title: Protecting REST API with OAuth2: Error creating bean with name 'scopedTarget.oauth2ClientContext': Scope 'session' is not active
body: <p>I've been working for a few days to attempt to implement oauth2 protection on a REST API. I've tried a ton of different configurations but still haven't managed to get it to work. </p>
  
  <p>I'm proving the code that I have right now, but I'm in no way married to this implementation. If you can show me some radically different way to accomplish what I want to accomplish, great. </p>
  
  <p>My flow looks like this:</p>
  
  <ol>
  <li>Client checks Auth Server, gets token.</li>
  <li>Client sends token to Resource Server.</li>
  <li>Resource Server uses Auth Server to make sure that token is valid.</li>
  </ol>
  
  <p>The Auth Server works fine. I'm having trouble configuring the Resource Server.</p>
  
  <h1>Configs on Resource Server</h1>
  
  <p>Here's some of my configs. I have this bean: </p>
  
  <h3>Ouath Rest Template</h3>
  
  <pre><code>@EnableOAuth2Client
  @Configuration
  @Import({PropertiesConfig.class}) //Imports properties from properties files.
  public class OauthRestTemplateConfig {
  
  
  
   @Bean
      public OAuth2RestTemplate oAuth2RestTemplate(OAuth2ClientContext oauth2ClientContext) {
          OAuth2RestTemplate template = new OAuth2RestTemplate(oauth2ResourceDetails(), oauth2ClientContext);
          return template;
      }
  
      @Bean
      OAuth2ProtectedResourceDetails oauth2ResourceDetails() {
          AuthorizationCodeResourceDetails details = new AuthorizationCodeResourceDetails();
          details.setId("theOauth");
          details.setClientId("clientID");
          details.setClientSecret("SecretKey");
          details.setAccessTokenUri("https://theAuthenticationServer.com/oauthserver/oauth2/token");
          details.setUserAuthorizationUri("https://theAuthenticationServer.com/oauthserver/oauth2/token");
          details.setTokenName("oauth_token");
          details.setPreEstablishedRedirectUri("http://localhost/login");
          details.setUseCurrentUri(true);
          return details;
      }
  }
  </code></pre>
  
  <h3>Security Config</h3>
  
  <p>I use that bean in my main security config in Resource Server:</p>
  
  <pre><code>@Slf4j
  @Configuration
  @EnableWebSecurity
  @EnableOAuth2Client
  @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true, proxyTargetClass = true)
  @Import({PropertiesConfig.class, OauthRestTemplateConfig.class})
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      @Qualifier("oAuth2RestTemplate")
      private OAuth2RestTemplate oAuth2RestTemplate;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http
                  .authorizeRequests()
                  .accessDecisionManager(accessDecisionManager()) //This is a WebExpressionVoter. I don't think it's related to the problem so didn't include the source.
                      .antMatchers("/login").permitAll()      
                  .antMatchers("/api/**").authenticated()
                  .anyRequest().authenticated();
          http
                  .exceptionHandling()
                  .authenticationEntryPoint(delegatingAuthenticationEntryPoint());
          http
                  .addFilterBefore(new OAuth2ClientContextFilter(), BasicAuthenticationFilter.class)
                  .addFilterAfter(oauth2ClientAuthenticationProcessingFilter(), OAuth2ClientContextFilter.class)
          ;
      }
  
      private OAuth2ClientAuthenticationProcessingFilter oauth2ClientAuthenticationProcessingFilter() {
          OAuth2ClientAuthenticationProcessingFilter
                  daFilter = new OAuth2ClientAuthenticationProcessingFilter("/api/**");
          daFilter.setRestTemplate(oAuth2RestTemplate);
          daFilter.setTokenServices(inMemoryTokenServices());
          return daFilter;
      } 
  
      private DefaultTokenServices inMemoryTokenServices() {
          InMemoryTokenStore tok = new InMemoryTokenStore();
          DefaultTokenServices tokenService = new DefaultTokenServices();
          tokenService.setTokenStore(tok);
  
          return tokenService;
      }
  }
  </code></pre>
  
  <h3>Extra stuff in Security Config</h3>
  
  <p>Aaand, some of the beans which I believe are less relevant, but here they are in case you need them:</p>
  
  <pre><code>@Bean
  public DelegatingAuthenticationEntryPoint delegatingAuthenticationEntryPoint() {
      LinkedHashMap&lt;RequestMatcher, AuthenticationEntryPoint&gt; matchers =
              Maps.newLinkedHashMap();
  
      //Match all HTTP methods
      matchers.put(new RegexRequestMatcher("\\/api\\/v\\d+\\/.*", null), oAuth2AuthenticationEntryPoint());
      matchers.put(AnyRequestMatcher.INSTANCE, casAuthenticationEntryPoint());
  
