Repository navigation
Expand file tree
/
Copy pathspringsecurity-oauth2.html
More file actions
2128 lines (1743 loc) · 88.6 KB
/
Copy pathspringsecurity-oauth2.html
File metadata and controls
2128 lines (1743 loc) · 88.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE HTML>
<html lang="zh-CN">
<head><meta name="generator" content="Hexo 3.9.0">
<meta charset="utf-8">
<meta name="keywords" content="SpringSecurity-OAuth2 授权码模式, 记录">
<meta name="baidu-site-verification" content="fmlEuI34ir">
<meta name="google-site-verification" content="yCy2azpds5XSuGZvis6OuA-XIGF5GuGpYRAaGfD6o48">
<meta name="360-site-verification" content="b7c11a830ef90fd1464ad6206bb7b6e7">
<meta name="description" content="在使用 OAuth2.0 中 Authorization Server （授权服务器）是一个回避不了的设施，在大多数情况下我们调用的是一些知名的、可靠的、可信任的第三方平台，比如 QQ、微信、微博、github 等。我们的应用只作为 Cli">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=no">
<meta name="renderer" content="webkit|ie-stand|ie-comp">
<meta name="mobile-web-app-capable" content="yes">
<meta name="format-detection" content="telephone=no">
<meta name="apple-mobile-web-app-capable" content="yes">
<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
<title>SpringSecurity-OAuth2 授权码模式 | Ji`s Blog</title>
<link rel="icon" type="image/png" href="/favicon.png">
<link rel="stylesheet" type="text/css" href="/libs/awesome/css/font-awesome.min.css">
<link rel="stylesheet" type="text/css" href="/libs/materialize/materialize.min.css">
<link rel="stylesheet" type="text/css" href="/libs/aos/aos.css">
<link rel="stylesheet" type="text/css" href="/libs/animate/animate.min.css">
<link rel="stylesheet" type="text/css" href="/libs/lightGallery/css/lightgallery.min.css">
<link rel="stylesheet" type="text/css" href="/css/matery.css">
<link rel="stylesheet" type="text/css" href="/css/my.css">
<style type="text/css">
</style>
<script src="/libs/jquery/jquery-2.2.0.min.js"></script>
<script src="https://sdk.jinrishici.com/v2/browser/jinrishici.js" charset="utf-8"></script>
<script>
var _hmt = _hmt || [];
(function() {
var hm = document.createElement("script");
hm.src = "https://hm.baidu.com/hm.js?4d1d73af45a62734730491a6b6c41da4";
var s = document.getElementsByTagName("script")[0];
s.parentNode.insertBefore(hm, s);
})();
</script>
<script>(function (i, s, o, g, r, a, m) {
i['DaoVoiceObject'] = r;
i[r] = i[r] ||
function () {
(i[r].q = i[r].q || []).push(arguments);
};
i[r].l = 1 * new Date();
a = s.createElement(o);
m = s.getElementsByTagName(o)[0];
a.async = 1;
a.src = g;
a.charset = 'utf-8';
m.parentNode.insertBefore(a, m);
})(window, document, 'script', ('https:' === document.location.protocol ? 'https:' : 'http:') + "//widget.daovoice.io/widget/xxx.js", 'daovoice');
daovoice('init', {
app_id: "xxx",
});
daovoice('update');
</script>
<script>
(function(){
var bp = document.createElement('script');
var curProtocol = window.location.protocol.split(':')[0];
if (curProtocol === 'https') {
bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
}
else {
bp.src = 'http://push.zhanzhang.baidu.com/push.js';
}
var s = document.getElementsByTagName("script")[0];
s.parentNode.insertBefore(bp, s);
})();
</script>
<script>
(function(){
var src = "https://jspassport.ssl.qhimg.com/11.0.1.js?d182b3f28525f2db83acfaaf6e696dba";
document.write('<script src="' + src + '" id="sozz"><\/script>');
})();
</script>
<meta name="baidu-site-verification" content>
<style type="text/css" lang="css">
#loading-container{
position: fixed;
top: 0;
left: 0;
min-height: 100vh;
width: 100vw;
z-index: 9999;
display: flex;
flex-direction: column;
justify-content: center;
align-items: center;
background: #FFF;
text-align: center;
/* loaderҳ����ʧ���ý����ķ�ʽ*/
-webkit-transition: opacity 1s ease;
-moz-transition: opacity 1s ease;
-o-transition: opacity 1s ease;
transition: opacity 1s ease;
}
.loading-image{
width: 120px;
height: 50px;
transform: translate(-50%);
}
.loading-image div:nth-child(2) {
-webkit-animation: pacman-balls 1s linear 0s infinite;
animation: pacman-balls 1s linear 0s infinite
}
.loading-image div:nth-child(3) {
-webkit-animation: pacman-balls 1s linear .33s infinite;
animation: pacman-balls 1s linear .33s infinite
}
.loading-image div:nth-child(4) {
-webkit-animation: pacman-balls 1s linear .66s infinite;
animation: pacman-balls 1s linear .66s infinite
}
.loading-image div:nth-child(5) {
-webkit-animation: pacman-balls 1s linear .99s infinite;
animation: pacman-balls 1s linear .99s infinite
}
.loading-image div:first-of-type {
width: 0;
