java - Spring Boot Oauth2 授权服务器不接受有效 token-6ren

java - Spring Boot Oauth2 授权服务器不接受有效 token

转载作者：行者123 更新时间：2023-12-03 18:24:52

我在使用 Spring Boot 的 OAuth2 功能设置简单的微服务系统时遇到问题。

我想做的是搭建一个Spring Boot Authorization Server来处理注册、授权和用户数据管理。除此之外，我想设置一个资源服务器来处理应用程序的逻辑。

由于所有数据都与用户 ID 相关，因此资源服务器必须向授权服务器请求 ID。因此，我设置了以下用户信息端点:

@Controller
public class UserInfoEndpoint {

    private UserManagementBean userManagementBean;

    @Autowired
    public UserInfoEndpoint(final UserManagementBean userManagementBean) {
        this.userManagementBean = userManagementBean;
    }

    @GetMapping("/user/me")
    @ResponseBody
    public Principal user(final Principal principal) throws PRPException {
        User user = userManagementBean.loadUser(principal.getName());
        @SuppressWarnings("unused")
        Principal retVal = new Principal() {

            @Override
            public String getName() {
                return user.getId().toString();
            }

            public String getPrimaryEmail() {
                return user.getPrimaryEmail();
            }
        };
        return retVal;
    }

}

目前，我正在使用 JWK 来签署 token 。我可以使用 Postman 访问此端点，在那里我得到以下结果:

{
    "primaryEmail": "eric@live.de",
    "name": "3"
}

但是，当尝试使用资源服务器获取用户信息时

    @Bean
    @RequestScope
    public OAuth2Authentication userInfo(final HttpServletRequest request) {
        UserInfoTokenServices services = new UserInfoTokenServices("http://localhost:8081/user/me", "PRPBackend");
        services.setPrincipalExtractor(principalExtractor());

        String authHeader = request.getHeader(HttpHeaders.AUTHORIZATION);
        String tokenString = authHeader.replace("Bearer ", "").replace("bearer ", "");
        DefaultOAuth2AccessToken accessToken = new DefaultOAuth2AccessToken(tokenString);

        AuthorizationCodeResourceDetails resource = new AuthorizationCodeResourceDetails();
        resource.setAccessTokenUri("http://localhost:8081/oauth/token");
        resource.setClientId("PRPBackend");
        resource.setClientSecret("secret");
        resource.setUserAuthorizationUri("http://localhost:8081/oauth/authorize");
        resource.setAuthenticationScheme(AuthenticationScheme.header);
        resource.setClientAuthenticationScheme(AuthenticationScheme.header);

        OAuth2ClientContext clientContext = new DefaultOAuth2ClientContext();
        clientContext.setPreservedState("key", "abcdef");
        clientContext.setAccessToken(accessToken);

        OAuth2RestTemplate restTemplate = new OAuth2RestTemplate(resource, clientContext);
        services.setRestTemplate(restTemplate);

        OAuth2Authentication authentication = services.loadAuthentication(tokenString);

        return authentication;
    }

授权服务器告诉我，该用户是匿名的。

2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.security.web.FilterChainProxy        : /user/me at position 1 of 13 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.security.web.FilterChainProxy        : /user/me at position 2 of 13 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] w.c.HttpSessionSecurityContextRepository : No HttpSession currently exists
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: null. A new one will be created.
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.security.web.FilterChainProxy        : /user/me at position 3 of 13 in additional filter chain; firing Filter: 'HeaderWriterFilter'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.security.web.FilterChainProxy        : /user/me at position 4 of 13 in additional filter chain; firing Filter: 'CorsFilter'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.security.web.FilterChainProxy        : /user/me at position 5 of 13 in additional filter chain; firing Filter: 'CsrfFilter'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.security.web.FilterChainProxy        : /user/me at position 6 of 13 in additional filter chain; firing Filter: 'LogoutFilter'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /user/me' doesn't match 'POST /logout'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.security.web.FilterChainProxy        : /user/me at position 7 of 13 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /user/me' doesn't match 'POST /login'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.security.web.FilterChainProxy        : /user/me at position 8 of 13 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.w.s.HttpSessionRequestCache        : saved request doesn't match
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.security.web.FilterChainProxy        : /user/me at position 9 of 13 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.security.web.FilterChainProxy        : /user/me at position 10 of 13 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.w.a.AnonymousAuthenticationFilter  : Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@74903b51: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@957e: RemoteIpAddress: 127.0.0.1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.security.web.FilterChainProxy        : /user/me at position 11 of 13 in additional filter chain; firing Filter: 'SessionManagementFilter'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.security.web.FilterChainProxy        : /user/me at position 12 of 13 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.security.web.FilterChainProxy        : /user/me at position 13 of 13 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/user/me'; against '/actuator/**'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/user/me'; against '/favicon.ico'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/user/me'; against '/login'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/user/me'; against '/confirm/**'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/user/me'; against '/signup'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/user/me'; against '/oauth/authorize'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/user/me'; against '/css/**'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/user/me'; against '/img/**'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /user/me' doesn't match 'OPTIONS /oauth/token'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /user/me' doesn't match 'POST /oauth/token'
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.w.a.i.FilterSecurityInterceptor    : Secure object: FilterInvocation: URL: /user/me; Attributes: [authenticated]
2019-12-16 06:28:30.532 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.w.a.i.FilterSecurityInterceptor    : Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@74903b51: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@957e: RemoteIpAddress: 127.0.0.1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS
2019-12-16 06:28:30.533 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.access.vote.AffirmativeBased       : Voter: org.springframework.security.web.access.expression.WebExpressionVoter@33824388, returned: -1
2019-12-16 06:28:30.545 DEBUG 7018 --- [nio-8081-exec-2] o.s.s.w.a.ExceptionTranslationFilter     : Access is denied (user is anonymous); redirecting to authentication entry point

