text:
When requesting the log4j2-spring.xml configuration file, a 401 error occurs

Versions:
spring-boot-starter-parent : 3.3.2
spring-cloud-dependencies: 2023.0.3
jdk: 21
Details:
My "Spring Cloud Config Server" has a security configuration applied, therefore authentication is required to access the service.
spring:
   security:
      user:
         name: root
         password: password

The source code can be seen at https://github.com/luidoc/demo-config-server-native.git
On the other hand, I have a sample application that uses the "Spring Cloud Config Server" service, both to obtain its configuration file and to obtain the log4j2 configuration file (log4j2-spring.xml).
The source code can be seen at https://github.com/luidoc/config-server-client.git
Below I show the bootstrap.yml configuration file:
spring:
    main:
        allow-bean-definition-overriding: true
    profiles:
      active: dev
    application:
        name: config-server-client
    config:
        import: optional:configserver=${spring.cloud.config.url}
    cloud:
        config:
            url: http://localhost:8888
            uri: http://localhost:8888
            username: root
            password: 'password'
            name: ${spring.application.name}
            profile: dev
            label: main
logging:
    config: ${spring.cloud.config.url}/${spring.application.name}/${spring.cloud.config.profile}/${spring.cloud.config.label}/log4j2-spring.xml?resolvePlaceholders=false
log4j2:
    Configuration:
        allowedProtocols: 'http,https'

