Spring Boot OAuth2登录中corrID的存储与取回最佳方案咨询

核心思路 #

借助Spring Security OAuth2原生提供的OAuth2AuthorizationRequestRepository扩展点，在构建谷歌授权请求时提取并存储corrID，待认证回调完成后，从授权请求对象中取回该参数。这个方案完全贴合Spring Security OAuth2的认证流程，是官方推荐的标准实现方式。

具体实现步骤 #

1. 实现自定义AuthorizationRequestRepository #

创建类实现OAuth2AuthorizationRequestRepository<OAuth2AuthorizationRequest>，在保存授权请求时注入corrID：

import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRepository;
import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
import org.springframework.stereotype.Component;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

@Component
public class CustomAuthorizationRequestRepository implements OAuth2AuthorizationRequestRepository<OAuth2AuthorizationRequest> {

    private static final String AUTH_REQUEST_SESSION_KEY = "oauth2_auth_request";

    @Override
    public OAuth2AuthorizationRequest loadAuthorizationRequest(HttpServletRequest request) {
        return (OAuth2AuthorizationRequest) request.getSession().getAttribute(AUTH_REQUEST_SESSION_KEY);
    }

    @Override
    public void saveAuthorizationRequest(OAuth2AuthorizationRequest authorizationRequest, HttpServletRequest request, HttpServletResponse response) {
        // 从请求中提取corrID并存入授权请求的额外参数
        String corrID = request.getParameter("corrID");
        if (corrID != null) {
            authorizationRequest.getAdditionalParameters().put("corrID", corrID);
        }
        request.getSession().setAttribute(AUTH_REQUEST_SESSION_KEY, authorizationRequest);
    }

    @Override
    public OAuth2AuthorizationRequest removeAuthorizationRequest(HttpServletRequest request, HttpServletResponse response) {
        OAuth2AuthorizationRequest authRequest = loadAuthorizationRequest(request);
        request.getSession().removeAttribute(AUTH_REQUEST_SESSION_KEY);
        return authRequest;
    }
}

2. 配置SecurityFilterChain注入自定义Repository #

在Spring Security配置类中，将自定义的Repository关联到OAuth2登录流程，并在认证成功后取回corrID：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig {

    private final CustomAuthorizationRequestRepository customAuthRequestRepo;

    public SecurityConfig(CustomAuthorizationRequestRepository customAuthRequestRepo) {
        this.customAuthRequestRepo = customAuthRequestRepo;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            )
            .oauth2Login(oauth2 -> oauth2
                .authorizationEndpoint(endpoint -> endpoint
                    // 指定自定义的授权请求仓库
                    .authorizationRequestRepository(customAuthRequestRepo)
                )
                .successHandler((request, response, authentication) -> {
                    // 从授权请求中取出corrID
                    OAuth2AuthorizationRequest authRequest = customAuthRequestRepo.loadAuthorizationRequest(request);
                    String corrID = (String) authRequest.getAdditionalParameters().get("corrID");
                    
                    // 这里可根据业务需求处理corrID，比如携带参数重定向到业务页面
                    response.sendRedirect("/auth-success?corrID=" + corrID);
                })
            );
        return http.build();
    }
}

3. 分布式场景适配 #

如果是分布式部署，可将授权请求存储到Redis等分布式缓存中，只需要修改CustomAuthorizationRequestRepository的存储逻辑，替换Session为RedisTemplate即可，核心逻辑保持不变。

方案优势 #

• 原生兼容：完全基于Spring Security OAuth2扩展机制，不破坏原有认证链路
• 安全可靠：授权请求由Spring Security统一管理，避免参数泄露或篡改
• 灵活扩展：支持单机、分布式多种部署场景，可按需调整存储方式
• 无额外依赖：无需引入第三方组件，利用现有Spring生态即可实现

内容的提问来源于stack exchange，提问作者George Jose