rwinch / spring-reactive-security Goto Github PK

Once Rossen provides templates we can provide Form Based Login

BasicAuthenticationFilter verifies passwords synchronously but password verification can take quite some time when passwords are stored securely (i.e. BCrypt). We should verify the password on another Thread

• Is there an easy way to provide defaults in WebClient? For example, can I make WebClient default to use application/json accept header, have a base URL of https://example.com/a, include basic authentication header of rob:secret, etc?
• Is there a reason that WebClient uses perform(DefaultHttpRequestBuilder builder) as apposed to perform(HttpRequestBuilder builder)? I see that there is a missing method on the interface, but it is weird to me that we have the interface since it does not appear to be used?
• I’m also wondering if we can think about extensions to building request, so we can support something like this: get(url).with(httpBasic("rob", "secret"))
• Why does DefaultHttpRequestBuilder use ClientHttpRequestFactory to create the ClientHttpRequest, but then need to populate the body on ClientHttpRequest. Either the method name might change or we might move around some logic?
• Why does DefaultHttpRequestBuilder write errors to the body of the client rather than throwing exception or change return type to Mono and reporting the error that way?
• DefaultHttpRequestBuilder uri variables isn't used in constructor?
• 'contentStream(Publisher content)' should be generic Publisher?

We should change the package names and place in a separate jar