When running the sample application, it fails to obtain the log4j2 configuration file from the "Config Server" service, resulting in an http 401 error.
The error trace can be seen below:
java -jar .\target\config-server-client.jar
Logging system failed to initialize using configuration from 'http://localhost:8888/config-server-client/dev/main/log4j2-spring.xml?resolvePlaceholders=false'
java.lang.IllegalStateException: Could not initialize Log4J2 logging from http://localhost:8888/config-server-client/dev/main/log4j2-spring.xml?resolvePlaceholders=false
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.loadConfiguration(Log4j2SpringBootLoggingSystem.java:198)
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.load(Log4J2LoggingSystem.java:246)
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.loadConfiguration(Log4J2LoggingSystem.java:238)
        at org.springframework.boot.logging.AbstractLoggingSystem.initializeWithSpecificConfig(AbstractLoggingSystem.java:67)
        at org.springframework.boot.logging.AbstractLoggingSystem.initialize(AbstractLoggingSystem.java:58)
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.initialize(Log4J2LoggingSystem.java:225)
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.initialize(Log4j2SpringBootLoggingSystem.java:96)
        at org.springframework.boot.context.logging.LoggingApplicationListener.initializeSystem(LoggingApplicationListener.java:335)
        at org.springframework.boot.context.logging.LoggingApplicationListener.initialize(LoggingApplicationListener.java:298)
        at org.springframework.boot.context.logging.LoggingApplicationListener.onApplicationEnvironmentPreparedEvent(LoggingApplicationListener.java:246)
        at org.springframework.boot.context.logging.LoggingApplicationListener.onApplicationEvent(LoggingApplicationListener.java:223)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.doInvokeListener(SimpleApplicationEventMulticaster.java:185)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.invokeListener(SimpleApplicationEventMulticaster.java:178)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:156)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:138)
        at org.springframework.boot.context.event.EventPublishingRunListener.multicastInitialEvent(EventPublishingRunListener.java:136)
        at org.springframework.boot.context.event.EventPublishingRunListener.environmentPrepared(EventPublishingRunListener.java:81)
        at org.springframework.boot.SpringApplicationRunListeners.lambda$environmentPrepared$2(SpringApplicationRunListeners.java:64)
        at java.base/java.lang.Iterable.forEach(Iterable.java:75)
        at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:118)
        at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:112)
        at org.springframework.boot.SpringApplicationRunListeners.environmentPrepared(SpringApplicationRunListeners.java:63)
        at org.springframework.boot.SpringApplication.prepareEnvironment(SpringApplication.java:370)
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:330)
        at org.springframework.boot.builder.SpringApplicationBuilder.run(SpringApplicationBuilder.java:149)
        at org.springframework.cloud.bootstrap.BootstrapApplicationListener.bootstrapServiceContext(BootstrapApplicationListener.java:195)
        at org.springframework.cloud.bootstrap.BootstrapApplicationListener.onApplicationEvent(BootstrapApplicationListener.java:114)
        at org.springframework.cloud.bootstrap.BootstrapApplicationListener.onApplicationEvent(BootstrapApplicationListener.java:77)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.doInvokeListener(SimpleApplicationEventMulticaster.java:185)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.invokeListener(SimpleApplicationEventMulticaster.java:178)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:156)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:138)
        at org.springframework.boot.context.event.EventPublishingRunListener.multicastInitialEvent(EventPublishingRunListener.java:136)
        at org.springframework.boot.context.event.EventPublishingRunListener.environmentPrepared(EventPublishingRunListener.java:81)
        at org.springframework.boot.SpringApplicationRunListeners.lambda$environmentPrepared$2(SpringApplicationRunListeners.java:64)
        at java.base/java.lang.Iterable.forEach(Iterable.java:75)
        at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:118)
        at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:112)
        at org.springframework.boot.SpringApplicationRunListeners.environmentPrepared(SpringApplicationRunListeners.java:63)
        at org.springframework.boot.SpringApplication.prepareEnvironment(SpringApplication.java:370)
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:330)
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:1363)
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:1352)
        at com.example.demo.ConfigServerClientApplication.main(ConfigServerClientApplication.java:10)
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
        at java.base/java.lang.reflect.Method.invoke(Method.java:580)
        at org.springframework.boot.loader.launch.Launcher.launch(Launcher.java:91)
        at org.springframework.boot.loader.launch.Launcher.launch(Launcher.java:53)
        at org.springframework.boot.loader.launch.JarLauncher.main(JarLauncher.java:58)
Caused by: java.io.IOException: Server returned HTTP response code: 401 for URL: http://localhost:8888/config-server-client/dev/main/log4j2-spring.xml?resolvePlaceholders=false
        at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1998)
        at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1599)
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.getConfigurationSource(Log4j2SpringBootLoggingSystem.java:247)
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.loadConfiguration(Log4j2SpringBootLoggingSystem.java:159)
        ... 48 more
18:44:35.385 [main] ERROR org.springframework.boot.SpringApplication - Application run failed
java.lang.IllegalStateException: java.lang.IllegalStateException: Could not initialize Log4J2 logging from http://localhost:8888/config-server-client/dev/main/log4j2-spring.xml?resolvePlaceholders=false
        at org.springframework.boot.context.logging.LoggingApplicationListener.initializeSystem(LoggingApplicationListener.java:347) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.context.logging.LoggingApplicationListener.initialize(LoggingApplicationListener.java:298) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.context.logging.LoggingApplicationListener.onApplicationEnvironmentPreparedEvent(LoggingApplicationListener.java:246) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.context.logging.LoggingApplicationListener.onApplicationEvent(LoggingApplicationListener.java:223) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.context.event.SimpleApplicationEventMulticaster.doInvokeListener(SimpleApplicationEventMulticaster.java:185) ~[spring-context-6.1.11.jar!/:6.1.11]
        at org.springframework.context.event.SimpleApplicationEventMulticaster.invokeListener(SimpleApplicationEventMulticaster.java:178) ~[spring-context-6.1.11.jar!/:6.1.11]
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:156) ~[spring-context-6.1.11.jar!/:6.1.11]
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:138) ~[spring-context-6.1.11.jar!/:6.1.11]
        at org.springframework.boot.context.event.EventPublishingRunListener.multicastInitialEvent(EventPublishingRunListener.java:136) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.context.event.EventPublishingRunListener.environmentPrepared(EventPublishingRunListener.java:81) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplicationRunListeners.lambda$environmentPrepared$2(SpringApplicationRunListeners.java:64) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at java.base/java.lang.Iterable.forEach(Iterable.java:75) ~[?:?]
        at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:118) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:112) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplicationRunListeners.environmentPrepared(SpringApplicationRunListeners.java:63) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplication.prepareEnvironment(SpringApplication.java:370) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:330) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.builder.SpringApplicationBuilder.run(SpringApplicationBuilder.java:149) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.cloud.bootstrap.BootstrapApplicationListener.bootstrapServiceContext(BootstrapApplicationListener.java:195) ~[spring-cloud-context-4.1.4.jar!/:4.1.4]
        at org.springframework.cloud.bootstrap.BootstrapApplicationListener.onApplicationEvent(BootstrapApplicationListener.java:114) ~[spring-cloud-context-4.1.4.jar!/:4.1.4]
        at org.springframework.cloud.bootstrap.BootstrapApplicationListener.onApplicationEvent(BootstrapApplicationListener.java:77) ~[spring-cloud-context-4.1.4.jar!/:4.1.4]
        at org.springframework.context.event.SimpleApplicationEventMulticaster.doInvokeListener(SimpleApplicationEventMulticaster.java:185) ~[spring-context-6.1.11.jar!/:6.1.11]
        at org.springframework.context.event.SimpleApplicationEventMulticaster.invokeListener(SimpleApplicationEventMulticaster.java:178) ~[spring-context-6.1.11.jar!/:6.1.11]
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:156) ~[spring-context-6.1.11.jar!/:6.1.11]
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:138) ~[spring-context-6.1.11.jar!/:6.1.11]
        at org.springframework.boot.context.event.EventPublishingRunListener.multicastInitialEvent(EventPublishingRunListener.java:136) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.context.event.EventPublishingRunListener.environmentPrepared(EventPublishingRunListener.java:81) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplicationRunListeners.lambda$environmentPrepared$2(SpringApplicationRunListeners.java:64) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at java.base/java.lang.Iterable.forEach(Iterable.java:75) [?:?]
        at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:118) [spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:112) [spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplicationRunListeners.environmentPrepared(SpringApplicationRunListeners.java:63) [spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplication.prepareEnvironment(SpringApplication.java:370) [spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:330) [spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:1363) [spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:1352) [spring-boot-3.3.2.jar!/:3.3.2]
        at com.example.demo.ConfigServerClientApplication.main(ConfigServerClientApplication.java:10) [!/:1.0.0-SNAPSHOT]
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103) ~[?:?]
        at java.base/java.lang.reflect.Method.invoke(Method.java:580) ~[?:?]
        at org.springframework.boot.loader.launch.Launcher.launch(Launcher.java:91) [config-server-client.jar:1.0.0-SNAPSHOT]
        at org.springframework.boot.loader.launch.Launcher.launch(Launcher.java:53) [config-server-client.jar:1.0.0-SNAPSHOT]
        at org.springframework.boot.loader.launch.JarLauncher.main(JarLauncher.java:58) [config-server-client.jar:1.0.0-SNAPSHOT]
Caused by: java.lang.IllegalStateException: Could not initialize Log4J2 logging from http://localhost:8888/config-server-client/dev/main/log4j2-spring.xml?resolvePlaceholders=false
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.loadConfiguration(Log4j2SpringBootLoggingSystem.java:198) ~[log4j-spring-boot-2.23.1.jar!/:2.23.1]
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.load(Log4J2LoggingSystem.java:246) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.loadConfiguration(Log4J2LoggingSystem.java:238) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.logging.AbstractLoggingSystem.initializeWithSpecificConfig(AbstractLoggingSystem.java:67) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.logging.AbstractLoggingSystem.initialize(AbstractLoggingSystem.java:58) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.initialize(Log4J2LoggingSystem.java:225) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.initialize(Log4j2SpringBootLoggingSystem.java:96) ~[log4j-spring-boot-2.23.1.jar!/:2.23.1]
        at org.springframework.boot.context.logging.LoggingApplicationListener.initializeSystem(LoggingApplicationListener.java:335) ~[spring-boot-3.3.2.jar!/:3.3.2]
        ... 41 more
Caused by: java.io.IOException: Server returned HTTP response code: 401 for URL: http://localhost:8888/config-server-client/dev/main/log4j2-spring.xml?resolvePlaceholders=false
        at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1998) ~[?:?]
        at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1599) ~[?:?]
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.getConfigurationSource(Log4j2SpringBootLoggingSystem.java:247) ~[log4j-spring-boot-2.23.1.jar!/:2.23.1]
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.loadConfiguration(Log4j2SpringBootLoggingSystem.java:159) ~[log4j-spring-boot-2.23.1.jar!/:2.23.1]
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.load(Log4J2LoggingSystem.java:246) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.loadConfiguration(Log4J2LoggingSystem.java:238) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.logging.AbstractLoggingSystem.initializeWithSpecificConfig(AbstractLoggingSystem.java:67) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.logging.AbstractLoggingSystem.initialize(AbstractLoggingSystem.java:58) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.initialize(Log4J2LoggingSystem.java:225) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.initialize(Log4j2SpringBootLoggingSystem.java:96) ~[log4j-spring-boot-2.23.1.jar!/:2.23.1]
        at org.springframework.boot.context.logging.LoggingApplicationListener.initializeSystem(LoggingApplicationListener.java:335) ~[spring-boot-3.3.2.jar!/:3.3.2]
        ... 41 more
18:44:35.412 [main] ERROR org.springframework.boot.SpringApplication - Application run failed
java.lang.IllegalStateException: java.lang.IllegalStateException: Could not initialize Log4J2 logging from http://localhost:8888/config-server-client/dev/main/log4j2-spring.xml?resolvePlaceholders=false
        at org.springframework.boot.context.logging.LoggingApplicationListener.initializeSystem(LoggingApplicationListener.java:347) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.context.logging.LoggingApplicationListener.initialize(LoggingApplicationListener.java:298) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.context.logging.LoggingApplicationListener.onApplicationEnvironmentPreparedEvent(LoggingApplicationListener.java:246) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.context.logging.LoggingApplicationListener.onApplicationEvent(LoggingApplicationListener.java:223) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.context.event.SimpleApplicationEventMulticaster.doInvokeListener(SimpleApplicationEventMulticaster.java:185) ~[spring-context-6.1.11.jar!/:6.1.11]
        at org.springframework.context.event.SimpleApplicationEventMulticaster.invokeListener(SimpleApplicationEventMulticaster.java:178) ~[spring-context-6.1.11.jar!/:6.1.11]
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:156) ~[spring-context-6.1.11.jar!/:6.1.11]
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:138) ~[spring-context-6.1.11.jar!/:6.1.11]
        at org.springframework.boot.context.event.EventPublishingRunListener.multicastInitialEvent(EventPublishingRunListener.java:136) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.context.event.EventPublishingRunListener.environmentPrepared(EventPublishingRunListener.java:81) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplicationRunListeners.lambda$environmentPrepared$2(SpringApplicationRunListeners.java:64) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at java.base/java.lang.Iterable.forEach(Iterable.java:75) ~[?:?]
        at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:118) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:112) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplicationRunListeners.environmentPrepared(SpringApplicationRunListeners.java:63) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplication.prepareEnvironment(SpringApplication.java:370) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:330) [spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.builder.SpringApplicationBuilder.run(SpringApplicationBuilder.java:149) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.cloud.bootstrap.BootstrapApplicationListener.bootstrapServiceContext(BootstrapApplicationListener.java:195) ~[spring-cloud-context-4.1.4.jar!/:4.1.4]
        at org.springframework.cloud.bootstrap.BootstrapApplicationListener.onApplicationEvent(BootstrapApplicationListener.java:114) ~[spring-cloud-context-4.1.4.jar!/:4.1.4]
        at org.springframework.cloud.bootstrap.BootstrapApplicationListener.onApplicationEvent(BootstrapApplicationListener.java:77) ~[spring-cloud-context-4.1.4.jar!/:4.1.4]
        at org.springframework.context.event.SimpleApplicationEventMulticaster.doInvokeListener(SimpleApplicationEventMulticaster.java:185) ~[spring-context-6.1.11.jar!/:6.1.11]
        at org.springframework.context.event.SimpleApplicationEventMulticaster.invokeListener(SimpleApplicationEventMulticaster.java:178) ~[spring-context-6.1.11.jar!/:6.1.11]
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:156) ~[spring-context-6.1.11.jar!/:6.1.11]
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:138) ~[spring-context-6.1.11.jar!/:6.1.11]
        at org.springframework.boot.context.event.EventPublishingRunListener.multicastInitialEvent(EventPublishingRunListener.java:136) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.context.event.EventPublishingRunListener.environmentPrepared(EventPublishingRunListener.java:81) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplicationRunListeners.lambda$environmentPrepared$2(SpringApplicationRunListeners.java:64) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at java.base/java.lang.Iterable.forEach(Iterable.java:75) ~[?:?]
        at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:118) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:112) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplicationRunListeners.environmentPrepared(SpringApplicationRunListeners.java:63) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplication.prepareEnvironment(SpringApplication.java:370) [spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:330) [spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:1363) [spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:1352) [spring-boot-3.3.2.jar!/:3.3.2]
        at com.example.demo.ConfigServerClientApplication.main(ConfigServerClientApplication.java:10) [!/:1.0.0-SNAPSHOT]
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103) ~[?:?]
        at java.base/java.lang.reflect.Method.invoke(Method.java:580) ~[?:?]
        at org.springframework.boot.loader.launch.Launcher.launch(Launcher.java:91) [config-server-client.jar:1.0.0-SNAPSHOT]
        at org.springframework.boot.loader.launch.Launcher.launch(Launcher.java:53) [config-server-client.jar:1.0.0-SNAPSHOT]
        at org.springframework.boot.loader.launch.JarLauncher.main(JarLauncher.java:58) [config-server-client.jar:1.0.0-SNAPSHOT]
Caused by: java.lang.IllegalStateException: Could not initialize Log4J2 logging from http://localhost:8888/config-server-client/dev/main/log4j2-spring.xml?resolvePlaceholders=false
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.loadConfiguration(Log4j2SpringBootLoggingSystem.java:198) ~[log4j-spring-boot-2.23.1.jar!/:2.23.1]
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.load(Log4J2LoggingSystem.java:246) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.loadConfiguration(Log4J2LoggingSystem.java:238) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.logging.AbstractLoggingSystem.initializeWithSpecificConfig(AbstractLoggingSystem.java:67) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.logging.AbstractLoggingSystem.initialize(AbstractLoggingSystem.java:58) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.initialize(Log4J2LoggingSystem.java:225) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.initialize(Log4j2SpringBootLoggingSystem.java:96) ~[log4j-spring-boot-2.23.1.jar!/:2.23.1]
        at org.springframework.boot.context.logging.LoggingApplicationListener.initializeSystem(LoggingApplicationListener.java:335) ~[spring-boot-3.3.2.jar!/:3.3.2]
        ... 41 more
Caused by: java.io.IOException: Server returned HTTP response code: 401 for URL: http://localhost:8888/config-server-client/dev/main/log4j2-spring.xml?resolvePlaceholders=false
        at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1998) ~[?:?]
        at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1599) ~[?:?]
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.getConfigurationSource(Log4j2SpringBootLoggingSystem.java:247) ~[log4j-spring-boot-2.23.1.jar!/:2.23.1]
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.loadConfiguration(Log4j2SpringBootLoggingSystem.java:159) ~[log4j-spring-boot-2.23.1.jar!/:2.23.1]
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.load(Log4J2LoggingSystem.java:246) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.loadConfiguration(Log4J2LoggingSystem.java:238) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.logging.AbstractLoggingSystem.initializeWithSpecificConfig(AbstractLoggingSystem.java:67) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.logging.AbstractLoggingSystem.initialize(AbstractLoggingSystem.java:58) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.initialize(Log4J2LoggingSystem.java:225) ~[spring-boot-3.3.2.jar!/:3.3.2]
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.initialize(Log4j2SpringBootLoggingSystem.java:96) ~[log4j-spring-boot-2.23.1.jar!/:2.23.1]
        at org.springframework.boot.context.logging.LoggingApplicationListener.initializeSystem(LoggingApplicationListener.java:335) ~[spring-boot-3.3.2.jar!/:3.3.2]
        ... 41 more

