From 7f2493e76b191da7c5800a599109f580b9728b71 Mon Sep 17 00:00:00 2001
From: Dylan Decrulle <81740200+ddecrulle@users.noreply.github.com>
Date: Wed, 4 Nov 2026 10:52:05 +0100
Subject: [PATCH] fix(security): enable DPoP support on the resource server

Spring Security 6.5 enabled DPoP automatically on oauth2ResourceServer;
Spring Security 7 (Spring Boot 4) requires opting in with .dPoP().
Without it, requests sent with "Authorization: DPoP <token>" by Onyxia
web are rejected with 401.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../java/fr/insee/onyxia/api/security/OIDCConfiguration.java  | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/onyxia-api/src/main/java/fr/insee/onyxia/api/security/OIDCConfiguration.java b/onyxia-api/src/main/java/fr/insee/onyxia/api/security/OIDCConfiguration.java
index 205f8dd6..78070378 100644
--- a/onyxia-api/src/main/java/fr/insee/onyxia/api/security/OIDCConfiguration.java
+++ b/onyxia-api/src/main/java/fr/insee/onyxia/api/security/OIDCConfiguration.java
@@ -168,6 +168,10 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
                         httpSecurityOAuth2ResourceServerConfigurer -> {
                             httpSecurityOAuth2ResourceServerConfigurer.jwt(
                                     Customizer.withDefaults());
+                            // Spring Security 7 no longer enables DPoP automatically (it did in
+                            // 6.5): Onyxia web sends DPoP-bound tokens ("Authorization: DPoP")
+                            httpSecurityOAuth2ResourceServerConfigurer.dPoP(
+                                    Customizer.withDefaults());
                         });
         return http.build();
     }