height: 0;
border: 25px solid #49b1f5;
border-right-color: transparent;
border-radius: 25px;
-webkit-animation: rotate_pacman_half_up .5s 0s infinite;
animation: rotate_pacman_half_up .5s 0s infinite;
}
.loading-image div:nth-child(2) {
width: 0;
height: 0;
border: 25px solid #49b1f5;
border-right-color: transparent;
border-radius: 25px;
-webkit-animation: rotate_pacman_half_down .5s 0s infinite;
animation: rotate_pacman_half_down .5s 0s infinite;
margin-top: -50px;
}
@-webkit-keyframes rotate_pacman_half_up {0% {transform: rotate(270deg)}50% {transform: rotate(1turn)}to {transform: rotate(270deg)}}
@keyframes rotate_pacman_half_up {0% {transform: rotate(270deg)}50% {transform: rotate(1turn)}to {transform: rotate(270deg)}}
@-webkit-keyframes rotate_pacman_half_down {0% {transform: rotate(90deg)}50% {transform: rotate(0deg)}to {transform: rotate(90deg)}}
@keyframes rotate_pacman_half_down {0% {transform: rotate(90deg)}50% {transform: rotate(0deg)}to {transform: rotate(90deg)}}
@-webkit-keyframes pacman-balls {75% {opacity: .7}to {transform: translate(-100px, -6.25px)}}
@keyframes pacman-balls {75% {opacity: .7}to {transform: translate(-100px, -6.25px)}}
.loading-image div:nth-child(3),
.loading-image div:nth-child(4),
.loading-image div:nth-child(5),
.loading-image div:nth-child(6){
background-color: #49b1f5;
width: 15px;
height: 15px;
border-radius: 100%;
margin: 2px;
width: 10px;
height: 10px;
position: absolute;
transform: translateY(-6.25px);
top: 25px;
left: 100px;
}
.loading-text{
margin-bottom: 20vh;
text-align: center;
color: #2c3e50;
font-size: 2rem;
box-sizing: border-box;
padding: 0 10px;
text-shadow: 0 2px 10px rgba(0,0,0,0.2);
}
@media only screen and (max-width: 500px) {
.loading-text{
font-size: 1.5rem;
}
}
.fadeout {
opacity: 0;
filter: alpha(opacity=0);
}
/* logo���ֶ��� */
@-webkit-keyframes fadeInDown{0%{opacity:0;-webkit-transform:translate3d(0,-100%,0);transform:translate3d(0,-100%,0)}100%{opacity:1;-webkit-transform:none;transform:none}}
@keyframes fadeInDown{0%{opacity:0;-webkit-transform:translate3d(0,-100%,0);}}
</style>
<script>
(function () {
const loaded = function(){
setTimeout(function(){
const loader = document.getElementById("loading-container");
loader.className="fadeout" ;//ʹ�ý����ķ�������loading page
// document.getElementById("body-wrap").style.display="flex";
setTimeout(function(){
loader.style.display="none";
},1000);
},1000);//ǿ����ʾloading page 1s
};
loaded();
})()
</script><link rel="stylesheet" href="/css/prism-tomorrow.css" type="text/css">
<link rel="stylesheet" href="/css/prism-line-numbers.css" type="text/css"><style type="text/css" lang="css">
#loading-container{
position: fixed;
top: 0;
left: 0;
min-height: 100vh;
width: 100vw;
z-index: 9999;
display: flex;
flex-direction: column;
justify-content: center;
align-items: center;
background: #FFF;
text-align: center;
/* loaderҳ����ʧ���ý����ķ�ʽ*/
-webkit-transition: opacity 1s ease;
-moz-transition: opacity 1s ease;
-o-transition: opacity 1s ease;
transition: opacity 1s ease;
}
.loading-image{
width: 120px;
height: 50px;
transform: translate(-50%);
}
.loading-image div:nth-child(2) {
-webkit-animation: pacman-balls 1s linear 0s infinite;
animation: pacman-balls 1s linear 0s infinite
}
.loading-image div:nth-child(3) {
-webkit-animation: pacman-balls 1s linear .33s infinite;
animation: pacman-balls 1s linear .33s infinite
}
.loading-image div:nth-child(4) {
-webkit-animation: pacman-balls 1s linear .66s infinite;
animation: pacman-balls 1s linear .66s infinite
}
.loading-image div:nth-child(5) {
-webkit-animation: pacman-balls 1s linear .99s infinite;
animation: pacman-balls 1s linear .99s infinite
}
.loading-image div:first-of-type {
width: 0;
height: 0;
border: 25px solid #49b1f5;
border-right-color: transparent;
border-radius: 25px;
-webkit-animation: rotate_pacman_half_up .5s 0s infinite;
animation: rotate_pacman_half_up .5s 0s infinite;
}
.loading-image div:nth-child(2) {
width: 0;
height: 0;
border: 25px solid #49b1f5;
border-right-color: transparent;
border-radius: 25px;
-webkit-animation: rotate_pacman_half_down .5s 0s infinite;
animation: rotate_pacman_half_down .5s 0s infinite;
margin-top: -50px;
}
@-webkit-keyframes rotate_pacman_half_up {0% {transform: rotate(270deg)}50% {transform: rotate(1turn)}to {transform: rotate(270deg)}}
@keyframes rotate_pacman_half_up {0% {transform: rotate(270deg)}50% {transform: rotate(1turn)}to {transform: rotate(270deg)}}