On the other hand, I can perfectly obtain the configuration file using curl.
curl --location 'http://localhost:8888/config-server-client/dev/main/log4j2-spring.xml?resolvePlaceholders=false' \
--header 'Authorization: Basic cm9vdDpwYXNzd29yZA=='

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="WARN">
    <Appenders>
        <Console name="Console" target="SYSTEM_OUT">
            <PatternLayout pattern="%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg %n" />
        </Console>
    </Appenders>
    <Loggers>
        <Root level="debug">
            <AppenderRef ref="Console" />
        </Root>
    </Loggers>
</Configuration>

Sample
Config Server: https://github.com/luidoc/demo-config-server-native.git
Demo application: https://github.com/luidoc/config-server-client.git

Yes, I've tried that before, but it doesn't work. As you can see, an error occurs (error 401):
Logging system failed to initialize using configuration from 'http://root:password@localhost:8888/config-server-client/dev/main/log4j2-spring.xml?resolvePlaceholders=false'
java.lang.IllegalStateException: Could not initialize Log4J2 logging from http://root:password@localhost:8888/config-server-client/dev/main/log4j2-spring.xml?resolvePlaceholders=false
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.loadConfiguration(Log4j2SpringBootLoggingSystem.java:198)
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.load(Log4J2LoggingSystem.java:246)
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.loadConfiguration(Log4J2LoggingSystem.java:238)
        at org.springframework.boot.logging.AbstractLoggingSystem.initializeWithSpecificConfig(AbstractLoggingSystem.java:67)
        at org.springframework.boot.logging.AbstractLoggingSystem.initialize(AbstractLoggingSystem.java:58)
        at org.springframework.boot.logging.log4j2.Log4J2LoggingSystem.initialize(Log4J2LoggingSystem.java:225)
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.initialize(Log4j2SpringBootLoggingSystem.java:96)
        at org.springframework.boot.context.logging.LoggingApplicationListener.initializeSystem(LoggingApplicationListener.java:335)
        at org.springframework.boot.context.logging.LoggingApplicationListener.initialize(LoggingApplicationListener.java:298)
        at org.springframework.boot.context.logging.LoggingApplicationListener.onApplicationEnvironmentPreparedEvent(LoggingApplicationListener.java:246)
        at org.springframework.boot.context.logging.LoggingApplicationListener.onApplicationEvent(LoggingApplicationListener.java:223)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.doInvokeListener(SimpleApplicationEventMulticaster.java:185)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.invokeListener(SimpleApplicationEventMulticaster.java:178)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:156)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:138)
        at org.springframework.boot.context.event.EventPublishingRunListener.multicastInitialEvent(EventPublishingRunListener.java:136)
        at org.springframework.boot.context.event.EventPublishingRunListener.environmentPrepared(EventPublishingRunListener.java:81)
        at org.springframework.boot.SpringApplicationRunListeners.lambda$environmentPrepared$2(SpringApplicationRunListeners.java:64)
        at java.base/java.lang.Iterable.forEach(Iterable.java:75)
        at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:118)
        at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:112)
        at org.springframework.boot.SpringApplicationRunListeners.environmentPrepared(SpringApplicationRunListeners.java:63)
        at org.springframework.boot.SpringApplication.prepareEnvironment(SpringApplication.java:370)
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:330)
        at org.springframework.boot.builder.SpringApplicationBuilder.run(SpringApplicationBuilder.java:149)
        at org.springframework.cloud.bootstrap.BootstrapApplicationListener.bootstrapServiceContext(BootstrapApplicationListener.java:195)
        at org.springframework.cloud.bootstrap.BootstrapApplicationListener.onApplicationEvent(BootstrapApplicationListener.java:114)
        at org.springframework.cloud.bootstrap.BootstrapApplicationListener.onApplicationEvent(BootstrapApplicationListener.java:77)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.doInvokeListener(SimpleApplicationEventMulticaster.java:185)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.invokeListener(SimpleApplicationEventMulticaster.java:178)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:156)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:138)
        at org.springframework.boot.context.event.EventPublishingRunListener.multicastInitialEvent(EventPublishingRunListener.java:136)
        at org.springframework.boot.context.event.EventPublishingRunListener.environmentPrepared(EventPublishingRunListener.java:81)
        at org.springframework.boot.SpringApplicationRunListeners.lambda$environmentPrepared$2(SpringApplicationRunListeners.java:64)
        at java.base/java.lang.Iterable.forEach(Iterable.java:75)
        at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:118)
        at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:112)
        at org.springframework.boot.SpringApplicationRunListeners.environmentPrepared(SpringApplicationRunListeners.java:63)
        at org.springframework.boot.SpringApplication.prepareEnvironment(SpringApplication.java:370)
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:330)
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:1363)
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:1352)
        at com.example.demo.ConfigServerClientApplication.main(ConfigServerClientApplication.java:10)
Caused by: java.io.IOException: Server returned HTTP response code: 401 for URL: http://root:password@localhost:8888/config-server-client/dev/main/log4j2-spring.xml?resolvePlaceholders=false
        at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1998)
        at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1599)
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.getConfigurationSource(Log4j2SpringBootLoggingSystem.java:247)
        at org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem.loadConfiguration(Log4j2SpringBootLoggingSystem.java:159)
        ... 43 more

The server treats this call as if it were an anonymous access, as you can see in the log:
TRACE 1144 --- [nio-8888-exec-1] o.s.s.w.a.ExceptionTranslationFilter     : Sending AnonymousAuthenticationToken [Principal=anonymousUser, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=127.0.0.1, SessionId=null], Granted Authorities=[ROLE_ANONYMOUS]] to authentication entry point since access is denied

org.springframework.security.access.AccessDeniedException: Access Denied
        at org.springframework.security.web.access.intercept.AuthorizationFilter.doFilter(AuthorizationFilter.java:98) ~[spring-security-web-6.3.1.jar!/:6.3.1]

Can you authenticate and access the file in other ways?

