DPoP filter is ignored when another AuthenticationFilter is present

[gbaso]

DPoP filter is implemented as a an AuthenticationConverter applied to an AuthenticationFilter. AuthenticationFilter extends OncePerRequestFilter, which means that only the first filter of that type actually do its filtering. An attribute then is added to the request that prevents additional filters of the same type to do anything other than proceeding to the next filter.

In my experience, AuthenticationFilter plus AuthenticationConverter is the easiest way to create a custom filter, therefore I believe it to be very commonly used. Depending on the configuration, either DPoP or the custom filter is completely disabled, based on the filter ordering.

Sample application with oauth2 resource server + custom API key: https://github.com/gbaso/oauth2-api-server

[jgrandja]

@gbaso Thanks for reporting this. Indeed this is an issue if there is more than one AuthenticationFilter in the chain.

Overriding OncePerRequestFilter.getAlreadyFilteredAttributeName() would solve this issue.

Would you be interested in submitting a fix?

[therepanic]

If no one would mind, I could prepare a fix.

[gbaso]

@therepanic you can go ahead

[jgrandja]

@gbaso This is now resolved via gh-17216. I'll mark this as a duplicate.