@-webkit-keyframes rotate_pacman_half_down {0% {transform: rotate(90deg)}50% {transform: rotate(0deg)}to {transform: rotate(90deg)}}
@keyframes rotate_pacman_half_down {0% {transform: rotate(90deg)}50% {transform: rotate(0deg)}to {transform: rotate(90deg)}}
@-webkit-keyframes pacman-balls {75% {opacity: .7}to {transform: translate(-100px, -6.25px)}}
@keyframes pacman-balls {75% {opacity: .7}to {transform: translate(-100px, -6.25px)}}
.loading-image div:nth-child(3),
.loading-image div:nth-child(4),
.loading-image div:nth-child(5),
.loading-image div:nth-child(6){
background-color: #49b1f5;
width: 15px;
height: 15px;
border-radius: 100%;
margin: 2px;
width: 10px;
height: 10px;
position: absolute;
transform: translateY(-6.25px);
top: 25px;
left: 100px;
}
.loading-text{
margin-bottom: 20vh;
text-align: center;
color: #2c3e50;
font-size: 2rem;
box-sizing: border-box;
padding: 0 10px;
text-shadow: 0 2px 10px rgba(0,0,0,0.2);
}
@media only screen and (max-width: 500px) {
.loading-text{
font-size: 1.5rem;
}
}
.fadeout {
opacity: 0;
filter: alpha(opacity=0);
}
/* logo���ֶ��� */
@-webkit-keyframes fadeInDown{0%{opacity:0;-webkit-transform:translate3d(0,-100%,0);transform:translate3d(0,-100%,0)}100%{opacity:1;-webkit-transform:none;transform:none}}
@keyframes fadeInDown{0%{opacity:0;-webkit-transform:translate3d(0,-100%,0);}}
</style>
<script>
(function () {
const loaded = function(){
setTimeout(function(){
const loader = document.getElementById("loading-container");
loader.className="fadeout" ;//ʹ�ý����ķ�������loading page
// document.getElementById("body-wrap").style.display="flex";
setTimeout(function(){
loader.style.display="none";
},1000);
},1000);//ǿ����ʾloading page 1s
};
loaded();
})()
</script></head>
<div id="loading-container">
<p class="loading-text"></p>
<div class="loading-image">
<div></div>
<div></div>
<div></div>
<div></div>
<div></div>
</div>
</div><body>
<header class="navbar-fixed">
<nav id="headNav" class="bg-color nav-transparent">
<div id="navContainer" class="nav-wrapper container">
<div class="brand-logo">
<a href="/" class="waves-effect waves-light">
<img src="/medias/logo.png" class="logo-img" alt="LOGO">
<span class="logo-span">Ji`s Blog</span>
</a>
</div>
<a href="#" data-target="mobile-nav" class="sidenav-trigger button-collapse"><i class="fa fa-navicon"></i></a>
<ul class="right">
<li class="hide-on-med-and-down">
<a href="/" class="waves-effect waves-light">
<span>首页</span>
</a>
</li>
<li class="hide-on-med-and-down">
<a href="/tags" class="waves-effect waves-light">
<span>标签</span>
</a>
</li>
<li class="hide-on-med-and-down">
<a href="/categories" class="waves-effect waves-light">
<span>分类</span>
</a>
</li>
<li class="hide-on-med-and-down">
<a href="/archives" class="waves-effect waves-light">
<span>归档</span>
</a>
</li>
<li class="hide-on-med-and-down">
<a href="/about" class="waves-effect waves-light">
<span>关于</span>
</a>
</li>
<li class="hide-on-med-and-down">
<a href="/friends" class="waves-effect waves-light">
<span>友情链接</span>
</a>
</li>
<li class="hide-on-med-and-down">
<a href="/contact" class="waves-effect waves-light">
<span>留言板</span>
</a>
</li>
<li>
<a href="#searchModal" class="modal-trigger waves-effect waves-light">
<i id="searchIcon" class="fa fa-search" title="搜索"></i>
</a>
</li>
</ul>
<div id="mobile-nav" class="side-nav sidenav">
<div class="mobile-head bg-color">
<img src="/medias/logo.png" class="logo-img circle responsive-img">
<div class="logo-name">Ji`s Blog</div>
<div class="logo-desc">
Java | Spring | Redis
</div>
</div>
<ul class="menu-list mobile-menu-list">
<li>
<a href="/" class="waves-effect waves-light">
<i class="fa fa-fw fa-link"></i>
首页
</a>
</li>
<li>
<a href="/tags" class="waves-effect waves-light">
<i class="fa fa-fw fa-link"></i>
标签
</a>
</li>
<li>
<a href="/categories" class="waves-effect waves-light">
<i class="fa fa-fw fa-link"></i>
分类
</a>
</li>
<li>
<a href="/archives" class="waves-effect waves-light">
<i class="fa fa-fw fa-link"></i>
归档
</a>
</li>
<li>
<a href="/about" class="waves-effect waves-light">
<i class="fa fa-fw fa-link"></i>
关于
</a>
</li>
<li>
<a href="/friends" class="waves-effect waves-light">
<i class="fa fa-fw fa-link"></i>
友情链接
</a>
</li>
<li>
<a href="/contact" class="waves-effect waves-light">
<i class="fa fa-fw fa-link"></i>
留言板
</a>
</li>
<li><div class="divider"></div></li>
<li>
<a href="https://github.com/jiyongg-code" class="waves-effect waves-light" target="_blank">
<i class="fa fa-github-square fa-fw"></i>Fork Me
</a>
</li>