I don't quite understand your question, if you mean if the file can be accessed from spring cloud config server url, yes, it is possible. If you run the example you will see that you can run a
curl --location 'http://localhost:8888/config-server-client/dev/main/log4j2-spring.xml?resolvePlaceholders=false'  --header 'Authorization: Basic cm9vdDpwYXNzd29yZA=='
And you will get the content of the file as a response.
In fact, if in the example of spring cloud config server I disable security or add this to the spring security filter of the server:
.requestMatchers(new AntPathRequestMatcher("/**/**/**/log4j2.xml**")).permitAll()
.requestMatchers(new AntPathRequestMatcher("/**/**/**/log4j2-spring.xml**")).permitAll()

everything works correctly.
I think the problem is in org.apache.logging.log4j.spring.boot.Log4j2SpringBootLoggingSystem , specifically in the getConfigurationSource method, that does not obtain the spring cloud config security configuration.

I wouldn't expect Boot to know anything about the security credentials for fetching remote logging configuration.  I would expect their to be a separate configuration for the Boot to fetch the remote logging configuration (if they support such a thing).  I don't think this is a Spring Cloud Config problem.

If you would like us to look at this issue, please provide the requested information. If the information is not provided within the next 7 days this issue will be closed.

Please, would you be so kind as to let me know what information you are missing in order to evaluate this issue?
I have clearly indicated the problem, the versions, as well as provided the URL of the examples to reproduce the problem.

As I said above

I don't think this is a Spring Cloud Config problem.

After reviewing the log4j documentation, I have seen that according to what is indicated in https://logging.apache.org/log4j/2.x/manual/configuration.html the credentials are specified with the properties log4j2.Configuration.username and log4j2.Configuration.password.
I have modified the example (https://github.com/luidoc/config-server-client.git) so that anyone who has the same problem can see how to solve it.

authors: luidoc ryanjbaxter spring-cloud-issues


text:
Support pattern properties in messaging contracts

We found that we were unable to use pattern properties such as anyAlphaUnicode() in messaging contracts and were told to open a bug report. We believe these changes would resolve the issue.

@mfeygelson Please sign the Contributor License Agreement!
Click here to manually synchronize the status of this Pull Request.
See the FAQ for frequently asked questions.

@mfeygelson Thank you for signing the Contributor License Agreement!

Sweeeeet, great job @mfeygelson and congratulations on your first contribution!

source: gharchive/pull-request

repo: spring-cloud/spring-cloud-contract

license_type: permissive

license_source: github-api


text:
How can I get response body size of a request in gateway?

I have created a custom filter in which I want to access size of response body. Is there anyway?

Either the content length header or read the whole response body into memory.

Actually I am new to spring framework and backend.
I tried the content length header. It worked. but sometime we didn't get this header from microservice.
Could you please share a small code for your second method (read the whole response body into memory)? like in term of ServerWebExchange or ServerHttpResponse.

same question here. any updates?

same question here. any updates?

Closing due to age of the question. If you would like us to look at this issue, please comment and we will look at re-opening the issue.

I tried get request/response body size by rewrite NettyRoutingFilter and NettyWriteResponseFilter. Gateway version is 2.2.9.RELEASE.
Write NettyRoutingFilter
......
	nettyOutbound.withConnection(connection -> {
		connection.channel().attr(TRACE_ID).set(traceId);
		if (log.isTraceEnabled()) {
			log.trace("outbound route: " + connection.channel().id().asShortText()
					+ ", inbound: " + exchange.getLogPrefix());
		}
	});
	return nettyOutbound.send(request.getBody().map(body -> {
                // get request body size here, put size in exchange
		int size = body.readableByteCount();
		exchange.getAttributes().put("gw-request-body-size", size);
		return getByteBuf(body);
	}));
}).responseConnection((res, connection) -> {

	.....

rewrite NettyWriteResponseFilter
.......
if (log.isTraceEnabled()) {
log.trace("NettyWriteResponseFilter start inbound: "
		+ connection.channel().id().asShortText() + ", outbound: "
		+ exchange.getLogPrefix());
}
ServerHttpResponse response = exchange.getResponse();

// TODO: needed?
final Flux<DataBuffer> body = connection
	.inbound()
	.receive()
	.retain()
	.map(byteBuf -> {
                // get response body size here and put the result in exchange
		int respSize = byteBuf.readableBytes();
		exchange.getAttributes().put("gw-response-body-size", respSize);
		return wrap(byteBuf, response);
	});
.......

create custom filter and get request/response body size from exchange
/**
 * @author luobo.hwz
 */
@Slf4j
@Component
public class RespBodySizeFilter implements GlobalFilter, Ordered {

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        return chain.filter(exchange)
                .then(Mono.defer(() -> {
                    // get result from exchange
                    Integer exchangeReq = exchange.getAttribute("gw-request-body-size");
                    Integer exchangeResp = exchange.getAttribute("gw-response-body-size");
                    log.info("req from exchange: {}", exchangeReq);
                    log.info("resp from exchange: {}", exchangeResp);
                    return Mono.empty();
                }));
    }

    @Override
    public int getOrder() {
        // filter before NettyWriteResponseFilter
        return NettyWriteResponseFilter.WRITE_RESPONSE_FILTER_ORDER - 1;
    }
}

source: gharchive/issue

authors: ShahzebAnsari fzyzcjy spencergibb spring-cloud-issues sweat123

repo: spring-cloud/spring-cloud-gateway


text:
Too many tcp connections cause requests slow

my spring、spring cloud and gateway version
spring boot:2.3.12.RELEASE
spring cloud version:Hoxton.SR12
gateway version:2.2.9.RELEASE
i adjust reactor.netty.ioWorkerCount is cpu * 4
reactor.netty.ioSelectCount is 1
httpclient is default config
now we production env if tcp client more than 10000,request will too slow and reach 20 seconds.but we don't reproduced in test env.so i need you help,how to do this?use fixed httpclient pool? Or other?And i think 10000 connections is very easy for gateway,but i don't why slowly.

ok i find it.

May I ask how it was resolved in the end?

请问最后是怎么解决的呢？

authors: Yanch1994 hymagic skyfour


text:
Unexpected changes to query string

Describe the bug
I use gateway mvc to reverse proxy vite.
ProxyExchangeHandlerFunction changes the query string part of the url, causing vite to reply with different response.
Sample
originally http://localhost:5174/src/components/HelloWorld.vue?scoped=e17ea971&index=0&type=style&vue=&lang.css
change to http://localhost:5174/src/components/HelloWorld.vue?scoped=e17ea971&index=0&type=style&vue=&lang.css=
There is an extra '=' character at the end.
It all seems to be in ProxyExchangeHandlerFunction.handle caused by UriComponentsBuilder.replaceQueryParams.

SCG consider lang.css as a url parameter, and its value is empty.
Use stripPrefix or custum filter to remove the redundant char.

authors: fredliex kimmking


text:
Response body is not coming in SCG

Describe the bug
We are using Spring CLoud Gateway version 4.0.7 with Jetty client.
Our call flow is as follows
client --> SCG -> stub
What is happening is, request is sent from client which will be forwarded to the stub via SCG, stub responds with header and data.
At SCG to client -> the response body is not coming.
The call flow goes into error state.
We have attached sample application, and wireshark screenshot. Please take a look.
scg-app-demo.zip

Thank you!

