3 ms·
Now make it with user-configurable credentials (like extracted from database) with proper token caching. With similar code I almost made a vulnerability in my
by vbezhenar 3y ago
Now make it with user-configurable credentials (like extracted from database) with proper token caching.
With similar code I almost made a vulnerability in my app because Spring cached tokens which belong to different users.
Spring security is terrible piece of code. Spring - I can stand it. Spring Security - I can not. It was different project back in the day (Acegi Security if I remember correctly). It should have stayed that way.
- zapnuk 3y agoThis already uses user-configurable credentials. It uses an autowired "ClientRegistrationRepository" that provides the credentials. We load the credentials once from AWS SecretsManager but I'm sure you could also load them from some DB. But yes, I'd probably prefern a modern rewrite of Spring Security.
- sverhagen 3y agoAnd yet, it is probably still much more secure than what 90% of us can whip together. I mean, maybe there's something better out there. I'm just pushing back on any suggestions that you should rather roll your own. Because, unless you're the other 10%, in an organization where continuity of that skill-set is taken care of, you definitely should not.