      DelegatingAuthenticationEntryPoint entryPoint = new DelegatingAuthenticationEntryPoint(matchers);
      entryPoint.setDefaultEntryPoint(casAuthenticationEntryPoint());
  
      return entryPoint;
  }
  @Bean(name = "casEntryPoint")
  public CasAuthenticationEntryPoint casAuthenticationEntryPoint() {
      CasAuthenticationEntryPoint casAuthenticationEntryPoint = new CasAuthenticationEntryPoint();
      casAuthenticationEntryPoint.setLoginUrl(casUrl + "/login");
      casAuthenticationEntryPoint.setServiceProperties(serviceProperties());
  
      return casAuthenticationEntryPoint;
  }
  </code></pre>
  
  <h1>Error</h1>
  
  <p>Resource Server starts up just fine. Client gets its auth token from theAuthenticationServer.com and sends it in the request header to an api url. And I get the following error:</p>
  
  <blockquote>
    <p>HTTP Status 500 - Error creating bean with name 'scopedTarget.oauth2ClientContext': Scope 'session' is not active for the current thread; consider defining a scoped proxy for this bean if you intend to refer to it from a singleton; nested exception is java.lang.IllegalStateException: No thread-bound request found: Are you referring to request attributes outside of an actual web request, or processing a request outside of the originally receiving thread? If you are actually operating within a web request and still receive this message, your code is probably running outside of DispatcherServlet/DispatcherPortlet: In this case, use RequestContextListener or RequestContextFilter to expose the current request.</p>
    
    <p>Exception report</p>
    
    <p>Error creating bean with name 'scopedTarget.oauth2ClientContext': Scope 'session' is not active for the current thread; consider defining a scoped proxy for this bean if you intend to refer to it from a singleton; nested exception is java.lang.IllegalStateException: No thread-bound request found: Are you referring to request attributes outside of an actual web request, or processing a request outside of the originally receiving thread? If you are actually operating within a web request and still receive this message, your code is probably running outside of DispatcherServlet/DispatcherPortlet: In this case, use RequestContextListener or RequestContextFilter to expose the current request.</p>
    
    <p>The server encountered an internal error that prevented it from fulfilling this request.</p>
  </blockquote>
  
  <pre><code>        org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'scopedTarget.oauth2ClientContext': Scope 'session' is not active for the current thread; consider defining a scoped proxy for this bean if you intend to refer to it from a singleton; nested exception is java.lang.IllegalStateException: No thread-bound request found: Are you referring to request attributes outside of an actual web request, or processing a request outside of the originally receiving thread? If you are actually operating within a web request and still receive this message, your code is probably running outside of DispatcherServlet/DispatcherPortlet: In this case, use RequestContextListener or RequestContextFilter to expose the current request.
      org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:355)
      org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:197)
      org.springframework.aop.target.SimpleBeanTargetSource.getTarget(SimpleBeanTargetSource.java:35)
      org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:187)
      com.sun.proxy.$Proxy26.getAccessToken(Unknown Source)
      org.springframework.security.oauth2.client.OAuth2RestTemplate.getAccessToken(OAuth2RestTemplate.java:169)
      org.springframework.security.oauth2.client.filter.OAuth2ClientAuthenticationProcessingFilter.attemptAuthentication(OAuth2ClientAuthenticationProcessingFilter.java:94)
      org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:217)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
      org.springframework.security.oauth2.client.filter.OAuth2ClientContextFilter.doFilter(OAuth2ClientContextFilter.java:60)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
      org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:120)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
      org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64)
      org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
      org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:91)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
      org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:53)
      org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
      org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:213)
      org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:176)
      org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
      org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262)
      org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:121)
      org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
  
  root cause
          &lt;pre&gt;java.lang.IllegalStateException: No thread-bound request found: Are you referring to request attributes outside of an actual web request, or processing a request outside of the originally receiving thread? If you are actually operating within a web request and still receive this message, your code is probably running outside of DispatcherServlet/DispatcherPortlet: In this case, use RequestContextListener or RequestContextFilter to expose the current request.
      org.springframework.web.context.request.RequestContextHolder.currentRequestAttributes(RequestContextHolder.java:131)
      org.springframework.web.context.request.SessionScope.get(SessionScope.java:91)
      org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:340)
      org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:197)
      org.springframework.aop.target.SimpleBeanTargetSource.getTarget(SimpleBeanTargetSource.java:35)
      org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:187)
      com.sun.proxy.$Proxy26.getAccessToken(Unknown Source)
      org.springframework.security.oauth2.client.OAuth2RestTemplate.getAccessToken(OAuth2RestTemplate.java:169)
      org.springframework.security.oauth2.client.filter.OAuth2ClientAuthenticationProcessingFilter.attemptAuthentication(OAuth2ClientAuthenticationProcessingFilter.java:94)
      org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:217)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
      org.springframework.security.oauth2.client.filter.OAuth2ClientContextFilter.doFilter(OAuth2ClientContextFilter.java:60)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
      org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:120)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
      org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64)
      org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
      org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:91)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
      org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:53)
      org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
      org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:213)
      org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:176)
      org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
      org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262)
      org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:121)
      org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
  </code></pre>
  
  <p>I've tried a lot of different configs, looked up a ton of resources online, and I've gotten nowhere. Am I using the right classes? Any idea what configs I might need to change? </p>