</ul>
</div>
</div>
<style>
.nav-transparent .github-corner {
display: none !important;
}
.github-corner {
position: absolute;
z-index: 10;
top: 0;
right: 0;
border: 0;
transform: scale(1.1);
}
.github-corner svg {
color: #0f9d58;
fill: #fff;
height: 64px;
width: 64px;
}
.github-corner:hover .octo-arm {
animation: a 0.56s ease-in-out;
}
.github-corner .octo-arm {
animation: none;
}
@keyframes a {
0%,
to {
transform: rotate(0);
}
20%,
60% {
transform: rotate(-25deg);
}
40%,
80% {
transform: rotate(10deg);
}
}
</style>
<a href="https://github.com/jiyongg-code" class="github-corner tooltipped hide-on-med-and-down" target="_blank"
data-tooltip="Fork Me" data-position="left" data-delay="50">
<svg viewBox="0 0 250 250" aria-hidden="true">
<path d="M0,0 L115,115 L130,115 L142,142 L250,250 L250,0 Z"></path>
<path d="M128.3,109.0 C113.8,99.7 119.0,89.6 119.0,89.6 C122.0,82.7 120.5,78.6 120.5,78.6 C119.2,72.0 123.4,76.3 123.4,76.3 C127.3,80.9 125.5,87.3 125.5,87.3 C122.9,97.6 130.6,101.9 134.4,103.2"
fill="currentColor" style="transform-origin: 130px 106px;" class="octo-arm"></path>
<path d="M115.0,115.0 C114.9,115.1 118.7,116.5 119.8,115.4 L133.7,101.6 C136.9,99.2 139.9,98.4 142.2,98.6 C133.8,88.0 127.5,74.4 143.8,58.0 C148.5,53.4 154.0,51.2 159.7,51.0 C160.3,49.4 163.2,43.6 171.4,40.1 C171.4,40.1 176.1,42.5 178.8,56.2 C183.1,58.6 187.2,61.8 190.9,65.4 C194.5,69.0 197.7,73.2 200.1,77.6 C213.8,80.2 216.3,84.9 216.3,84.9 C212.7,93.1 206.9,96.0 205.4,96.6 C205.1,102.4 203.0,107.8 198.3,112.5 C181.9,128.9 168.3,122.5 157.7,114.1 C157.9,116.9 156.7,120.9 152.7,124.9 L141.0,136.5 C139.8,137.7 141.6,141.9 141.8,141.8 Z"
fill="currentColor" class="octo-body"></path>
</svg>
</a>
</nav>
</header>
<script src="/libs/cryptojs/crypto-js.min.js"></script>
<script>
(function() {
let pwd = '';
if (pwd && pwd.length > 0) {
if (pwd !== CryptoJS.SHA256(prompt('请输入访问本文章的密码')).toString(CryptoJS.enc.Hex)) {
alert('密码错误，将返回主页！');
location.href = '/';
}
}
})();
</script>
<div class="bg-cover pd-header post-cover" style="background-image: url('/medias/featureimages/13.jpg')">
<div class="container">
<div class="row">
<div class="col s12 m12 l12">
<div class="brand">
<div class="description center-align post-title">
SpringSecurity-OAuth2 授权码模式
</div>
</div>
</div>
</div>
</div>
</div>
<main class="post-container content">
<link rel="stylesheet" href="/libs/tocbot/tocbot.css">
<style>
#articleContent h1::before,
#articleContent h2::before,
#articleContent h3::before,
#articleContent h4::before,
#articleContent h5::before,
#articleContent h6::before {
display: block;
content: " ";
height: 100px;
margin-top: -100px;
visibility: hidden;
}
#articleContent :focus {
outline: none;
}
.toc-fixed {
position: fixed;
top: 64px;
}
.toc-widget {
padding-left: 20px;
}
.toc-widget .toc-title {
margin: 35px 0 15px 0;
padding-left: 17px;
font-size: 1.5rem;
font-weight: bold;
line-height: 1.5rem;
}
.toc-widget ol {
padding: 0;
list-style: none;
}
#toc-content ol {
padding-left: 10px;
}
#toc-content ol li {
padding-left: 10px;
}
#toc-content .toc-link:hover {
color: #42b983;
font-weight: 700;
text-decoration: underline;
}
#toc-content .toc-link::before {
background-color: transparent;
max-height: 25px;
}
#toc-content .is-active-link {
color: #42b983;
}
#toc-content .is-active-link::before {
background-color: #42b983;
}
#floating-toc-btn {
position: fixed;
right: 20px;
bottom: 76px;
padding-top: 15px;
margin-bottom: 0;
z-index: 998;
}
#floating-toc-btn .btn-floating {
width: 48px;
height: 48px;
}
#floating-toc-btn .btn-floating i {
line-height: 48px;
font-size: 1.4rem;
}
</style>
<div class="row">
<div id="main-content" class="col s12 m12 l9">
<!-- 文章内容详情 -->
<div id="artDetail">
<div class="card">
<div class="card-content article-info">
<div class="row tag-cate">
<div class="col s7">
<div class="article-tag">
<a href="/tags/OAuth2/" target="_blank">
<span class="chip bg-color">OAuth2</span>
</a>
</div>
</div>
<div class="col s5 right-align">
</div>
</div>
<div class="post-info">
<div class="post-date info-break-policy">
<i class="fa fa-calendar-minus-o fa-fw"></i>发布日期:
2023-03-25
</div>
<div class="post-author info-break-policy">
<i class="fa fa-user-o fa-fw"></i>作者:
jiyonggang
</div>
<div class="info-break-policy">
<i class="fa fa-file-word-o fa-fw"></i>文章字数:
4.3k
</div>
<div class="info-break-policy">
<i class="fa fa-clock-o fa-fw"></i>阅读时长:
17 分
</div>
<div id="busuanzi_container_page_pv" class="info-break-policy">
<i class="fa fa-eye fa-fw"></i>阅读次数:
<span id="busuanzi_value_page_pv"></span>
</div>
</div>
</div>
<hr class="clearfix">
<div class="card-content article-card-content">
<div id="articleContent">
<p>在使用 <strong>OAuth2.0</strong> 中 <strong>Authorization Server</strong> （授权服务器）是一个回避不了的设施，在大多数情况下我们调用的是一些知名的、可靠的、可信任的第三方平台，比如 <strong>QQ、微信、微博、github</strong> 等。我们的应用只作为 <strong>Client</strong> 进行注册接入即可。也就是说我们只需要实现 <strong>OAuth2.0</strong> 客户端的逻辑就可以了，无须关心授权服务器的实现。</p>
<p>如果要自己定义一个授权服务器可以用Spring Authorization Server</p>
<p>Spring Security5 OAuth2 授权码模式登录会经过以下几个类：</p>
<ul>
<li><strong>OAuth2AuthorizationRequestRedirectFilter</strong>：这个过滤器用于拦截客户端的授权请求，使用OAuth2AuthorizationRequestResolver来解析OAuth2AuthorizationRequest对象，并重定向到授权服务器的授权端点。里面会调用<strong>DefaultOAuth2AuthorizationRequestResolver</strong>，里面包含授权服务的所有请求参数</li>
<li><strong>OAuth2LoginAuthenticationFilter</strong>：这个过滤器用于处理授权服务器返回的授权码，使用<strong>AuthorizationCodeAuthenticationProvider</strong>来进行身份验证，并获取<strong>OAuth2LoginAuthenticationToken</strong>对象。</li>
<li><strong>OAuth2AuthorizationCodeAuthenticationProvider</strong>：这个提供者用于验证授权码，使用OAuth2AccessTokenResponseClient接口携带code来发送令牌请求，并获取OAuth2AccessTokenResponse对象。</li>
<li><strong>DefaultAuthorizationCodeTokenResponseClient</strong>：这个客户端用于发送令牌请求，使用RestTemplate来发送HTTP请求，并解析响应为OAuth2AccessTokenResponse对象。</li>
<li><strong>OAuth2UserService</strong>：这个服务用于获取用户信息，使用RestTemplate来发送HTTP请求到用户信息端点，并创建OAuth2User对象。</li>
<li><strong>DefaultOAuth2UserService</strong>：这个服务是OAuth2UserService的默认实现，它可以根据不同的用户信息响应格式来适配不同的提供者。</li>
</ul>
<h2 id="OAuth2AuthorizationRequestRedirectWebFilter"><a href="#OAuth2AuthorizationRequestRedirectWebFilter" class="headerlink" title="OAuth2AuthorizationRequestRedirectWebFilter"></a>OAuth2AuthorizationRequestRedirectWebFilter</h2><p>先来看第一个<code>OAuth2AuthorizationRequestRedirectWebFilter</code>，它实现了Spring Webflux的<code>WebFilter</code>接口，这显然是Webflux的东西，如果你用到Webflux的话这个会有用，但是不是现在用的。</p>
<h3 id="DefaultOAuth2AuthorizationRequestResolver"><a href="#DefaultOAuth2AuthorizationRequestResolver" class="headerlink" title="DefaultOAuth2AuthorizationRequestResolver"></a>DefaultOAuth2AuthorizationRequestResolver</h3><p>从名称上看着是一个默认OAuth2授权请求解析器。它实现了接口OAuth2AuthorizationRequestResolver</p>
<p><img src="/springsecurity-oauth2/image-20230801145153240.png" alt="image-20230801145153240"></p>
<p>就是把HttpServletRequest 和ClientRegistrationID封装成OAuth2AuthorizationRequest</p>
<p>当请求<code>/oauth2/authorization</code>时，<code>DefaultOAuth2AuthorizationRequestResolver</code> 会从<code>/oauth2/authorization</code>对应的<code>HttpServletRequest</code>中提取数据封装到<code>OAuth2AuthorizationRequest</code>请求对象中做进一步使用。</p>
<p><code>/oauth2/authorization</code>这个默认拦截标识也是可以自定义的。</p>
<ul>
<li>通过实现<code>OAuth2AuthorizationRequestResolver</code>接口，自定义授权请求的解析逻辑，并在<code>OAuth2AuthorizationRequestRedirectFilter</code>中注入该实现类</li>
<li>通过配置<code>oauth2Login().authorizationEndpoint().baseUri()</code>方法，修改授权请求的基础路径</li>
<li>[通过实现<code>AccessDecisionManager</code>接口，自定义决策管理器，判断是否有访问权限，并在<code>WebSecurityConfig</code>中配置启用<code>filterSecurityInterceptor</code>。</li>
</ul>
<h3 id="OAuth2AuthorizationRequest"><a href="#OAuth2AuthorizationRequest" class="headerlink" title="OAuth2AuthorizationRequest"></a>OAuth2AuthorizationRequest</h3><p>封装了一些OAuth2相关概念参数</p>
<p><img src="/springsecurity-oauth2/image-20230801151136827.png" alt="image-20230801151136827"></p>
<h3 id="OAuth2AuthorizationRequestRedirectFilter"><a href="#OAuth2AuthorizationRequestRedirectFilter" class="headerlink" title="OAuth2AuthorizationRequestRedirectFilter"></a>OAuth2AuthorizationRequestRedirectFilter</h3><p>继承了 OncePerRequestFilter</p>
<p>这个过滤器用于拦截客户端的授权请求，使用OAuth2AuthorizationRequestResolver来解析OAuth2AuthorizationRequest对象，并重定向到授权服务器的授权端点。</p>
<p><img src="/springsecurity-oauth2/image-20230801161322372.png" alt="image-20230801161322372"></p>
<p><img src="/springsecurity-oauth2/image-20230801162945544.png" alt="image-20230801162945544"></p>
<p><img src="/springsecurity-oauth2/image-20230801162956665.png" alt="image-20230801162956665"></p>
<p>主要是用sendRedirectForAuthorization</p>
<h3 id="sendRedirectForAuthorization"><a href="#sendRedirectForAuthorization" class="headerlink" title="sendRedirectForAuthorization"></a>sendRedirectForAuthorization</h3><p>它的主要作用就是向第三方平台进行授权重定向访问。它所有的逻辑都和<code>OAuth2AuthorizationRequest</code>有关</p>
<h3 id="OAuth2AuthorizationRequestResolver"><a href="#OAuth2AuthorizationRequestResolver" class="headerlink" title="OAuth2AuthorizationRequestResolver"></a>OAuth2AuthorizationRequestResolver</h3><p>需要去分析解析类<code>OAuth2AuthorizationRequestResolver</code></p>