I'm sorry, we only support the netty http client and corresponding routing filters. I don't have the bandwidth to debug custom routing filters.

authors: pwn-tndn spencergibb


text:
README file dedup

fixes #1319
The two files turn out to be exactly the same, so a simple include:: is enough.

Codecov Report

Merging #1329 into master will not change coverage.
The diff coverage is n/a.

@@            Coverage Diff            @@
##             master    #1329   +/-   ##
=========================================
  Coverage     67.72%   67.72%
  Complexity     1397     1397
=========================================
  Files           202      202
  Lines          5643     5643
  Branches        567      567
=========================================
  Hits           3822     3822
  Misses         1587     1587
  Partials        234      234

Flag
Coverage Δ
Complexity Δ

#integration
?
?

#unittests
67.72% <ø> (ø)
1397 <ø> (ø)
:arrow_down:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a9ebc50...a00f9b1. Read the comment docs.

authors: ChengyuanZhao codecov-io

repo: spring-cloud/spring-cloud-gcp

license_source: bigquery


text:
[WIP] Pubsub stream binder via synchronous pull

So we have something to point at when discussing the streaming/synchronous doc.

I am going to fix that commit history. I've created the branch off of pubsub-pull, which caused commits to be duplicated after rebase.


text:
Firestore extractDatabasePath update

Updating extractDatabasePath to avoid org.apache.commons.lang3 dependency

@dmitry-s Notice the build error though.

authors: dmitry-s meltsufin


text:
java.lang.IllegalArgumentException: name is required

execute AiNickNameClient#getNickNameTypeForAi(String) fail. Cause by: name is required.
java.lang.IllegalArgumentException: name is required.
u0009at feign.template.QueryTemplate.create(QueryTemplate.java:66)
u0009at feign.RequestTemplate.lambda$appendQuery$0(RequestTemplate.java:611)
u0009at java.util.HashMap.compute(HashMap.java:1197)
u0009at feign.RequestTemplate.appendQuery(RequestTemplate.java:609)
u0009at feign.RequestTemplate.query(RequestTemplate.java:573)
u0009at java.util.LinkedHashMap.forEach(LinkedHashMap.java:684)
u0009at feign.RequestTemplate.extractQueryTemplates(RequestTemplate.java:909)
u0009at feign.RequestTemplate.uri(RequestTemplate.java:423)
u0009at feign.RequestTemplate.uri(RequestTemplate.java:390)
u0009at feign.RequestTemplate.resolve(RequestTemplate.java:196)
u0009at feign.ReflectiveFeign$BuildTemplateByResolvingArgs.resolve(ReflectiveFeign.java:320)
u0009at feign.ReflectiveFeign$BuildTemplateByResolvingArgs.create(ReflectiveFeign.java:224)
u0009at feign.SynchronousMethodHandler.invoke(SynchronousMethodHandler.java:74)
u0009at feign.hystrix.HystrixInvocationHandler$1.run(HystrixInvocationHandler.java:106)
u0009at com.netflix.hystrix.HystrixCommand$2.call(HystrixCommand.java:302)
u0009at com.netflix.hystrix.HystrixCommand$2.call(HystrixCommand.java:298)
u0009at rx.internal.operators.OnSubscribeDefer.call(OnSubscribeDefer.java:46)
u0009at rx.internal.operators.OnSubscribeDefer.call(OnSubscribeDefer.java:35)
u0009at rx.internal.operators.OnSubscribeLift.call(OnSubscribeLift.java:48)
u0009at rx.internal.operators.OnSubscribeLift.call(OnSubscribeLift.java:30)
u0009at rx.internal.operators.OnSubscribeLift.call(OnSubscribeLift.java:48)
u0009at rx.internal.operators.OnSubscribeLift.call(OnSubscribeLift.java:30)
u0009at rx.internal.operators.OnSubscribeLift.call(OnSubscribeLift.java:48)
u0009at rx.internal.operators.OnSubscribeLift.call(OnSubscribeLift.java:30)
u0009at rx.Observable.unsafeSubscribe(Observable.java:10327)
u0009at rx.internal.operators.OnSubscribeDefer.call(OnSubscribeDefer.java:51)
u0009at rx.internal.operators.OnSubscribeDefer.call(OnSubscribeDefer.java:35)
u0009at rx.Observable.unsafeSubscribe(Observable.java:10327)
u0009at rx.internal.operators.OnSubscribeDoOnEach.call(OnSubscribeDoOnEach.java:41)
u0009at rx.internal.operators.OnSubscribeDoOnEach.call(OnSubscribeDoOnEach.java:30)
u0009at rx.internal.operators.OnSubscribeLift.call(OnSubscribeLift.java:48)
u0009at rx.internal.operators.OnSubscribeLift.call(OnSubscribeLift.java:30)
u0009at rx.Observable.unsafeSubscribe(Observable.java:10327)
u0009at rx.internal.operators.OperatorSubscribeOn$SubscribeOnSubscriber.call(OperatorSubscribeOn.java:100)
u0009at com.netflix.hystrix.strategy.concurrency.HystrixContexSchedulerAction$1.call(HystrixContexSchedulerAction.java:56)
u0009at com.netflix.hystrix.strategy.concurrency.HystrixContexSchedulerAction$1.call(HystrixContexSchedulerAction.java:47)
u0009at com.xxx.feign.enhance.RequestContextHystrixConcurrencyStrategy$RequestContextCallable.call(RequestContextHystrixConcurrencyStrategy.java:77)
u0009at org.springframework.cloud.sleuth.instrument.async.TraceCallable.call(TraceCallable.java:70)
u0009at com.netflix.hystrix.strategy.concurrency.HystrixContexSchedulerAction.call(HystrixContexSchedulerAction.java:69)
u0009at rx.internal.schedulers.ScheduledAction.run(ScheduledAction.java:55)
u0009at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
u0009at java.util.concurrent.FutureTask.run(FutureTask.java:266)
u0009at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
u0009at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
u0009at java.lang.Thread.run(Thread.java:748)

but the code have name：
@PostMapping(path = "/xxx")
    String getNameT(@RequestParam("data") String data);

This  happened by accident，in production environment

Please learn how to properly format code and logs.
Can you please show the full definition of the feign client?

I would hate to step over something but we hit up a similar issue and thought would post it here. If its a different issue please let me know i could create an separate issue.
That being said we encountered this when a RequestParam had

&&

in them. Here is a test project that replicates this behavior.

Feign Client

Test that could be run that would show the above error.

Another thing observed but have not written a test for this yet is if the QueryParameter contains a single '&' character in between and because of this code in RequestTemplate - it causes the parameter to be split up am assuming the resolution to above would resolve this as well.

Also if we pass the parameter as SpringQueryMap it gets encoded correctly and the test passes. Here is a test

Please let me know if this is valid.

Hi @naavo  - yes this looks like a different issue. Please create a separate one. Closing this one.

authors: OlgaMaciaszek naavo sdcuike spencergibb

repo: spring-cloud/spring-cloud-openfeign


text:
spring.cloud.stream.function.bindings property doesn't work as described in documentation

In Functional Composition section it is mentioned the following:
"For example, if we want to give our toUpperCase|wrapInQuotes a more descriptive name we can do so with the following property spring.cloud.stream.function.bindings.toUpperCase|wrapInQuotes-in-0=quotedUpperCaseInput"
However it seems that this property doesn't work. I have an example. This is the yaml file. However when I try to use the name uppercaseAndReverseInput in this test it fails.
I did different attempts but without positive results.

@SimoneGiusso It looks like you are adding the property under spring.cloud.function.bindings..., which is the incorrect level for that property. It should be under spring.cloud.stream.function.bindings... here.

authors: SimoneGiusso sobychacko

repo: spring-cloud/spring-cloud-stream


text:
Runtime errors with Boot 2.x

Mostly for heads up but boot is starting to break a lot of things
Caused by: java.lang.NoClassDefFoundError: org/springframework/boot/bind/RelaxedDataBinder
	at org.springframework.cloud.stream.binding.BindingService.validate(BindingService.java:174)
	at org.springframework.cloud.stream.binding.BindingService.bindConsumer(BindingService.java:96)
	at org.springframework.cloud.stream.binding.BindableProxyFactory.bindInputs(BindableProxyFactory.java:221)
	at org.springframework.cloud.stream.binding.InputBindingLifecycle.start(InputBindingLifecycle.java:55)

RelaxedDataBinder is gone, see https://github.com/spring-projects/spring-boot/issues/9000
I think we need to create 2.x so that we start to see what issues spring5/boot2 brings in.