org.springframework.security.access.AccessDeniedException: Access is denied
    at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) ~[spring-security-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233) ~[spring-security-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:123) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:90) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:118) ~[spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:158) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:200) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:117) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:92) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:92) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:77) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178) [spring-security-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:108) [spring-boot-actuator-2.2.1.RELEASE.jar:2.2.1.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at com.prp.auth.security.filter.SimpleCorsFilter.doFilter(SimpleCorsFilter.java:38) [main/:na]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:526) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:861) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1579) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_222]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_222]
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-9.0.27.jar:9.0.27]
    at java.lang.Thread.run(Thread.java:748) [na:1.8.0_222]

并返回登录页面。

我尝试了几个配置，但没有任何效果。这是我的授权服务器的安全配置:

    @Override
    protected void configure(final HttpSecurity http) throws Exception {
        // @formatter:off
        http.requestMatchers().and()
        .authorizeRequests()
        .and()
        .authorizeRequests()
        .antMatchers("/actuator/**", "/favicon.ico").permitAll()
        .antMatchers(HttpMethod.GET, "/login", "/confirm/**", "/signup",
                "/oauth/authorize", "/css/**", "/img/**").permitAll()
        .antMatchers(HttpMethod.OPTIONS, "/oauth/token").permitAll()
        .antMatchers(HttpMethod.POST, "/oauth/token").permitAll()
        .and().formLogin().loginPage("/login").permitAll()
        .and().authorizeRequests().anyRequest().authenticated()
        .and().headers().frameOptions().disable()
        .and().cors().configurationSource(new CorsConfigurationSource() {

                    @Override
                    public CorsConfiguration getCorsConfiguration(final HttpServletRequest request) {
                        CorsConfiguration conf = new CorsConfiguration();
                        List<String> allowedOrigins = new ArrayList<>();
                        allowedOrigins.add("http://localhost:8000");
                        conf.setAllowedOrigins(allowedOrigins);
                        List<String> allowedMethods = new ArrayList<>();
                        allowedMethods.add("POST");
                        conf.setAllowedMethods(allowedMethods);
                        return conf;
                    }
                });
}

编辑 :

我一直在尝试通过 Postman 和 JQuery 访问同一个端点。 Postman 能够获取用户的数据，但 JQuery 实现会得到与上述相同的错误。

再一次编辑:

我正在测试的 JQuery 请求如下:

  fetchUser() {
    let ref = this;
    console.log("Calling URL to load user information: " + localStorageManager.loadOauthProvider() + "/user/me");
    $.ajax({
      url: localStorageManager.loadOauthProvider() + "/user/me",
      method: "GET",
      headers: ref.oauth2.authorizationHeader,
      success: function(data, status, xhr) {
        console.log("Fetch user response: " + JSON.stringify(data));
      },
      error: function(xhr, status, error) {
        console.log("Error: " + error);
      }
    });
  }

结果:

