添加@Async注解后订单接口出现403禁止访问错误排查

1. 修正SecurityContext异步传递逻辑 #

Spring Security默认不会自动将安全上下文传递到异步线程，手动传递时需确保线程池支持上下文继承：

• 在配置类中设置上下文传递策略，让子线程能继承父线程的认证信息：

@Configuration
public class SecurityConfig {
    static {
        SecurityContextHolder.setStrategyName(SecurityContextHolder.MODE_INHERITABLETHREADLOCAL);
    }
}

• 自定义带上下文装饰的异步线程池（推荐方式，避免内存泄漏）：

@Bean("orderAsyncExecutor")
public Executor asyncExecutor() {
    ThreadPoolTaskExecutor executor = new ThreadPoolTaskExecutor();
    executor.setCorePoolSize(3);
    executor.setMaxPoolSize(5);
    executor.setQueueCapacity(100);
    executor.setThreadNamePrefix("OrderAsync-");
    // 用TaskDecorator传递SecurityContext
    executor.setTaskDecorator(runnable -> {
        SecurityContext context = SecurityContextHolder.getContext();
        return () -> {
            try {
                SecurityContextHolder.setContext(context);
                runnable.run();
            } finally {
                SecurityContextHolder.clearContext();
            }
        };
    });
    executor.initialize();
    return executor;
}

• 在异步方法上指定该线程池：

@Async("orderAsyncExecutor")
public CompletableFuture<OrderResponse> createOrder(OrderRequest request) {
    // 订单创建逻辑
    Order order = orderRepository.save(buildOrderFromRequest(request));
    return CompletableFuture.completedFuture(new OrderResponse("SUCCESS", order.getId()));
}

2. 校验接口权限注解配置 #

• 确保Spring Security配置类开启方法级权限校验：

@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    // 其他配置
}

• 控制器层的权限注解要直接作用在异步方法入口，避免权限校验被异步逻辑绕过：

@PostMapping("/orders")
@PreAuthorize("hasRole('USER')")
public CompletableFuture<ResponseEntity<OrderResponse>> createOrder(@RequestBody OrderRequest request) {
    return orderService.createOrder(request)
            .thenApply(ResponseEntity::ok)
            .exceptionally(ex -> ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).build());
}

3. 排查CSRF防护影响 #

如果项目启用了CSRF保护，异步请求可能因未携带Token返回403：

• 对订单创建接口关闭CSRF校验（REST接口场景常用）：

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.csrf(csrf -> csrf.ignoringAntMatchers("/orders"));
    // 其他安全配置
}

4. 调试异步线程的上下文状态 #

在异步方法中打印认证信息，确认SecurityContext是否正常传递：

@Async("orderAsyncExecutor")
public CompletableFuture<OrderResponse> createOrder(OrderRequest request) {
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    System.out.println("异步线程认证信息：" + auth); // 若为null则说明上下文未传递
    // 订单创建逻辑
}

内容的提问来源于stack exchange，提问作者devan5hu