Expected Behavior

developer can custom AuthorizationRequestRepository implement if they dont want to use session

Current Behavior

we cant set custom AuthorizationRequestRepository now, we need extend Oauth2Filter and rewrite constructor to solve this.

Comment From: jzheaux

You can already customize the AuthorizationRequestRepository through HttpSecurity like so:

@Bean 
SecurityFilterChain appSecurity(HttpSecurity http) {
    http
        .oauth2Login((oauth2) -> oauth2
            .authorizationCodeGrant((grant) -> grant
                .authorizationRequestRepository(myCustomRepository)
            )
        )
        // ...
    return http.build();
}

For more details, please see the AuthorizationRequestRepository section in the reference manual