Customize Spring Security Internal WebClient - spring

Question

While working in a café hotspot Wifi, I have noticed that Spring Security is failing while resolving the JWK URI as set in application.yml:
# application.yml
spring:
security:
oauth2:
resourceserver:
jwt:
jwk-set-uri: https://some.vendor.com/.well-known/jwks.json
I have noticed a similar behavior with another piece of code I own that uses org.springframework.web.reactive.function.client.WebClient, which I was able to fix by changing the address resolver as in:
val jvmBlockingResolver = HttpClient.create().resolver(DefaultAddressResolverGroup.INSTANCE)
val webClient = WebClient
.builder()
.clientConnector(ReactorClientHttpConnector(jvmBlockingResolver))
.build()
Digging inside Spring Security code, I have found the following lines:
// NimbusReactiveJwtDecoder.java
package org.springframework.security.oauth2.jwt;
/* ... */
import org.springframework.web.reactive.function.client.WebClient;
/* ... */
// line 383:
source.setWebClient(this.webClient);
Now I strongly believe that this error is because of this this WebClient. Is there a way to solve this problem?
I was thinking I could inject my WebClient bean, but now that I have seen the code, I don't think that will work. Am I looking in the wrong place? Is this a Spring Security limitation or a bug?

Answer 1

Thanks to #Toerktumlare comment, I was able to use his suggestion to create a custom bean:
#Bean
fun reactiveJwtDecoder(): ReactiveJwtDecoder {
val jvmBlockingResolver = HttpClient.create().resolver(DefaultAddressResolverGroup.INSTANCE)
val connector = ReactorClientHttpConnector(jvmBlockingResolver)
val webClient = WebClient.builder().clientConnector(connector).build()
return NimbusReactiveJwtDecoder.withJwkSetUri("https://example.com/.well-known/jwks.json")
.webClient(webClient)
.build()
}
Also it is possible to do this with the SecurityWebFilterChain builder:
.oauth2ResourceServer {
val jvmBlockingResolver = HttpClient.create().resolver(DefaultAddressResolverGroup.INSTANCE)
val connector = ReactorClientHttpConnector(jvmBlockingResolver)
val webClient = WebClient.builder().clientConnector(connector).build()
it.jwt().jwtDecoder(
NimbusReactiveJwtDecoder
.withJwkSetUri("https://example.com/.well-known/jwks.json")
.webClient(webClient)
.build()
)
}