Fetch user response: "<!doctype html>\n<html>\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\"\n\tcontent=\"width=device-width, initial-scale=1, shrink-to-fit=no\">\n<meta name=\"description\" content=\"\">\n<meta name=\"author\" content=\"\">\n<link rel=\"icon\" href=\"/img/favicon.ico\">\n\n<title>Login</title>\n<link rel=\"stylesheet\"\n\thref=\"/css/bootstrap.min.css\" />\n\n<!-- Custom styles for this template -->\n<link rel=\"stylesheet\" type=\"text/css\" href=\"/css/login.css\" />\n\n</head>\n\n<body class=\"text-center\">\n\n\t<form name=\"login\" action=\"/login\" method=\"post\"\n\t\tclass=\"form-signin\">\n\t\t<h1 class=\"h3 mb-3 font-weight-normal\">LEVO</h1>\n\t\t<img class=\"mb-4\" src=\"/img/logo.png\" alt=\"\" width=\"72\"\n\t\t\theight=\"72\">\n\t\t<h1 class=\"h3 mb-3 font-weight-normal\">\n\t\t\t<span>Anmelden</span>\n\t\t</h1>\n\t\t\n\t\t\n\t\t<label for=\"username\" class=\"sr-only\">E-Mail</label>\n\t\t<input type=\"text\" id=\"username\" name=\"username\" class=\"form-control\"\n\t\t\tplaceholder=\"E-Mail\" required autofocus>\n\t\t<label for=\"password\" class=\"sr-only\"></label>\n\t\t<input type=\"password\" id=\"password\" name=\"password\"\n\t\t\tclass=\"form-control\" placeholder=\"Passwort\"\n\t\t\trequired>\n\t\t<div class=\"checkbox mb-3\">\n\t\t\t<label> <input type=\"checkbox\" value=\"remember-me\"> <span>Angemeldet bleiben</span>\n\t\t\t</label>\n\t\t</div>\n\t\t<button class=\"btn btn-lg btn-primary btn-block\" type=\"submit\">\n\t\t\t<span>Anmelden</span>\n\t\t</button>\n\t\t<a class=\"nav-link\" href=\"/signup\">\n\t\t\t<span data-feather=\"home\"></span>\n\t\t\t<span>Hier registrieren</span>\n\t\t</a>\n\n\t\t<p class=\"mt-5 mb-3 text-muted\">&copy; Levo 2019</p>\n\t</form>\n\n\n</body>\n</html>"

postman 正在创建以下请求，该请求有效:

GET /user/me HTTP/1.1 Host: localhost:8081 Authorization: Bearer [...]

最佳答案

从我的角度来看，您的 SecurityConfig 处理的不是您所期望的。您的第一条规则 http.requestMatchers().and().authorizeRequests()方法:

requestMatchers() configures if an URL will be processed by that SecurityFilterChain. So if an URL does not match it , the whole SecurityFilterChain will be skipped which means Spring Security will not handle this URL after that. If you do not configure it, the default is to match all URLs.

所以你需要定义你的 antMatchers 资源，它应该由这个 SecurityFilerChain 处理。如果将此规则更改为以下基本配置 http.requestMatchers().antMatchers("/")...用户端点应该按预期工作。

这背后的原因是，端点 /user/me此 SecurityConfigChain 不应处理/覆盖。因此，如果您以默认方式启用了 Spring 的 ResourceServer，则该端点使用默认配置。

所以在这个 antMatchers("/")你应该定义所有应该由这个安全过滤器处理的资源，而不是 user/me .

关于java - Spring Boot Oauth2 授权服务器不接受有效 token ，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/59351287/

