Spring Boot集成com.auth0实现JWT认证遇问题：无响应及首页空白

我正在为特定端点/employees实现JWT认证，目前项目已集成SAML认证。相关版本信息：

• Spring Boot版本：2.7.18
• com.auth0(java-jwt)版本：4.4.0
• com.auth0(jwks-rsa)版本：0.22.1

相关配置与代码 #

Spring Security配置（SpringSecurityConfig.java） #

@Bean
public FilterChainProxy samlAuthFilter(HttpSecurity http) throws Exception {
    List<SecurityFilterChain> chains = new ArrayList<>();
    chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/**"), //SecurityContextHolderAwareRequestFilter as a bean));
    chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/**"), //SecurityContextHolderFilter as a bean));
    chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/SSO/**"),
        //SAML Processing Filter as a bean));
    chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/metadata/**"),
        //Metadata Display Filter as a bean));
    chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/SSOHoK/**"),
        //SAMLWebSSOHoKProcessingFilter as a bean with authentication success and failure handler));
    chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/employees"),
        //JWTFilter));

    return new FilterChainProxy(chains);
}

//Security Filter Chain configure method
@Bean
protected SecurityFilterChain configure(HttpSecurity http) throws Exception {
   http.csrf.disable();
   http.addFilterBefore(samlAuthFilter(), BasicAuthenticationFilter.class);
   //setting CSP and Referrer Policy to http headers.
   return http.build();
}

JWT认证过滤器（JWTTokenAuth.java） #

//All necessary import statements
public class JWTTokenAuth implements Filter {

   JwkProvider provider;

   @Autowired
   ApplicationContext applicationContext;

   public JWTTokenAuth() throws MalformedURLException {
      provider = new JwkProviderBuilder(new URL(/*keyProvider URL*/)).build();
   }

   @Override
   public void doFilter (ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {

       if(SecurityContextHolder.getContext().getAuthentication() == null &&
            ((HttpServletRequest) request).getHeader("Authorization") != null) {

            logger.info("Inside token validation");
            String tokenFromReq = ((HttpServletRequest) request).getHeader("Authorization").subString(7);
            
            DecodedJWT decodedToken = JWT.decode(tokenFromReq);

            try {

                Jwk jwk = jwkProvider.get(decodedToken.getKey);

                Algorithm algorithm = Algorithm.RSA256((RSAPublicKey) jwk.getPublicKey(), null);

                JWTVerifier verifier = JWT.require(algorithm).withIssuer(/*issuer here*/).withAudience(/*audience*/).build();

                verifier.verify(decodedToken);

                logger.info("Token Validated");

                String username = decodedToken.getClaim("Username").asString();

                UserDetails userDetails = applicationContext.getBean(AppUsersDetails.class).loadUserByUsername(username);

                UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
                authToken.setDetails(new WebAuthenticationDetailsSource.buildDetails(((HttpServletRequest) request)));

                SecurityContextHolder.getContext().setAuthentication(authToken);

            } catch (JwkException e) {
                e.printStackTrace();
            } catch(Exception e) {
                e.printStackTrace();
            }
            chain.doFilter(request,response);
       }
   }
}

问题现象 #

• 本地运行：使用有效Token调用/employees端点返回200状态码，但响应体为空，且JWTTokenAuth中的日志未打印
• 服务器部署：应用首页加载空白，日志中无任何错误或异常信息
• 此前SAML认证正常，项目无编译或运行时错误

1. JWT过滤器未执行的核心原因：过滤器链顺序错误 #

Spring Security的过滤器链是按注册顺序匹配的，一旦前面的/**通用链匹配成功，后面的/employees精确匹配链不会被执行。你当前的配置把/employees链放在了两个/**链之后，导致请求/employees时直接走通用链，JWT过滤器根本没机会运行。

修复：将/employees的过滤器链移到所有通用链的最前面，确保精确匹配优先：

List<SecurityFilterChain> chains = new ArrayList<>();
// 先添加精确匹配的/employees链
chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/employees"), jwtFilter));
// 再添加通用和SAML相关链
chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/**"), securityContextHolderAwareRequestFilter));
chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/**"), securityContextHolderFilter));
chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/SSO/**"), samlProcessingFilter));
// ... 其他SAML相关链

2. JWT过滤器代码的致命问题 #

（1）请求截断导致响应体为空 #

你的chain.doFilter(request,response);放在了if分支内部，当请求没有Authorization头、或者已有认证信息时，不会执行该方法，直接截断请求，导致响应体为空。

修复：将chain.doFilter移到if分支外部，确保所有请求都能继续向下处理：

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    if(SecurityContextHolder.getContext().getAuthentication() == null &&
            ((HttpServletRequest) request).getHeader("Authorization") != null) {
        // 原有的认证逻辑
    }
    // 必须移到外部，保证请求流转
    chain.doFilter(request,response);
}

（2）变量名与API调用错误 #

• 构造方法初始化的是provider，但代码中用了未定义的jwkProvider，运行时会抛异常，被catch后仅打印堆栈但无日志输出
• decodedToken.getKey()应为decodedToken.getKeyId()（auth0官方API获取kid的方法）
• subString拼写错误，正确为substring（小写s）
• WebAuthenticationDetailsSource.buildDetails调用错误，需先实例化对象再调用方法

修复后的核心代码片段：

// 修正变量名
Jwk jwk = provider.get(decodedToken.getKeyId());
// 修正substring拼写
String tokenFromReq = ((HttpServletRequest) request).getHeader("Authorization").substring(7);
// 修正WebAuthenticationDetailsSource调用
WebAuthenticationDetailsSource detailsSource = new WebAuthenticationDetailsSource();
authToken.setDetails(detailsSource.buildDetails((HttpServletRequest) request));

（3）日志未打印 #

检查JWTTokenAuth是否正确初始化Logger：

private static final Logger logger = LoggerFactory.getLogger(JWTTokenAuth.class);

未初始化Logger会导致logger.info无输出。

3. 服务器部署后首页空白问题 #

由于过滤器链顺序错误，通用链的SecurityContext相关过滤器可能截断了首页请求。修复过滤器链顺序后，该问题大概率会解决。同时检查服务器日志级别，是否关闭了info/debug级别的日志输出，导致错误信息无法查看。

4. Spring Security配置优化（可选） #

Spring Boot 2.7.x推荐通过多SecurityFilterChain Bean的方式配置不同路径的认证规则，无需手动创建FilterChainProxy，Spring会自动按匹配精度排序执行，更可靠：

@Bean
public SecurityFilterChain jwtFilterChain(HttpSecurity http) throws Exception {
    http.antMatcher("/employees")
        .csrf().disable()
        .addFilterBefore(jwtFilter, BasicAuthenticationFilter.class)
        .authorizeRequests()
        .anyRequest().authenticated();
    return http.build();
}

@Bean
public SecurityFilterChain samlFilterChain(HttpSecurity http) throws Exception {
    http.antMatcher("/saml/**")
        .csrf().disable()
        // 配置SAML相关过滤器与认证逻辑
        .authorizeRequests()
        .anyRequest().authenticated();
    return http.build();
}

@Bean
public SecurityFilterChain defaultFilterChain(HttpSecurity http) throws Exception {
    http.antMatcher("/**")
        .csrf().disable()
        .addFilterBefore(securityContextHolderAwareRequestFilter, BasicAuthenticationFilter.class)
        .addFilterBefore(securityContextHolderFilter, BasicAuthenticationFilter.class)
        .authorizeRequests()
        .antMatchers("/").permitAll()
        .anyRequest().authenticated();
    return http.build();
}

内容的提问来源于stack exchange，提问作者Heyyou