Copilot commented on code in PR #149:
URL:
https://github.com/apache/fineract-consumer-facing/pull/149#discussion_r4076368894
##########
consumer/src/main/java/org/apache/fineract/consumer/infrastructure/configs/SecurityConfig.java:
##########
@@ -81,6 +84,8 @@ public SecurityFilterChain securityFilterChain(HttpSecurity
http,
.oauth2ResourceServer(oauth2 -> oauth2
.bearerTokenResolver(SecurityConfig::resolveAccessTokenCookie)
.jwt(jwt -> jwt.decoder(accessTokenJwtDecoder)))
+ .addFilterBefore(new CorrelationIdFilter(correlationIdHolder),
+ BearerTokenAuthenticationFilter.class)
Review Comment:
This is only added to the order-3 login chain, but
`OAuth2AuthorizationServerConfig` has higher-priority chains for
`/api/v1/oauth2/**` and `/api/v1/openbanking/**`. Those requests bypass this
filter, so they get no response/MDC correlation ID and any Feign calls made
from token customization or open-banking services cannot forward one. Register
the filter for all security chains (or as a servlet-wide filter) so every
backend entry point is covered.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
