Missing persisted `OAuth2AuthorizedClient` in sessions about spring-session HOT 5 CLOSED

Hi, @Haarolean.

The OAuth2AuthorizedClientService is from Spring Security, therefore you would need to open an issue on its issue tracker. I would argue that if you need something specific for Redis, you would need to provide your own implementation.

from spring-session.

@marcusdacoregio thank you for a swift reply. However, I'm not sure that relates to spring-security. As we're (in spring-session-data-redis, not spring-security) altering the session storage mechanism, this seems to be an issue with spring-session, as without it everything would work fine as everything would be stored in memory.

from spring-session.

I don't think I follow. If you are using Spring Session Redis then your session will be stored in a Redis instance transparently to the application. Maybe you are confused between OAuth2AuthorizedClientService and OAuth2AuthorizedClientRepository, where the latter has the HttpSessionOAuth2AuthorizedClientRepository implementation.

from spring-session.

Yes, indeed, there's an implementation of OAuth2AuthorizedClientRepository, but there's no implementation of the OAuth2AuthorizedClientService which will let us use the HttpSessionOAuth2AuthorizedClientRepository as underlying storage mechanism. So, with spring-session-redis (or any other package) we have broken OAuth2AuthorizedClient storage mechanism out of the box.

from spring-session.

It is not intended to store authorized clients in the session after the user has logged in. The reason they are stored there at all is for anonymous users who would otherwise clutter up the database with junk records. Once a user is logged in, their authorized client should be stored in a database where it can be managed and revoked if a leak occurs. If you still want to use sessions you can do:

@Bean
public OAuth2AuthorizedClientRepository authorizedClientRepository() {
    return new HttpSessionOAuth2AuthorizedClientRepository();
}

from spring-session.