Incorrect Location For Setting SecurityContext in Reactive Web Flux Security

Currently we are creating SecurityContext in AuthenticationWebFilter. And SecurityContext is null in all filters wrapping AuthenticationFilter. Its interfering with the usecase of using custom SecurityContext implementation and not allowing us to set DomainContext on it and not allowing us to use DomainContext information in Authentication.

public class ExtendedSecurityContextImpl extends SecurityContextImpl {
    private DomainContext domainContext;
    public DomainContext getDomainContext() {
        return domainContext;
    }

    public void setDomainContext(DomainContext domainContext) {
        this.domainContext = domainContext;
    }
}

public class DomainContext implements Serializable {

    private final ServerWebExchange exchange;

    public DomainContext(final ServerWebExchange exchange) {
        this.exchange = exchange;
    }


    public Mono<String> getRemoteAddress(){
        return Mono.just(exchange.getRequest())
                .map(ServerHttpRequest::getRemoteAddress)
                .map(InetSocketAddress::getAddress)
                .map(InetAddress::getHostAddress);
    }


}

public class SecurityContextCompositeWebFilter implements WebFilter {


    @Override
    public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
        return ReactiveSecurityContextHolder.getContext()
                .log()
                .filter(ExtendedSecurityContextImpl.class::isInstance)
                .log()
                .cast(ExtendedSecurityContextImpl.class)
                .log()
                .doOnSuccess(context -> context.setDomainContext(new DomainContext(exchange)))
                .then(chain.filter(exchange)).log();
    }
}

@Bean
    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        http
                .authorizeExchange()
                .pathMatchers(HttpMethod.GET, RequestMappingPaths.PATH_ROOT).hasAuthority(Role.ROLE_ADMIN)
                .pathMatchers(HttpMethod.GET, RequestMappingPaths.PATH_FAVICON).permitAll()
                .pathMatchers(HttpMethod.GET, apiPath(PATH_GET_ME)).hasAuthority(Role.ROLE_ADMIN)
                .pathMatchers(HttpMethod.GET, apiPath(PATH_GET_USERS)).hasAuthority(Role.ROLE_ADMIN)
                .anyExchange().denyAll()
                .and()
                .csrf().disable()
                .addFilterAt(filterConfig.securityContextCompositeWebFilter(), SecurityWebFiltersOrder.HTTP_BASIC)
                .addFilterAt(filterConfig.authenticationWebFilter(), SecurityWebFiltersOrder.AUTHENTICATION)
                .exceptionHandling()
                .authenticationEntryPoint(authenticationEntryPoint)
                .accessDeniedHandler(accessDeniedHandler)
                .and()
        ;
        return http.build();

    }

[ankurpathak]

@rwinch Great Idea of creating custom context for request. Solved all my problems. Here is what I did:

final public class DomainContext implements Serializable {

    private final Mono<String> ip;

    public DomainContext(final ServerWebExchange exchange) {
        ip = Mono.just(exchange)
                .map(ServerWebExchange::getRequest)
                .map(ServerHttpRequest::getRemoteAddress)
                .map(InetSocketAddress::getAddress)
                .map(InetAddress::getHostAddress);
    }

    public Mono<String> getIp(){
        return ip;
    }
}

public class ReactiveDomainContextHolder {

    private static final Class<?> DOMAIN_CONTEXT_KEY = DomainContext.class;


    public static Mono<DomainContext> getContext() {
        return Mono.subscriberContext()
                .filter( c -> c.hasKey(SECURITY_CONTEXT_KEY))
                .flatMap( c-> c.<Mono<DomainContext>>get(DOMAIN_CONTEXT_KEY));
    }

    
    public static Function<Context, Context> clearContext() {
        return context -> context.delete(SECURITY_CONTEXT_KEY);
    }

    
    public static Context withDomainContext(Mono<? extends DomainContext> domainContext) {
        return Context.of(SECURITY_CONTEXT_KEY, domainContext);
    }

}

public class DomainContextWebFilter implements WebFilter {


    @Override
    public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
        DomainContext context = new DomainContext(exchange);
        return chain.filter(exchange)
                .subscriberContext(ReactiveDomainContextHolder.withDomainContext(Mono.just(context)));
    }
}

protected DomainContextWebFilter domainContextWebFilter(){
        return new DomainContextWebFilter();
    }

               http .addFilterAt(filterConfig.domainContextWebFilter(), SecurityWebFiltersOrder.REACTOR_CONTEXT)

[ankurpathak]

@rwinch Ok got your point. Even I agree I can do that with details object placed in Authentication token send and returned .Lets take look at these Mongo Collections(Spring Data MongoDb) we use in our project:

@Document(collection = Product.COLLECTION)
public class Product extends ExtendedDomain<String> implements Serializable {
   
    public static final String COLLECTION = "#{'products' +  T(co.indexify.util.SecurityUtil).getOrganization()}";
}

@Document(collection = UserVisitor.COLLECTION)
public final class UserVisitor extends ExtendedDomain<String> {
    public static final String COLLECTION = "#{'userVisitors' + T(co.indexify.util.SecurityUtil).getUser()}";
}

These mongo collections are using requestedUser and requestedOrganization store in DomainContext by SPEL in their names. So this information will be required always and this won’t be possible to do this with Authentication. So for this use I thing DomainContext on Custom SecurityContext is best place to do. What do you think??