@jvalkeal Yes, the plan is to get started on a 2.x branch in May.

Is there a build snapshot maven repository tracking the 2.x branch anywhere?  I don't see one at http://repo.spring.io/libs-snapshot/org/springframework/cloud/spring-cloud-stream/

Not yet, will have one next week once the binders are upgraded as well.

Closing this after merging @jvalkeal 's PR in the 2.0.x branch and making respective branches for all binders.
@davidwadden To your question - the BOM for Elmhurst release train (Based on 2.0) is CI-built now and available here https://repo.spring.io/libs-snapshot-local/org/springframework/cloud/spring-cloud-stream-dependencies/Elmhurst.BUILD-SNAPSHOT/

authors: davidwadden jvalkeal mbogoevici


text:
Guide Rewrite

This is a rewrite of the guide with many changes. In addition to content changes, structural changes were made to the guide as a potential template for future guide updates to follow.
Addresses issues #33, #32, #31, #29, #28.
Several changes were made to promote correctness, make for a better user experience, and allow the option to dual publish to Spring Academy in the future.

The README.adoc has no text content, but instead links to 3 separate files. This allows spring.io/guides to publish the guide with the full context, including Spring Initializr, while allowing Spring Academy to only be concerned with the guide specific content, located in content.adoc. There should be no change for how users view the guide on spring.io.
The README.adoc added an additional conditional section that can be set if rendering for Spring Academy to exclude certain sections.
The initial and complete folders were removed in favor of keeping only the solution in the root project directory. This should simplify the user experience by providing fewer places to look for code and create an easier experience when importing the project to an IDE. The user can still follow along with a blank project by starting with Spring Initializr. This format of keeping the code in the root directory makes it possible to easily load the project to Spring Academy as well.
A single build tool is used. For this guide, Gradle is used because it is the preferred build tool of the project driving the functionality of the guide, Spring Framework. Having a single build tool should simplify the user experience when importing the project to a local IDE. This ease of import is also important for the user experience when loading into Spring Academy.
A lot of references to the common macros project were removed. This was done to prioritize correctness and user experience over ease of guide creation. A few problems exist when trying to use a common template. First, the wording may be slightly off, as demonstrated by issue #33. The 'web' text in the line This web application is 100% pure Java... comes from a common file. Second, some teachings were incorrect. For example, in the popular rest-service guide, we advise the user that @ComponentScan will check the com/example package, but that information is not correct. It will in fact check the com/example/restservice package in this particular guide. Third, the commands to package the application as a jar file were not correct. The problem is persistent to all guides as described here.
References to dated technologies, i.e. web.xml and WAR files, were also removed. This was done when removing links to the common GitHub macro repository in favor of static text.
The Build an executable JAR section was renamed to Building the Application and text was added for using Cloud Native Buildpacks and Native Image compilation.

I think that instead of 3 separate files, using ifndef from AsciiDoc Conditionals would be a better approach.
If we choose to publish this guide to Spring Academy, we could set the variable env-exclude-spring-initializr to exclude certain sections. This can easily be achieved using a downdoc command:
npx downdoc -a env-exclude-spring-initializr README.adoc

@Buzzardo what do you think about this use of a conditional?
@joemoore do you think an approach could work for Spring Academy?

Converted to draft until I come up with a better solution to importing some common components from the getting started macros GitHub repository. Thanks for the feedback @mbhave!

I added a new file to the getting-started-macros repository that is intended to be a common section at the end of every guide.

The 3 files in this PR can be checked into the common macro project at a later date.

guide_intro.adoc
spring_academy_intro.adoc
spring_academy_see_also.adoc

Before those files are checked into the macro project and used as a template for all guides to follow, I'd like to verify that the process to convert content to Spring Academy (reducer, downdoc) is successful. This requires a GitHub action to execute, which should be performed on a non-forked repo.

repo: spring-guides/gs-scheduling-tasks


text:
PrimaryDefaultValidatorPostProcessor triggered at different time with AOT leads to incomplete Validator bean definition

In this sample, in AOT mode, NoUniqueBeanDefinition is thrown for Validator beans, even though one of the two is annotated with @ConditionalOnMissingBean:
org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'integrationMessageHandlerMethodFactory': Unsatisfied dependency expressed through method 'messageHandlerMethodFactory' parameter 1; nested exception is org.springframework.beans.factory.NoUniqueBeanDefinitionException: No qualifying bean of type 'org.springframework.validation.Validator' available: expected single matching bean but found 2: defaultValidator,mvcValidator

The problem is a different order of processing for BeanDefinitionRegistryPostProcessor. I have changed a custom code to use a callback of framework and that fixed the issue. Unfortunately, calling these has the side effects of contributing quite some more bean definitions, certain with not the type I'd expect. I am investigating.

This was already fixed as part of #1213 but I've added a test to validate the behaviour. @OlgaMaciaszek your sample app still doesn't work unfortunately as Spring Integration is not yet supported.

Ok - the users will need to wait till that's done then for these kinds of projects. Anyway, that user-provided sample has allowed us to discover and fix at least 3 different issues :) . Thanks, @matus753.

authors: OlgaMaciaszek snicoll


text:
GH-1071: JUnit 5 Support Improvements

Resolves https://github.com/spring-projects/spring-amqp/issues/1071

Remove JUnit4 dependency from RabbitAvailableCondition (minor breaking API change)
Add purgeAfterEach to @RabbitAvailable
tabs not spaces in RabbitAvailableCondition (review with ?w=1)
@LogLevels now requires level

convert more tests.

Does that mean that we are very close to remove hard dependency on JUnit 4 and only use it for rules in the test module?

I wouldn't say "very close", but certainly "closer".
We have one nut to crack - RepatableProcessor @Rule.
In most cases, it should be easy to replace with @RepeatableTest but there is one test case where the RepeatableProcessor calls the test method on multiple threads.

I added a couple more conversions with the push; I don't plan on doing any more today, so this can be merged.

authors: artembilan garyrussell

repo: spring-projects/spring-amqp


text:
what is new for 2.0 ?

Docs http://docs.spring.io/spring-android/docs/2.0.x/reference/pdf/spring-android-reference.pdf
do not explain why there is major version increase.

@royclarkson when do you plan to release 2.0? There was no activity on this repo since December. :cry:

@paulvi 2.0 was started in response to some changes in Spring Framework's RestTemplate. Spring for Android's RestTemplate had made some different API choices, and the initial goal of 2.0 was to bring those two close to parity. The major version number update was because of some of these minor, but breaking changes.
@WonderCsabo Unfortunately, we've had changes in priorities which mean this project is not receiving much attention right now. I'm happy to facilitate merging PRs, triaging issues, and pushing out releases.

Thanks! I was just asking so we can communicate  this correctly in the downstream AndroidAnnotations project.

@royclarkson BTW what is stopping you from release 2.0 as the current HEAD? Are there any blocking issues or missing features?

There's not anything critical, IIRC. I had gone through and merged in many of the improvements and updates from Spring Framework already. The main outstanding issue is the OkHttp support as mentioned in #24, and of course doc updates.

Alright, OkHttp (#24) support is in a better place now. Here are a few other outstanding items that would be nice to have addressed prior to pushing a GA.

remove Jackson 1.x support
update dependencies and fix resulting issues
https://jira.spring.io/browse/ANDROID-168
https://jira.spring.io/browse/ANDROID-163
https://jira.spring.io/browse/ANDROID-143

Went ahead and knocked out those first two items on the list.

What is the ETA of final release of 2.0?

2.0.0.M3 is now available for testing. It includes the latest OkHttp improvements. @jaredsburrows unfortunately, I don't have a specific ETA for the GA. I'm juggling some priorities, but working on getting those last few issues cleaned up. Thanks.

Hi, Roy. Will there be support for PATCH or should I like for another solution?
If anyone has a good reference in solving this usecase, I'm all eyes.
Thanks.

