Configure Spring Security 5 Oauth 2 to use access_token uri parameter

Question

I am creating an application based on this example -

Background -

https://github.com/spring-projects/spring-security/tree/master/samples/boot/oauth2resourceserver-webflux

It works perfectly fine of the OAuth2 token is in the Header.

Problem -

However I would like to change it to use an OAuth 2 token in the url. I am trying to create a OAuth2 resource server.

Analysis-

It seems Spring Security supports getting the token from access_token parameter -

https://github.com/spring-projects/spring-security/blob/e3eaa99ad06769cf44ad3e1249f6398077b90834/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/server/ServerBearerTokenAuthenticationConverter.java#L57

However it seems to be disabled by default -

https://github.com/spring-projects/spring-security/blob/master/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/server/ServerBearerTokenAuthenticationConverter.java#L48

Now this class is not accessible outside the spring hierarchy is directly created here -

https://github.com/spring-projects/spring-security/blob/master/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java#L955

Question?

Is there a to set this allowUriQueryParameter to true in my code?

Update

I am creating a OAuth2 resource server. Unfortunately the OAuth2ResourceServerSpec does not allow authenticationConverter to be set.

Answer 1

The Pushkar answer didn't work for me but helped me to find the solution, the following code did the trick:

DefaultBearerTokenResolver resolver = new DefaultBearerTokenResolver();
resolver.setAllowUriQueryParameter(true);

http.authorizeRequests()
        .anyRequest().authenticated()
        .and().oauth2ResourceServer().bearerTokenResolver(resolver)
        .jwt();

Thanks.

Answer 2

Now with Spring Security 5.1.5 we can do this -

ServerBearerTokenAuthenticationConverter 
authenticationConverter = new ServerBearerTokenAuthenticationConverter();
authenticationConverter.setAllowUriQueryParameter(true);

http.oauth2ResourceServer().bearerTokenConverter(authenticationConverter).jwt();