Spring Cloud Gateway配置OAuth2后无法开放公共接口求助

核心问题 #

基于Spring Cloud Gateway + OAuth2 + Spring Security的微服务架构中，TokenRelay过滤器可正常传递JWT令牌访问受保护API，但无法配置公开访问（permitAll）的API路径——即使在网关设置anyExchange().permitAll()也未生效。

关键排查点与解决步骤 #

1. 网关路由与过滤器顺序问题 #

当前网关路由中，tokenRelay()过滤器会强制尝试传递令牌，而公开API不需要令牌，必须针对公开路径单独配置路由并跳过TokenRelay，且公开路由要放在受保护路由前面（Gateway路由按顺序匹配，优先匹配前面的规则）。

修改GatewayConfig：

@Configuration
public class GatewayConfig {

    private static final String SEGMENT = "/${segment}";

    @Bean
    public RouteLocator routeLocator(RouteLocatorBuilder builder) {
        return builder.routes()
                // 公开API路由：跳过TokenRelay过滤器
                .route("microservice-a-public-route", r -> r.path("/microservice-a-service/api/public/**")
                        .filters(f -> f.rewritePath("/microservice-a-service/(?<segment>.*)", SEGMENT))
                        .uri("lb://microservice-a"))
                // 受保护API路由：保留TokenRelay
                .route("microservice-a-route", r -> r.path("/microservice-a-service/**")
                        .filters(f -> f.rewritePath("/microservice-a-service/(?<segment>.*)", SEGMENT).tokenRelay())
                        .uri("lb://microservice-a"))
                .route("microservice-b-route", r -> r.path("/microservice-b-service/**")
                        .filters(f -> f.rewritePath("/microservice-b-service/(?<segment>.*)", SEGMENT).tokenRelay())
                        .uri("lb://microservice-b"))
                .build();
    }
}

2. 网关Security配置的路径匹配规则 #

网关使用响应式的ServerHttpSecurity，路径匹配要对应网关接收的原始请求路径，而非重写后传递给微服务的路径。

修改Gateway Security Config：

@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http, ReactiveClientRegistrationRepository clientRepository) {

    http
            .authorizeExchange(authorize -> authorize
                    .pathMatchers("/actuator/**").permitAll()
                    // 匹配网关侧的原始请求路径
                    .pathMatchers("/microservice-a-service/api/public/**").permitAll()
                    .anyExchange().authenticated())
            .oauth2Login(login -> login.authorizationRequestResolver(pkceResolver(clientRepository)))
            .oauth2Client(Customizer.withDefaults());

    return http.build();
}

3. 微服务侧Security配置校验 #

确保微服务A的Security配置中公开路径规则正确，同时关闭不必要的CSRF拦截（公开API场景下无需CSRF保护）：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http, OAuth2AuthorizedClientRepository authClientRepo) throws Exception {
    http
            .csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(auth -> auth
                    .requestMatchers("/api/public/**").permitAll()
                    .requestMatchers("/admin/**").hasRole("ADMIN")
                    .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()))
            .oauth2Client(client -> client.authorizedClientRepository(authClientRepo));
    return http.build();
}

4. 验证逻辑 #

启动网关与微服务A后，直接访问http://网关地址/microservice-a-service/api/public/xxx，确认无需认证即可获取响应。

内容的提问来源于stack exchange，提问作者Shail