We have PATCH support in the latest 2.0 milestone. You can see the usage in code via a search. Most versions (or all?) of the native Android HTTP clients do not support PATCH, however. You'll need to include the dependency for either the Android port of Apache HttpClient 4.3, or OkHttp to make use of it. Hope that helps.

authors: WonderCsabo jaredsburrows paulvi primaproxima royclarkson

repo: spring-projects/spring-android


text:
Token exchange failed when the subject token is a client_credentials granted access token

Describe the bug
Token exchange failed when the subject token is a client_credentials granted access token.
To Reproduce

build a spring authorization server which enables client_credentials grant for 'user-client' and token-exchange grant for 'messaging-client'

spring:
  security:
    oauth2:
      authorizationserver:
        client:
          test-client:
            registration:
              client-id: "user-client"
              client-secret: "{noop}user"
              client-authentication-methods:
                - client_secret_basic
              authorization-grant-types:
                - client_credentials
              scopes:
                - user.read
          token-client:
            registration:
              client-id: "messaging-client"
              client-secret: "{noop}messaging"
              client-authentication-methods:
                - client_secret_basic
              authorization-grant-types:
                - urn:ietf:params:oauth:grant-type:token-exchange
              scopes:
                - message.read

get access token for 'user-client' using client_credentials grant
build resource server  'user-service' and 'messaging-service', user-service remote calls messaging-service
Access resource server 'user-service' with the access token above
token exchange failed due to the client_credentials granted access token does not have a 'princial' attribute, but OAuth2TokenExchangeAuthenticationProvider require a principal to be available via the subject_token for impersonation or delegation use cases:

Expected behavior
As per https://datatracker.ietf.org/doc/html/rfc8693，there doesn't appear to be any explicit prohibition against using an access token obtained through the client_credentials grant for token exchange.

@wapkch

As per https://datatracker.ietf.org/doc/html/rfc8693，there doesn't appear to be any explicit prohibition against using an access token obtained through the client_credentials grant for token exchange.

This is true but at the same time the spec does not make any reference to the client_credentials grant type either.
Furthermore, looking at the examples in Appendix A. Additional Token Exchange Examples, you will see the subject tokens referenced contain "sub":"bdc@example.net" and "sub":"user@example.net" that clearly indicate a user principal.
As well, in 1.1. Delegation vs. Impersonation Semantics, it states:

One common use case for an STS (as alluded to in the previous section) is to allow a resource server A to make calls to a backend service C on behalf of the requesting user B

The word "user" is referenced in many parts in the spec, which implies there is a Resource Owner principal associated to the subject token.
I'm curious, why are you using a client_credentials obtained access token to represent the subject token in the token_exchange grant? If the client needs another scope, (message.read as per your example) why wouldn't the messaging-client be configured for the client_credentials grant and obtain a new access token with the required scope?

@jgrandja
That makes a lot of sense! Thanks for the detailed explanation. You can close this now.

authors: jgrandja wapkch


text:
Provide access to PreparedStatement in the JdbcTemplate classes.

Hello,
I am building an application where I need to have direct access to the resulting PreparedStatement before it is executed by  the different methods of the template.  Currently the classes hide it from developers, making it less flexible.
I understand the approach, but in my case (where the execution happens in a reactor environment) it is impossible to make use of Spring Data.  You can provide access to the PreparedStatement as you already have it.
Thanks,
Juan
PS. Trying to use MemPOI.

Could you please explain in more detail what you are trying to do and why?
We generally don't give access to data structures we consider internal, because every such public API drives up maintenance.

Hi Jan, thanks for such a quick answer.
I think best is to show you a piece of code (incomplete) so you can understand the problem...
`// Using Apache POI and MemPOI (https://github.com/firegloves/MemPOI)
XSSFWorkbook workbook = new XSSFWorkbook();
try {
// Contains a list of SQL statements with named parameters.
List reports = loadReports();
if (reports != null) {
MempoiBuilder builder = MempoiBuilder.aMemPOI()
.withWorkbook(workbook)
.withAdjustColumnWidth(true);
int i = 0;
for (String sql : reports) {
PreparedStatement statement = dataSource.getConnection()
.prepareStatement(rep.sql);
                // @Wired DataSource dataSource...
                NamedParameterJdbcTemplate template   = new NamedParameterJdbcTemplate(dataSource);
                Map<String, ?>             parameters = new HashMap<>();
                // given parameters from and to are Instant
                parameters.put("from", Timestamp.from(from));
                parameters.put("to", Timestamp.to(to));
                String name = names.get(i);
                // Code below is just to show how MemPOI expects data to assemble the workbook.
                // It needs to run the assemblage together because the links between the workbook and the
                // sheets.  Not ideal, but understandable.
                PreparedStatementCallback<MempoiSheet> prepStmtCallBack = preparedStatement -> {
                    // MemPOI expects a PreparedStatement, but that is executed when the whole workbook is
                    // assembled. See code below.
                    MempoiSheet sheet = MempoiSheetBuilder.aMempoiSheet()
                                                          .withSheetName(name)
                                                          .withPrepStmt(preparedStatement)
                                                          .build();
                    return sheet;
                };
                // Is there anyway to attach this execution to the Future<> that is assembled by MemPOI?
                // see code below...
                MempoiSheet sheet = template.execute(sql, parameters, prepStmtCallBack);
                builder.addMempoiSheet(sheet);
                i++;
            }
            MemPOI                          memPOI = builder.build();
            CompletableFuture<MempoiReport> fut    = memPOI.prepareMempoiReport();
            // Here is the problem:
            // MemPOI executes the queries from the prepared statements when
            // fut is executed... but at this point, all preparedstatements are closed.
            // Obviously, they were ran through when the callback was called.
            MempoiReport report = fut.get();
            workbook.close();
            // Now we add the pivots by hand.                 .toSeconds());
        } else {
            log.error("Error: cannot load report information!");
        }
    } catch (Exception ex) {
        ...
    }`

If I could get the PreparedStatement with the parameters set and ready to be "queried" then that would solve my problem.  Obviously, I am responsible for closing it and freeing all resources.   I cannot use getPreparedStatementCreator, nor ParsedSql... there is simply no option in the way all the nice utility classes are protected.
So I have no way to use such a great idea of the named parameters template outside of the limitations of the provided methods.
That limits a lot.

authors: jfarjona schauder

repo: spring-projects/spring-data-relational


text:
Secured '/graphql' endpoint

Hello, team
Please help me to understand what I'm doing wrong. I'm trying to migrate our Spring Boot application from version 2.7.5 to 3.0.1.
We have secured '/graphql' endpoint using SecurityFilterChain bean:
.authorizeHttpRequests((authorizeRequests) ->
                authorizeRequests.requestMatchers("/graphql").access(new AdminAuthManager()))

public static class AdminAuthManager implements AuthorizationManager<RequestAuthorizationContext> {

        @Override
        public AuthorizationDecision check(Supplier<Authentication> authentication, RequestAuthorizationContext object) {
            if (isAnonymous()) {
                return new AuthorizationDecision(false);
            }
            return new AuthorizationDecision(true);
        }
    }

The request is received by my GraphQL controller and the correct response is returned from DB but at the end of request execution it is returned to spring AuthorizationFilter and SecurityContext is empty, this causes fail of the full request:
2023-01-06 13:03:27,995 [Traceid: 63b7ffff50b995f1f9375945ff600474, SpanId: c29b9c53cfabab31] 2398385 DEBUG graphql.GraphQL - Execution 'fbce998b-d787-2caa-f857-0441c3b0d249' completed with zero errors
2023-01-06 13:03:27,996 [Traceid: 63b7ffff50b995f1f9375945ff600474, SpanId: c29b9c53cfabab31] 2398386 DEBUG o.s.g.s.webmvc.GraphQlHttpHandler - Execution complete
2023-01-06 13:03:27,996 [Traceid: 63b7ffff50b995f1f9375945ff600474, SpanId: c29b9c53cfabab31] 2398386 DEBUG o.s.w.c.r.async.WebAsyncManager - Started async request
2023-01-06 13:03:27,997 [Traceid: 63b7ffff50b995f1f9375945ff600474, SpanId: c29b9c53cfabab31] 2398387 DEBUG o.s.w.c.r.async.WebAsyncManager - Async result set, dispatch to /admin/graphql
2023-01-06 13:03:27,997 [Traceid: 63b7ffff50b995f1f9375945ff600474, SpanId: c29b9c53cfabab31] 2398387 DEBUG o.s.web.servlet.DispatcherServlet - Exiting but response remains open for further handling
2023-01-06 13:03:27,998 [Traceid: 63b7ffff50b995f1f9375945ff600474, SpanId: f9375945ff600474] 2398388 DEBUG o.s.security.web.FilterChainProxy - Securing POST /graphql
2023-01-06 13:03:28,007 [Traceid: 63b7ffff50b995f1f9375945ff600474, SpanId: eee2beca764645fd] 2398397 DEBUG o.s.s.w.a.AnonymousAuthenticationFilter - Set SecurityContextHolder to anonymous SecurityContext
2023-01-06 13:03:30,972 [Traceid: 63b7ffff50b995f1f9375945ff600474, SpanId: 14b43c683496f98d] 2401362 DEBUG o.s.s.w.a.Http403ForbiddenEntryPoint - Pre-authenticated entry point called. Rejecting access
2023-01-06 13:03:30,974 [Traceid: , SpanId: ] 2401364 DEBUG o.s.security.web.FilterChainProxy - Securing POST /error
......
2023-01-06 13:03:30,980 [Traceid: 63b800023f4fe8e2a1e95d2c2d8981fa, SpanId: 4fe5b407a4134d43] 2401370 DEBUG o.s.s.w.a.AnonymousAuthenticationFilter - Set SecurityContextHolder to anonymous SecurityContext
2023-01-06 13:03:32,319 [Traceid: 63b800023f4fe8e2a1e95d2c2d8981fa, SpanId: a1e95d2c2d8981fa] 2402709 DEBUG o.s.s.w.a.Http403ForbiddenEntryPoint - Pre-authenticated entry point called. Rejecting access

