-
Notifications
You must be signed in to change notification settings - Fork 6.1k
Open
Labels
in: configAn issue in spring-security-configAn issue in spring-security-configstatus: ideal-for-contributionAn issue that we actively are looking for someone to help us withAn issue that we actively are looking for someone to help us withtype: enhancementA general enhancementA general enhancement
Description
Expected Behavior
RSocketSecurity dsl should have ability to disable anonymous auth interceptor
Current Behavior
RSocketSecurity has hardcode in private method that adds anonymous interceptor no matter what
Context
I'm doing method-level security and rely on @PreAuthorize("authenticated"), my global security config has just permitAll. So anonymous authentication ruining my rsocket experience, for http security i can just disable it.
As workaround i constructed PayloadSocketAcceptorInterceptor entirely by hand, but this process is quite tedious, it would be nice to be able to disable it in RSocketSecurity dsl like in http.
Metadata
Metadata
Assignees
Labels
in: configAn issue in spring-security-configAn issue in spring-security-configstatus: ideal-for-contributionAn issue that we actively are looking for someone to help us withAn issue that we actively are looking for someone to help us withtype: enhancementA general enhancementA general enhancement
Activity
jzheaux commentedon May 21, 2025
Thanks for the suggestion, @Aaur1s. Are you able to submit a PR to add this? I think just the ability to disable will be fine for the time being since there are no other configurable aspects of
AnonymousPayloadInterceptor
.add option to disable anonymous authentication in `RSocketSecurity` (s…
add option to disable anonymous authentication in `RSocketSecurity` (s…
RSocketSecurity
#17159add option to disable anonymous authentication in `RSocketSecurity` (s…
Aaur1s commentedon May 24, 2025
Hey, I didn't able to answer in time, sorry. Thank you for your work!