I am developing a React application that utilizes msal-react for user authentication, which generates an access token through the /oauth2/v2.0/token API, alongside additional details such as refresh token and scope. My intention is to send this access token to my Spring Boot application, which employs Spring Security 5 and WebFlux for backend processing. I need the backend services to confirm the validity of the bearer token by calling the Microsoft Graph API’s user endpoint. However, it appears that my SecurityWebFilterChain configuration is not functioning correctly.
For instance, I have the following endpoint to secure:
@GetMapping("/protected-endpoint")
public Mono<String> retrieveProtectedData() {
return Mono.just("Protected Data");
}
Here’s how my security configuration looks:
@Configuration
@EnableWebFluxSecurity
public class WebSecurityConfig {
private final ReactiveAuthenticationManager authManager;
public WebSecurityConfig(ReactiveAuthenticationManager authManager) {
this.authManager = authManager;
}
@Bean
public SecurityWebFilterChain securityChain(ServerHttpSecurity http) {
return http.authorizeExchange().anyExchange().authenticated().and()
.authenticationManager(authManager).build();
}
}
The implementation of ReactiveAuthenticationManager is:
@Bean
ReactiveAuthenticationManager authenticationHandler() {
return auth -> Mono.just(handleAuthentication(auth));
}
private Authentication handleAuthentication(Authentication auth) {
String token = auth.getCredentials().toString();
MsAuthResponse response = this.authService.validateTokenWithGraphApi(token);
if (response == null) {
throw new BadCredentialsException("Invalid token: " + token);
}
return new UsernamePasswordAuthenticationToken(response, token, new ArrayList<>());
}
The validateTokenWithGraphApi() method checks the token with Microsoft. I’ve tried several approaches, but nothing has worked so far; the breakpoints in my authentication handler are never triggered.
Have you checked the scopes requested in MSAL? Errors in scope might affect token validation. Maybe experiment with logging the token submission to see if the request reaches your backend at all? Does anyone have suggestions for debugging reactive pipelines in Webflux?
Might it be worthwhile to examine the 