I don't understand why Authorization is not propagated in SecurityContext
Thank you for any help

Could you share a sample application (something we can git clone or download) that shows the issue?

Hello,
I've implemented sample application for you that reproduces the issue. Please download from here https://github.com/idun-corp/neo4j-test
The issue itself is described in HELP.md

Thanks @marichka-spin for the sample application. I've managed indeed to reproduce the issue but I'm not familiar enough with the security setup to understand what changed.
@rwinch could you have a look?
Here's my current understanding of the problem.
The application configures a InternalAuthFilter before the UsernamePasswordAuthenticationFilter; this custom filter "hard codes" a PreAuthenticatedAuthenticationToken authentication in the Spring Security context. I guess this is a simplified version of an existing implementation.
This authentication is propagated as expected from the SecurityContextHolder to the GraphQL context during the execution of the GraphQL request. The GraphQL Controller com.proptechos.neo4j.graphql.DogQueryResolver is called as expected as well and returns the response object. Once the response has been completed asynchronously in the org.springframework.graphql.server.webmvc.GraphQlHttpHandler, the security context is overwritten with an anonymous user:
2023-01-11T16:37:12.216+01:00 DEBUG 67097 --- [nio-8083-exec-1] o.s.security.web.FilterChainProxy        : Securing POST /graphql
2023-01-11T16:37:12.253+01:00 DEBUG 67097 --- [nio-8083-exec-1] o.s.security.web.FilterChainProxy        : Secured POST /graphql
2023-01-11T16:37:12.436+01:00 DEBUG 67097 --- [nio-8083-exec-1] o.s.security.web.FilterChainProxy        : Securing POST /graphql
2023-01-11T16:37:12.440+01:00 DEBUG 67097 --- [nio-8083-exec-1] o.s.s.w.a.AnonymousAuthenticationFilter  : Set SecurityContextHolder to anonymous SecurityContext
2023-01-11T16:37:12.441+01:00 DEBUG 67097 --- [nio-8083-exec-1] o.s.s.w.a.Http403ForbiddenEntryPoint     : Pre-authenticated entry point called. Rejecting access

It looks like the async dispatch of the request is bypassing this custom filter. Is there something missing in the security configuration of this application? Do you know why we're getting a different behavior vs Spring GraphQL 1.0? If I'm not mistaken, we were already completing the GraphQL HTTP request asynchronously in the previous version. I'm wondering if this part of the Spring Security 6.0 upgrade docs is relevant.

@bclozel sorry, have you managed to solve this issue?

@marichka-spin sorry, have you managed to solve this issue?

Is there any update on this isccue? I can actually reproduce it.

We currently have the same problem, that the SecurityContext is not available after request filter. Thus Spring Security blocks the request.
By disabling authorization for ASYNC dispatchers,  we can work around.
.authorizeHttpRequests {    it.dispatcherTypeMatchers(DispatcherType.ASYNC).permitAll() }
But still not sure, looks like a Bug in Spring Graphql to me.

Investigating a bit deper in the problem, actually showed be that the root problem is that Spring for Graphql uses a async request dispatcher approach. Since, Spring Security 6 the SecurityContext is not "persisted" anymore automatically, and thus not available for subsequent requests. [see: Persisting Authentication] Therefore, we need to manually register the SecurityContextRepository, to make the context available for the async dispatcher.
For me this solved the problem.

Investigating a bit deper in the problem, actually showed be that the root problem is that Spring for Graphql uses a async request dispatcher approach. Since, Spring Security 6 the SecurityContext is not "persisted" anymore automatically, and thus not available for subsequent requests. [see: Persisting Authentication] Therefore, we need to manually register the SecurityContextRepository, to make the context available for the async dispatcher.
  http
  // ...
    .securityContext((securityContext) -> securityContext
      .securityContextRepository(new DelegatingSecurityContextRepository(
        new RequestAttributeSecurityContextRepository(),
        new HttpSessionSecurityContextRepository()
    ))
  );

For me this solved the problem.

Hi, I have the same problem.
This solution is not working for me, can you suggest in what direction to dig?
By the way config.dispatcherTypeMatchers(DispatcherType.ASYNC).permitAll(); works fine, but it is not how security should be configured.

Any updates on this issue? Running into the same problem.

Sorry about the delayed response.
I believe @StefanMessner is right as this behavior is due to a Spring Security behavior change that is documented in the migration guide.
Adding the following to the sample application "fixes" the issue.
 @Bean
    public SecurityFilterChain filterChain(HttpSecurity http,
                                           InternalAuthFilter internalAuthFilter) throws Exception {
        return http.addFilterBefore(internalAuthFilter, UsernamePasswordAuthenticationFilter.class)
                // disabling explicit save
                .securityContext((securityContext) -> securityContext.requireExplicitSave(false))
...

Developers should look into this topic to decide whether changing the default in their application is a good fit.
I'm closing this issue as a result.

Hi everyone. Since Spring Security 6.0 the SecurityContext must be explicitly saved by the user if they wish the context to be available in subsequent requests. The built-in authentication mechanisms from Spring Security already do that and you can configure which SecurityContextRepository should be used to save the SecurityContext.
However, when you specify a custom authentication filter without extending AuthenticationFilter/AuthenticationWebFilter, you also have to be aware that you should save the context. Considering the example from https://github.com/idun-corp/neo4j-test, there is an InternalAuthFilter that sets the SecurityContext in the SecurityContextHolder, but it does not save it anywhere else to be available in the ASYNC request. That said, I opened a PR with a suggested change to the implementation of InternalAuthFilter.
The 6.0 Migration Guide has some details about this as well.

Another solution would be to implement jakarta.servlet.Filter instead of extending OncePerRequestFilter, allowing the filter to be invoked again for the ASYNC dispatcher.
@Component
public class InternalAuthFilter implements Filter {

    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {

        UserPrincipal principal = UserPrincipal.authenticated();

        //Granting authorities
        List<SimpleGrantedAuthority> grantedAuthorities = principal.getRoles().stream()
            .map(SimpleGrantedAuthority::new)
            .collect(Collectors.toList());

        final PreAuthenticatedAuthenticationToken authentication =
            new PreAuthenticatedAuthenticationToken(principal, null, grantedAuthorities);
        authentication.setAuthenticated(!grantedAuthorities.isEmpty());
        authentication.setDetails(principal);
        SecurityContext context = SecurityContextHolder.createEmptyContext();
        context.setAuthentication(authentication);
        SecurityContextHolder.setContext(context);
        filterChain.doFilter(request, response);
    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        doFilterInternal((HttpServletRequest) servletRequest, (HttpServletResponse) servletResponse, filterChain);
    }

}

authors: StefanMessner asndevever bclozel jelena-pesevski marcusdacoregio marichka-spin schmoellphi

repo: spring-projects/spring-graphql


text:
GH-1587: Option to Correct Transactional Offsets

Resolves https://github.com/spring-projects/spring-kafka/issues/1587
See javadoc for ConsumerProperties.setFixTxOffsets() for more information.
cherry-pick to 2.5.x

... and cherry-picked to 2.5.x

repo: spring-projects/spring-kafka