -> useToken(jwt));  

}

Here is a test using org.springframework.security:spring-security-test

@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
@AutoConfigureWebTestClient
class RouteConfigTest {
    @Autowired
    private WebTestClient client;

    @Test
    void test() {
        this.client.mutateWith(mockJwt())
                .get()
                .uri("/someEndpoint")
                .accept(MediaType.APPLICATION_JSON)
                .exchange()
                .expectStatus().isOk();
    }
}