title: Spring security oauth2 - add filter after oauth/token call
body: <p>I am using Spring Boot <code>2.1.1.RELEASE</code> (<code>spring-security-oauth2</code>-<code>2.3.4.RELEASE</code>).</p>
  
  <p>I would like to create a filter with precedence after <code>TokenEndpoint#postAccessToken</code> call. Why ? 'cause in that filter I want to take the token from the <code>tokenStore</code> and add it as a cookie to the response.</p>
  
  <p>I would expect that, this will give me what I want:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      http
      .(...)
      .addFilterAfter(new MyFilter(), BasicAuthenticationFilter.class);
  }
  </code></pre>
  
  <p>But it doesn't. I can see, that <code>BasicAuthenticationFilter</code> is called after successfull authentication on <code>oauth/token</code> but it doesn't enter my <code>MyFilter</code>.</p>
  
  <p>What am I suppose to do to call <code>MyFilter</code> after <code>oauth/token</code> call ?</p>
  
  <hr>
  
  <blockquote>
    <p>You want to set cookie from authorization server or from resource server?
    Is your auth server and resource server both are in same context? or different applications.?</p>
  </blockquote>
  
  <p>I have two microservices. First one is authorization server, that provides jwt tokens (signed by its private key). Second microservice is a resource server, that validates tokens based on authorization server public key (exposed via REST endpoint by Auth server)</p>
  
  <blockquote>
    <p>Do you want to set after receiving access_token from authorization server? What > do you want to do by setting cookie?</p>
  </blockquote>
  
  <p>No. I would like the authorization server to set a cookie when <code>oauth/token</code> call is made by the frontend application. That way the browser is responsible for adding a token to each request rather than my frontend app. That protects me against XSS attack, as the cookie will be set as <code>httpOnly</code> and <code>secure</code>.</p>
  
  <blockquote>
    <p>Is your plan is to read cookie for getting access_token?</p>
  </blockquote>
  
  <p>Correct. But that supposed to be done by resource server (haven't done that, yet)</p>
  
  <blockquote>
    <p>simple way is to create an API for the same functionality. Which takes access_token as request parameter and sets the cookie.</p>
  </blockquote>
  
  <p>Are you suggesting something like a proxy microservice that stands between frontend application and auth/resource servers ? proxy microservice that is setting jwt token as cookie, and read token from cookie ?</p>