GraphQL and Spring Security @PreAuthorize for Spring Boot webflux project

[stasbit]

Hello team,

I was recently asked to add Security support for kotlin Spring boot webflux service. After add certain spring security dependencies, I observer that test endpoint retruns Access Denied exception.

How to reproduce

1. Test service - https://github.com/stasbit/webflux-security-demo-service
2. Create test JWT token(http://jwtbuilder.jamiekurtz.com) here and put it to cookie "access_token". Add Claim Type "Roles" with values 'USER, MANAGER'
3. Send Query to getAllBooks

[dariuszkuc]

Have you checked #1300?

[stasbit]

Hi!
@dariuszkuc
#1300 working solution for Reactive context restoration. Am I right that in case of call(query, mutation) of GraphQL Endpoint, Reactive context should me recreated in this way each time you need to have something in this Reactive context. So in my case it was restore of Security context. But there can be more key, values which I do need in the underlying web app. Do I understand situation correctly?

[dariuszkuc]

As per #1300 reactive security context is stored in the GraphQLContext which is restored in the data fetcher prior to executing any field. That should be sufficient for spring security to work. If you have other items in your reactive context that you need to propagate down (e.g. tracing info) then you would propagate it in similar way.