文章推荐： sqlite - 如何在 Delphi 将整数值插入 SQLite 表

文章推荐： iphone - UIWebview 本地化

文章推荐： iphone - 如何在iphone的sqlite表中获取最后10条添加的记录

android - 使用刷新 token 在访问 token 过期之前刷新访问 token
我正在开发一个应用程序，它使用 OAuth - 基于 token 的身份验证。考虑到我们拥有访问和刷新 token ，这就是流程的样子。 Api call -> intercepter append
python - 如何取消对 spacy.tokens.token.Token 的标记？
如何取消标记此代码的输出？类(class)核心: def __init__(self, user_input): pos = pop(user_input) subject = ""
kubernetes - kubectl --token=$TOKEN 没有使用 token 的权限运行
当我使用命令 kubectl 时与 --token标记并指定 token ，它仍然使用 kubeconfig 中的管理员凭据文件。这是我做的: NAMESPACE="default" SERVICE
security - 访问 token 和刷新 token 最佳实践？如何实现访问和刷新 token
我正在制作 SPA，并决定使用 JWT 进行身份验证/授权，并且我已经阅读了一些关于 Tokens 与 Cookies 的博客。我了解 cookie 授权的工作原理，并了解基本 token 授权的工作
azure - 请求刷新 token 失败。在 token 存储中找不到刷新 token
我正在尝试从应用服务获取 Google 的刷新 token ，但无法。日志说 2016-11-04T00:04:25 PID[500] Verbose Received request: GET h
java - token 语法错误 "(", ; token ","上的预期语法错误，； token ")"上的预期语法错误，；预期的
我正在开发一个项目，只是为了为 java 开发人员测试 eclipse IDE。我是java新手，所以我想知道为什么它不起作用，因为我已经知道该怎么做了。这是代码: public class ecli
asp.net - token 处理程序无法将 token 转换为 jwt token
我正在尝试使用 JwtSecurityTokenHandler 将 token 字符串转换为 jwt token 。但它出现错误说 IDX12709: CanReadToken() returned
android - Facebook 用户访问 token 与应用程序访问 token 与页面访问 token
我已阅读文档 Authentication (来自 Facebook 的官方)。我仍然不明白 Facebook 提供的这三种访问 token 之间的区别。网站上给出了一些例子，但我还是不太明白。每个
c# - 防伪 token 无法解密 & 防伪cookie token 和表单字段 token 在部署中不匹配
我的部署服务器有时有这个问题，这让我抓狂，因为我无法在本地主机中重现，我已经尝试在我的 web.config 中添加机器 key ，但没有成功远。它只发生在登录页面。我的布局:
c# - 如何在不创建新刷新 token 的情况下使用刷新 token 更新 Owin 访问 token ？
我已经设法获得了一个简单的示例代码，它可以创建一个不记名 token ，还可以通过阅读 stackoverflow 上的其他论坛来通过刷新 token 请求新的不记名 token 。启动类是这样的
php - Google Api，当我有访问 token 和以前的刷新 token 时如何刷新用户 token
如果我有以前的刷新 token 和使用纯 php 的访问 token ，没有 Google Api 库，是否可以刷新 Google Api token ？我在数据库中存储了许多用户刷新和访问 toke
java - token 无效 - 无效 token : Cannot parse referred token string: Invalid gaia_data. Base64 token 上的 AuthSubToken 原型(prototype)
我通过 Java 应用程序使用 Google 电子表格时遇到了问题。我创建了应用程序，该应用程序运行了 1 年多，没有任何问题，我什至在 Create Spreadsheet using Google
Keycloak admin REST API - 使用刷新 token 创建新的访问 token 而不重新创建刷新 token
当我有一个有效的刷新 token 时，我正在尝试使用 Keycloak admin REST API 重新创建访问 token 。我已经通过调用 POST/auth/realms/{realm}/p
wcf - 找不到 'System.IdentityModel.Tokens.UserNameSecurityToken' token 类型的 token 验证器。
我正在尝试让第三方 Java 客户端与我编写的 WCF 服务进行通信。收到消息时出现如下异常: Cannot find a token authenticator for the 'System.I
sql - 解析查询时出错。 [ token 行号=1， token 行偏移量=52， token 错误=)]
在尝试将数据插入到我的 SQl 数据库时，我收到以下错误 System.Data.SqlServerCe.SqlCeException: There was an error parsing the
access-token - JSON Web token (JWT) 相对于数据库 session token 的优势
使用数据库 session token 系统，我可以让用户使用用户名/密码登录，服务器可以生成 token (例如 uuid)并将其存储在数据库中并将该 token 返回给客户端。其上的每个请求都将包
azure - 错误: The received token is of incorrect token type -- What should the token look like?
我最近注册了 Microsoft Azure 并设置了认知服务帐户。使用 Text Translation API Documentation 中的说明我能够使用 interactive online
asp.net - 所提供的防伪 token 验证失败。 cookie token 和请求 token 已交换
我使用 IAntiforgery API 创建了一个 ASP.Net Core 2 应用程序。这提供了一种返回 cookie 的方法。客户端获取该 cookie，并在后续 POST 请求中将该值放
python - 基于 Spacy token 的匹配， token 之间的 token 数量为 'n'
我正在使用 spacy 来匹配某些文本(意大利语)中的特定表达式。我的文本可以多种形式出现，我正在尝试学习编写一般规则的最佳方式。我有如下 4 个案例，我想写一个适用于所有案例的通用模式。像这样的东西
javascript - OAuth 2.0 token 处理。是否有服务器 token 和客户端 token ？
我无法理解 oauth 2.0 token 的原则处理。我的场景是，我有一个基于 web 的前端后端系统，带有 node.js 和 angular 2。用户应该能够在此站点上上传视频。然后创建一些额

行者123

个人简介

我是一名优秀的程序员,十分优秀！

作者热门文章

滴滴打车优惠券免费领取

全站热门文章

首页

博学

6Ren·AI

商城

java - Spring Boot Oauth2 授权服务器不接受有效 token