oauth-2.0 - 是什么导致org.springframework.social.connect.web.ConnectSupport中的原始 'OAuth2'状态参数为空？

Question

我正在尝试在应用程序上使用Spring Social，并且在调试时注意到，原始“OAuth2”状态参数在我的应用程序上始终为null。

请参阅下面的 org.springframework.social.connect.web.ConnectSupport 的Spring Social源代码:

private void verifyStateParameter(NativeWebRequest request) {
    String state = request.getParameter("state");
    String originalState = extractCachedOAuth2State(request);//Always null...
    if (state == null || !state.equals(originalState)) {
        throw new IllegalStateException("The OAuth2 'state' parameter is missing or doesn't match.");
    }
}

private String extractCachedOAuth2State(WebRequest request) {
    String state = (String) sessionStrategy.getAttribute(request, OAUTH2_STATE_ATTRIBUTE);
    sessionStrategy.removeAttribute(request, OAUTH2_STATE_ATTRIBUTE);
    return state;       
}

谁能帮忙吗？

编辑:我确实看到了Facebook传回的state参数:

Request URL:https://www.facebook.com/v2.5/dialog/oauth?client_id=414113641982912&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fconnect%2Ffacebook&scope=public_profile&state=0b7a97b5-b8d1-4f97-9b60-e3242c9c7eb9
Request Method:GET
Status Code:302 
Remote Address:179.60.192.36:443

edit 2 :顺便说一句，我得到的异常如下:

Exception while handling OAuth2 callback (The OAuth2 'state' parameter is missing or doesn't match.). Redirecting to facebook connection status page.

Answer 1

原来，这个问题是由于我依赖头(而不是cookie)来管理 session 而造成的。

通过注释掉以下spring session 配置bean:

@Bean
public HttpSessionStrategy sessionStrategy(){
    return new HeaderHttpSessionStrategy();
}

oauth2状态参数问题已排序。

P.S. 现在，我必须找到一种方法，使Spring Social与我当前的Spring Session配置一起使用...

编辑:我设法保留HeaderHttpSessionStrategy(在 Spring session 方面)，并通过实现自己的SessionStrategy(在 Spring 社会方面)使其工作，如下所示:

public class CustomSessionStrategy implements SessionStrategy {

    public void setAttribute(RequestAttributes request, String name, Object value) {
        request.setAttribute(name, value, RequestAttributes.SCOPE_SESSION);
    }

    public Object getAttribute(RequestAttributes request, String name) {
        ServletWebRequest servletWebRequest = (ServletWebRequest) request;
        return servletWebRequest.getParameter(name);
    }

    public void removeAttribute(RequestAttributes request, String name) {
        request.removeAttribute(name, RequestAttributes.SCOPE_SESSION);
    }
}