Prevent concurrent OAuth2 client authorization requests

Contribution Overview

The Engineering Context

This contribution was made to the spring-projects/spring-securityopen-source repository. The work involved understanding the existing codebase, identifying the underlying engineering problem, implementing a focused solution, and validating the change against the project's existing behaviour and testing standards.

Engineering Problem

Understanding the Problem

Concurrent authorization calls for the same OAuth2 client registration and principal could independently invoke the OAuth2AuthorizedClientProvider, resulting in duplicate authorization work and inconsistent concurrent processing.

Solution

Implementation Approach

Introduced coordination of in-flight authorization requests using OAuth2AuthorizedClientId, ConcurrentHashMap, and CompletableFuture. Concurrent callers now wait for and reuse the same authorization result, while failures are propagated and completed requests are removed safely. Added a regression test verifying that only one provider authorization occurs during concurrent calls.

Technologies

Engineering Stack