Search code examples
springspring-securityoauthspring-social

spring-social: ProviderSignInController: Why signIn(...) with POST only?

Is there a specific reason why a user sign-in with {providerId} can only be initiated with a POST request (to /signin/{providerId})? Why not with a GET request?

Solution

  • Answering my own question: Maybe because of

    /**
 * Process the authentication callback when neither the oauth_token or code parameter is given, likely indicating that the user denied authorization with the provider.
 * Redirects to application's sign in URL, as set in the signInUrl property.
 * @return A RedirectView to the sign in URL
 */
@RequestMapping(value="/{providerId}", method=RequestMethod.GET)
public RedirectView canceledAuthorizationCallback() {
    return redirect(signInUrl);
}

    Anyway, it would be nice if a sign-in with a GET request would be possible, too (with a different URL or a parameter narrowing the mapping).