How does it work with springboot3 ?

[clementSabattie]

hello, i'm trying to use this lib with springboot3 and Google.

First of all, can somebody can validate (or not) my hypotheses:

1. The Authorization Server is Google
2. The Client si the web browser
3. The Ressource Server is my backend.

So I understand with this lib, I have to define only the Ressource Server.

How can i do that ? I tried

application.yml

spring:
    security:
        oauth2:
            resourceserver:
                opaque-token:
                    introspection-uri: https://www.googleapis.com/
                    client-id: myClient
                    client-secret: mySecret

SecurityConfig.java

import lombok.RequiredArgsConstructor;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpStatus;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.HttpStatusEntryPoint;
import org.springframework.web.reactive.function.client.WebClient;

import static org.springframework.security.config.http.SessionCreationPolicy.STATELESS;

@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
public class SecurityConfig {

    private final WebClient userInfoClient;

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .cors(Customizer.withDefaults())
            .exceptionHandling(customizer -> customizer.authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED)))
            .sessionManagement(c -> c.sessionCreationPolicy(STATELESS))
            .authorizeHttpRequests((authorize) -> authorize
                .requestMatchers("/", "/auth/**").permitAll()
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(c -> c.opaqueToken(Customizer.withDefaults()));
        return http.build();
    }

}

It doesn't works.