<p><img src="/springsecurity-oauth2/image-20230801163501080.png" alt="image-20230801163501080"></p>
<p>上面方法里面的<code>resolve(request, registrationId, redirectUriAction)</code>方法才是最终从<code>/oauth2/authorization</code>提取<code>OAuth2AuthorizationRequest</code>的根本方法。</p>
<p>resolve<code>方法会根据不同的授权方式(</code>AuthorizationGrantType<code>)来组装不同的</code>OAuth2AuthorizationRequest</p>
<p><img src="/springsecurity-oauth2/image-20230801163656733.png" alt="image-20230801163656733"></p>
<pre><code>
// registrationId是通过uri路径参数/oauth2/authorization/{registrationId}获得的
String registrationId = this.resolveRegistrationId(request);
// 然后去请求对象request中提取key为action的参数，默认值是login
String redirectUriAction = getAction(request, "login");
// 然后进入根本的解析方法
return resolve(request, registrationId, redirectUriAction);
</code></pre><h3 id="OAuth2AuthorizationRequest-1"><a href="#OAuth2AuthorizationRequest-1" class="headerlink" title="OAuth2AuthorizationRequest"></a>OAuth2AuthorizationRequest</h3><p><code>OAuth2AuthorizationRequestResolver</code>在各种授权方式下的<code>OAuth2AuthorizationRequest</code>对象的解析</p>
<p><img src="/springsecurity-oauth2/image-20230801170100554.png" alt="image-20230801170100554"></p>
<h3 id="由AuthorizationGrantType决定的"><a href="#由AuthorizationGrantType决定的" class="headerlink" title="由AuthorizationGrantType决定的"></a>由AuthorizationGrantType决定的</h3><ul>
<li><code>authorizationGrantType</code> ，来自配置ClientRegistration.getAuthorizationGrantType()。</li>
<li><code>responseType</code> ， 由<code>authorizationGrantType</code> 的值决定</li>
<li><code>additionalParameters</code>，当<code>authorizationGrantType</code>值为<code>authorization_code</code>时需要额外的一些参数</li>
<li><code>attributes</code>，不同的<code>authorizationGrantType</code>存在不同的属性</li>
</ul>
<p>在OAuth2客户端配置中有以下五种情况:</p>
<p>其中类似<code>{registrationId}</code> 的形式表示<code>{registrationId}</code>是一个变量</p>
<p>是用来指定客户端的注册信息，包括客户端 ID，客户端密钥，授权类型，授权范围等信息。这些信息是用来向认证服务器发起授权请求的。</p>
<p>OAuth2AuthorizationRequest最终会拼装成 URL 的形式请求授权服务器。下面是json的格式，最终会拼成url</p>
<p>当 <code>scope</code> 不包含<code>openid</code>而且<code>client-authentication-method</code>不为<code>none</code>时上述四个参数</p>
<pre><code>{
"authorizationGrantType": "authorization_code",
"responseType": "code",
"additionalParameters": {},
"attributes": {
"registration_id": "{registrationId}"
}
}</code></pre><p>当 <code>scope</code> 包含<code>openid</code>而且<code>client-authentication-method</code>不为<code>none</code>时上述四个参数：</p>
<pre><code>{
"authorizationGrantType": "authorization_code",
"responseType": "code",
"additionalParameters": {
"nonce": "{nonce}的Hash值"
},
"attributes": {
"registration_id": "{registrationId}",
"nonce": "{nonce}"
}
}</code></pre><p>当 <code>scope</code>不包含<code>openid</code>而且<code>client-authentication-method</code>为<code>none</code>时上述四个参数：</p>
<pre><code>{
"authorizationGrantType": "authorization_code",
"responseType": "code",
"additionalParameters": {
"code_challenge": "{codeVerifier}的Hash值",
// code_challenge_method 当不是SHA256可能没有该key
"code_challenge_method": "S256（如果是SHA256算法的话）"
},
"attributes": {
"registration_id": "{registrationId}",
"code_verifier": "Base64生成的安全{codeVerifier}"
}
}</code></pre><p>当 <code>scope</code>包含<code>openid</code>而且<code>client-authentication-method</code>为<code>none</code>时上述四个参数：</p>
<pre><code>{
"authorizationGrantType": "authorization_code",
"responseType": "code",
"additionalParameters": {
"code_challenge": "{codeVerifier}的Hash值",
// code_challenge_method 当不是SHA256可能没有该key
"code_challenge_method": "S256（如果是SHA256算法的话）",
"nonce": "{nonce}的Hash值"
},
"attributes": {
"registration_id": "{registrationId}",
"code_verifier": "Base64生成的安全{codeVerifier}",
"nonce": "{nonce}"
}
}</code></pre><p><code>implicit</code>下要简单的多：</p>
<pre><code>{
"authorizationGrantType": "implicit",
"responseType": "token",
"attributes": {}
}</code></pre><h3 id="固定规则部分"><a href="#固定规则部分" class="headerlink" title="固定规则部分"></a>固定规则部分</h3><p>上面是各种不同<code>AuthorizationGrantType</code>下的<code>OAuth2AuthorizationRequest</code>的成员变量个性化取值策略， 还有几个参数的规则是固定的：</p>
<ul>
<li><code>clientId</code> 来自于配置，是第三方平台给予我们的唯一标识。</li>
<li><code>authorizationUri</code>来自于配置，用来构造向第三方发起的请求URL。</li>
<li><code>scopes</code> 来自于配置，是第三方平台给我们授权划定的作用域，可以理解为角色。</li>
<li><code>state</code> 自动生成的，为了防止csrf 攻击。</li>
<li><code>authorizationRequestUri</code> 向第三方平台发起授权请求的，可以直接通过<code>OAuth2AuthorizationRequest</code>的构建类来设置或者通过上面的<code>authorizationUri</code>等参数来生成。</li>
