title: Configure Spring Security 5 Oauth 2 to use access_token uri parameter
body: <p>I am creating an application based on this example -</p>
  
  <p><strong>Background -</strong></p>
  
  <p><a href="https://github.com/spring-projects/spring-security/tree/master/samples/boot/oauth2resourceserver-webflux" rel="nofollow noreferrer">https://github.com/spring-projects/spring-security/tree/master/samples/boot/oauth2resourceserver-webflux</a></p>
  
  <p>It works perfectly fine of the OAuth2 token is in the Header. </p>
  
  <p><strong>Problem -</strong></p>
  
  <p>However I would like to change it to use an OAuth 2 token in the url. I am trying to create a OAuth2 resource server.</p>
  
  <p><strong>Analysis-</strong></p>
  
  <p>It seems Spring Security supports getting the token from access_token parameter -</p>
  
  <p><a href="https://github.com/spring-projects/spring-security/blob/e3eaa99ad06769cf44ad3e1249f6398077b90834/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/server/ServerBearerTokenAuthenticationConverter.java#L57" rel="nofollow noreferrer">https://github.com/spring-projects/spring-security/blob/e3eaa99ad06769cf44ad3e1249f6398077b90834/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/server/ServerBearerTokenAuthenticationConverter.java#L57</a></p>
  
  <p>However it seems to be disabled by default -</p>
  
  <p><a href="https://github.com/spring-projects/spring-security/blob/master/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/server/ServerBearerTokenAuthenticationConverter.java#L48" rel="nofollow noreferrer">https://github.com/spring-projects/spring-security/blob/master/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/server/ServerBearerTokenAuthenticationConverter.java#L48</a></p>
  
  <p>Now this class is not accessible outside the spring hierarchy is directly created here -</p>
  
  <p><a href="https://github.com/spring-projects/spring-security/blob/master/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java#L955" rel="nofollow noreferrer">https://github.com/spring-projects/spring-security/blob/master/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java#L955</a></p>
  
  <p><strong>Question?</strong></p>
  
  <p>Is there a to set this <strong>allowUriQueryParameter</strong> to true in my code?</p>
  
  <p><strong>Update</strong></p>
  
  <p>I am creating a OAuth2 resource server. Unfortunately the OAuth2ResourceServerSpec does not allow authenticationConverter to be set. </p>