spring - JWT 与 Spring OAuth2

Question

我创建了发布 JWT 的 Spring 授权服务器和检查 JWT、其声明以及授权服务器上的权限的资源服务器。为此，我遵循了此article .

我的问题是为什么我需要在获取 token 请求中发送带有 HTTP Basic 授权和 Base64 编码的用户名/密码 (ClientId:ClientSecret) 的 Authorization header ？我见过仅需要用户名和密码的 JWT 实现。

Answer 1

它是规范的一部分，请参阅 RFC 6749 :

2.3 Client Authentication

If the client type is confidential, the client and authorization server establish a client authentication method suitable for the security requirements of the authorization server. The authorization server MAY accept any form of client authentication meeting its security requirements.

Confidential clients are typically issued (or establish) a set of client credentials used for authenticating with the authorization server (e.g., password, public/private key pair).

The authorization server MAY establish a client authentication method with public clients. However, the authorization server MUST NOT rely on public client authentication for the purpose of identifying the client.

The client MUST NOT use more than one authentication method in each request.

默认情况下，Spring Security OAuth 2.0 保护 token 端点，请参阅 OAuth 2 Developers Guide :

The token endpoint is protected for you by default by Spring OAuth in the @Configuration support using HTTP Basic authentication of the client secret.

但似乎您可以禁用客户端身份验证:

• Spring Security OAuth 2.0 - client secret always required for authorization code grant
• Is it possible to get an access_token from Spring OAuth2 server without client secret?
• Spring Security OAuth 2.0 with no client_secret