Expected Behavior
developer can custom AuthorizationRequestRepository implement if they dont want to use session
Current Behavior
we cant set custom AuthorizationRequestRepository now, we need extend Oauth2Filter and rewrite constructor to solve this.
Comment From: jzheaux
You can already customize the AuthorizationRequestRepository through HttpSecurity like so:
@Bean
SecurityFilterChain appSecurity(HttpSecurity http) {
http
.oauth2Login((oauth2) -> oauth2
.authorizationCodeGrant((grant) -> grant
.authorizationRequestRepository(myCustomRepository)
)
)
// ...
return http.build();
}
For more details, please see the AuthorizationRequestRepository section in the reference manual