vert-x3/vertx-web

Component: vertx-web / OAuth2AuthHandler Affected: Vert.x 5.x (confirmed on 5.1.6) Regression: Behavior differs from 4.x Description In Vert.x 5, OAuth2AuthHandler falls back to the current route's "scopes" metadata when no scopes are explicitly configured. This can cause scopes to be enforced even though the application never configured scope validation on the handler. This is especially problematic with vertx-web-openapi-router, which can automatically add scope metadata based on the OpenAPI security definition. For applications that use OAuth2AuthHandler only for authentication and implement authorization separately (e.g. roles/permissions), this can result in unexpected 403 responses. In Vert.x 4.x, scope validation was only performed when scopes were explicitly configured. Example OAuth2AuthHandler.create(vertx, provider); If the matched route contains: metadata["scopes"] = ["some-scope"] the handler will validate some-scope against the token, even though the application never con

Describe the feature With the advent of HTTP/3 we should implement in vertx-web an handler supporting alternative services broadcasting using a declarative configuration. router.route().handler(AltSvcHandler.create(new AltSvcOptions().addOrigin("https://foo.com", "h3:bar.com:5000"))); The goal of this handler is to only send once an alt-svc notification for a given origin, to avoid flooding the client with useless notifications. Contribution No response