<li><code>redirectUri</code> 当<code>OAuth2AuthorizationRequest</code>被第三方平台收到后，第三方平台会回调这个URI来对授权请求进行相应。</li>
</ul>
<h4 id="authorizationRequestUri的构建机制"><a href="#authorizationRequestUri的构建机制" class="headerlink" title="authorizationRequestUri的构建机制"></a>authorizationRequestUri的构建机制</h4><p>是一个表示授权请求的 URI，它包含了所有的请求参数，使用 application/x-www-form-urlencoded 格式。它是用来向认证服务器发起授权请求的，客户端可以通过重定向到 authorizationRequestUri 来启动授权流程。</p>
<p>authorizationRequestUri 是由 OAuth2AuthorizationRequest.Builder.build() 方法构造的，它根据不同的授权类型和客户端的注册信息来拼装请求参数，例如 client-id，response-type，scope，redirect-uri 等。这些参数可以从 spring.security.client.registration 配置属性中获取，也可以从请求对象中提取。</p>
<p>如果不显式提供<code>authorizationRequestUri</code>就会通过<code>OAuth2AuthorizationRequest</code>中的</p>
<ul>
<li><p><code>responseType</code></p>
</li>
<li><p><code>clientId</code></p>
</li>
<li><p><code>scopes</code></p>
</li>
<li><p><code>state</code></p>
</li>
<li><p><code>redirectUri</code></p>
</li>
<li><p><code>additionalParameters</code></p>
<p>按照下面的规则进行拼接成<code>authorizationUri</code>的参数串，参数串的<code>key</code>和<code>value</code>都要进行URI编码。</p>
<ul>
<li>按照下面的规则进行拼接成<code>authorizationUri</code>的参数串，参数串的<code>key</code>和<code>value</code>都要进行URI编码。</li>
</ul>
<pre><code>authorizationUri?response_type={responseType.getValue()}&client_id={clientId}&scope={scopes元素一个字符间隔}&state={state}&redirect_uri={redirectUri}&{additionalParameter展开进行同样规则的KV参数串}</code></pre><p>然后<code>OAuth2AuthorizationRequestRedirectFilter</code>负责重定向到<code>authorizationRequestUri</code>向第三方请求授权</p>
</li>
</ul>
<h4 id="redirectUri"><a href="#redirectUri" class="headerlink" title="redirectUri"></a>redirectUri</h4><p>第三方收到响应会调用<code>redirectUri</code>，回调也是有一定规则的，遵循<code>{baseUrl}/{action}/oauth2/code/{registrationId}</code>的路径参数规则。</p>
<ul>
<li><code>baseUrl</code> 是从我们<code>/oauth2/authorization</code>请求中提取的基础请求路径。</li>
<li><code>action</code>，有两种默认值<code>login</code>、<code>authorize</code> ，当<code>/oauth2/authorization</code>请求中包含了<code>action</code>参数时会根据<code>action</code>的值进行填充。</li>
</ul>
<p><code>OAuth2AuthorizationRequestRedirectFilter</code>流程：</p>
<ol>
<li>通过客户端配置构建<code>ClientRegistration</code>，后续可以进行持久化。</li>
<li>拦截<code>/oauth2/authorization</code>请求并构造<code>OAuth2AuthorizationRequest</code>，然后重定向到<code>authorizationRequestUri</code>进行请求授权。</li>
<li>第三方通过<code>redirect_uri</code>进行相应。</li>
</ol>
<h1 id="回调"><a href="#回调" class="headerlink" title="回调"></a>回调</h1><h2 id="OAuth2登录认证"><a href="#OAuth2登录认证" class="headerlink" title="OAuth2登录认证"></a>OAuth2登录认证</h2><p>当第三方收到OAuth2授权请求后，会将授权的回执通过我方提供的回调请求<code>redirect_uri</code>传递给我们。由于默认情况下回调的路径满足<code>/login/oauth2/code/*</code>，所以我们只要找到拦截回调的过滤器就可以知道Spring Security是如何处理回调了</p>
<h2 id="OAuth2LoginAuthenticationFilter"><a href="#OAuth2LoginAuthenticationFilter" class="headerlink" title="OAuth2LoginAuthenticationFilter"></a>OAuth2LoginAuthenticationFilter</h2><p>第三方认证服务器在调用<code>redirect_uri</code>时附加<code>code</code>和<code>state</code>参数，在被这个<code>Filter</code>拦截后，创建一个待认证凭据<code>OAuth2LoginAuthenticationToken</code>，并委托给了<code>AuthenticationManager</code>进行身份验证。</p>
<p>一旦成功验证，则生成认证凭据<code>OAuth2AuthenticationToken</code>和认证客户端对象<code>OAuth2AuthorizedClient</code>。 最后， <code>OAuth2AuthenticationToken</code>返回，并最终存储在<code>SecurityContextRepository</code>完成认证处理；而</p>
<p><img src="/springsecurity-oauth2/image-20230801205032925.png" alt="image-20230801205032925"></p>
<p>这个过滤器和<code>UsernamePasswordAuthenticationFilter</code>一样继承了<code>AbstractAuthenticationProcessingFilter</code>，流程有相像的地方</p>
<h2 id="OAuth2对应的AuthenticationProvider"><a href="#OAuth2对应的AuthenticationProvider" class="headerlink" title="OAuth2对应的AuthenticationProvider"></a>OAuth2对应的AuthenticationProvider</h2><p>OAuth2LoginAuthenticationProvider</p>
<h2 id="OAuth2LoginAuthenticationProvider"><a href="#OAuth2LoginAuthenticationProvider" class="headerlink" title="OAuth2LoginAuthenticationProvider"></a>OAuth2LoginAuthenticationProvider</h2><p><code>OAuth2LoginAuthenticationProvider</code>实现了授权回调的认证过程：</p>
<p><img src="/springsecurity-oauth2/image-20230801213107713.png" alt="image-20230801213107713"></p>
<p>具体认证由<code>OAuth2AuthorizationCodeAuthenticationProvider</code>来负责，认证通过后会去获取用户的信息并封装为<code>OAuth2User</code>，最终生成授权成功的<code>OAuth2LoginAuthenticationToken</code>。</p>
<p>在OAuth2LoginAuthenticationProvider的构造方法里面有一个<code>OAuth2AccessTokenResponseClient</code></p>
<p><img src="/springsecurity-oauth2/image-20230801214249780.png" alt="image-20230801214249780"></p>
