Spring / Spring7 Intermediate to Advanced Interview questions
How does Spring Security 7 improve OAuth2 client support for HTTP service clients like RestClient?
Spring Security 7 adds OAuth2 support directly into the builders for HTTP service clients, so an outbound call to a protected downstream API can have a bearer token attached automatically instead of the application manually managing token acquisition and refresh in an interceptor.
@Bean @ClientRegistrationId("inventory-service") public InventoryClient inventoryClient(RestClient.Builder builder) { RestClient client = builder.baseUrl("https://inventory.internal").build(); HttpServiceProxyFactory factory = HttpServiceProxyFactory .builderFor(RestClientAdapter.create(client)).build(); return factory.createClient(InventoryClient.class); }
Placing @ClientRegistrationId at the class level, rather than repeating it on every method, is a smaller but meaningful convenience addition - previously each individual call site needed its own registration-id annotation even when a whole client interface always talked to the same downstream service. Together these changes reduce the amount of hand-written token-management plumbing needed for service-to-service OAuth2 calls.
What does OAuth2 support in HTTP service client builders eliminate the need for?
Where can @ClientRegistrationId now be placed to avoid repeating it per method?
More Related questions...