<p>在该实现中包含了一个<code>OAuth2AccessTokenResponseClient</code>成员变量，它抽象了通过<code>tokenUri</code>端点从认证服务器获取<strong>Token</strong>的细节。你可以根据<strong>OAuth 2.0</strong>常用的四种模式来进行实现它， 以达到根据不同的策略来获取<strong>Token</strong>的能力。</p>
<h2 id="DefaultAuthorizationCodeTokenResponseClient"><a href="#DefaultAuthorizationCodeTokenResponseClient" class="headerlink" title="DefaultAuthorizationCodeTokenResponseClient"></a>DefaultAuthorizationCodeTokenResponseClient</h2><p>OAuth2AccessTokenResponseClient的实现类</p>
<p>在<strong>Spring Security 5</strong>中<strong>OAuth 2.0</strong>登录的配置中默认使用<code>DefaultAuthorizationCodeTokenResponseClient</code>。如果你想使用自定义实现的话可以通过<code>HttpSecurity</code>来配置</p>
<pre><code> @Override
protected void configure(HttpSecurity http) throws Exception {
http.oauth2Login()
.tokenEndpoint()
// 注入自定义的 OAuth2AccessTokenResponseClient
.accessTokenResponseClient(authorizationCodeTokenResponseClient);
// 其它省略
}</code></pre><p><img src="/springsecurity-oauth2/image-20230801215448743.png" alt="image-20230801215448743"></p>
<ul>
<li>DefaultAuthorizationCodeTokenResponseClient：用于处理授权码授权类型的令牌响应，它会根据授权请求中的授权码和重定向 URI 向令牌端点发送请求，并返回一个包含访问令牌和可选的刷新令牌的 OAuth2AccessTokenResponse 对象。</li>
<li>DefaultClientCredentialsTokenResponseClient：用于处理客户端凭证授权类型的令牌响应，它会根据客户端 ID 和客户端密钥向令牌端点发送请求，并返回一个包含访问令牌的 OAuth2AccessTokenResponse 对象。</li>
<li>DefaultJwtBearerTokenResponseClient：用于处理 JWT Bearer 授权类型的令牌响应，它会根据客户端 ID 和 JWT 断言向令牌端点发送请求，并返回一个包含访问令牌的 OAuth2AccessTokenResponse 对象。</li>
<li>DefaultPasswordTokenResponseClient：用于处理密码授权类型的令牌响应，它会根据客户端 ID、客户端密钥、用户名和密码向令牌端点发送请求，并返回一个包含访问令牌和可选的刷新令牌的 OAuth2AccessTokenResponse 对象。</li>
<li>DefaultRefreshTokenTokenResponseClient：用于处理刷新令牌授权类型的令牌响应，它会根据客户端 ID、客户端密钥和刷新令牌向令牌端点发送请求，并返回一个包含新的访问令牌和可选的刷新令牌的 OAuth2AccessTokenResponse 对象。</li>
</ul>
<p>DefaultAuthorizationCodeTokenResponseClient的主要方法</p>
<p><img src="/springsecurity-oauth2/image-20230801230601870.png" alt="image-20230801230601870"></p>
<h1 id="OAuth2UserService-（用code获取用户信息）"><a href="#OAuth2UserService-（用code获取用户信息）" class="headerlink" title="OAuth2UserService （用code获取用户信息）"></a>OAuth2UserService （用code获取用户信息）</h1><ul>
<li><strong>DefaultOAuth2UserService</strong>：这个类是OAuth2UserService的默认实现，它可以根据不同的用户信息响应格式来适配不同的提供者，如Google、GitHub、Facebook等。它使用RestOperations来发送HTTP请求到用户信息端点，并使用OAuth2UserRequest和OAuth2UserAuthority来创建OAuth2User对象。</li>
<li><strong>OidcUserService</strong>：这个类是OAuth2UserService的一个扩展，它专门用于处理OpenID Connect（OIDC）协议的用户信息响应。它继承了DefaultOAuth2UserService，并重写了loadUser方法，使用OidcUserRequest和OidcUserAuthority来创建OidcUser对象。OidcUser对象包含了OIDC标准的用户信息，如id_token、sub、name等。</li>
<li><strong>DelegatingOAuth2UserService</strong>是一个类，它实现了OAuth2UserService接口，它的作用是根据不同的提供者来委派不同的OAuth2UserService来处理用户信息响应。它可以通过构造器来注入一个列表的OAuth2UserService，每个OAuth2UserService都可以指定一个或多个提供者的标识（registrationId）。当DelegatingOAuth2UserService收到一个用户请求时，它会根据用户请求中的提供者标识来选择一个合适的OAuth2UserService来调用loadUser方法，并返回一个用户对象。如果没有找到合适的OAuth2UserService，它会抛出异常。DelegatingOAuth2UserService可以实现多个提供者的用户信息映射的灵活配置和扩展。</li>
</ul>
<h2 id="DefaultOAuth2UserService"><a href="#DefaultOAuth2UserService" class="headerlink" title="DefaultOAuth2UserService"></a>DefaultOAuth2UserService</h2><p><img src="/springsecurity-oauth2/image-20230801235817263.png" alt="image-20230801235817263"></p>
<p><img src="/springsecurity-oauth2/image-20230801235832601.png" alt="image-20230801235832601"></p>
<p>DefaultOAuth2User是一个类，它实现了OAuth2User接口，它的作用是表示一个默认的OAuth2用户。它包含以下属性：</p>
<ul>
<li><strong>authorities</strong>：表示用户的权限集合，可以包含用户的属性和角色。</li>
<li><strong>attributes</strong>：表示用户的属性，是一个键值对的映射，可以包含用户的标识、姓名、邮箱等信息。</li>
<li><strong>nameAttributeKey</strong>：表示用户名属性名，是用户属性中的一个键，用于获取用户的名称。</li>
</ul>
<p>DefaultOAuth2User提供了一些方法来访问这些属性，如getAuthorities、getAttributes、getNameAttributeKey、getName等。它还重写了equals、hashCode和toString方法，以便于比较和打印用户对象。拿到用户信息了</p>
<p>当DefaultOAuth2UserService获取到用户信息后，它会创建一个OAuth2AuthenticationToken，并将其设置到SecurityContextHolder中。然后，它会触发AuthenticationSuccessHandler，用于处理认证成功后的逻辑。</p>
<pre><code>import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.security.oauth2.core.user.OAuth2User;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
public class UserController {
@GetMapping("/user")
public String getUserInfo(@AuthenticationPrincipal OAuth2User oauth2User) {
String username = oauth2User.getName();
String email = oauth2User.getAttribute("email");
String pictureUrl = oauth2User.getAttribute("picture");
return "Username: " + username + "<br>"
+ "Email: " + email + "<br>"
+ "Picture URL: " + pictureUrl;
}