如何禁用Spring Cloud Gateway中的OAuth2登录页面？

针对你遇到的Gateway自带/login选择页面的问题，核心原因是Spring Security OAuth2 Client在未指定默认客户端时，会自动生成这个客户端选择页面。结合你使用的Spring Boot 3.3.2和Spring Cloud Gateway 4.1.5（基于WebFlux），可以通过以下配置彻底禁用该页面，让/login直接重定向到认证服务器登录页：

1. 配置WebFlux Security，指定默认OAuth2客户端 #

创建Security配置类，通过ServerOAuth2AuthorizationRequestResolver设置默认客户端ID，跳过选择页面：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.server.DefaultServerOAuth2AuthorizationRequestResolver;
import org.springframework.security.oauth2.client.web.server.ServerOAuth2AuthorizationRequestResolver;
import org.springframework.security.web.server.SecurityWebFilterChain;
import org.springframework.security.web.server.authentication.RedirectServerAuthenticationSuccessHandler;
import org.springframework.security.web.server.authentication.ServerAuthenticationSuccessHandler;
import org.springframework.security.web.server.authentication.logout.RedirectServerLogoutSuccessHandler;
import org.springframework.security.web.server.authentication.logout.ServerLogoutSuccessHandler;

@Configuration
@EnableWebFluxSecurity
public class GatewaySecurityConfig {

    private final ClientRegistrationRepository clientRegistrationRepository;

    // 构造注入Spring Boot自动配置的ClientRegistrationRepository
    public GatewaySecurityConfig(ClientRegistrationRepository clientRegistrationRepository) {
        this.clientRegistrationRepository = clientRegistrationRepository;
    }

    @Bean
    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
        http
            .authorizeExchange(exchanges -> exchanges
                .anyExchange().authenticated()
            )
            .oauth2Login(oauth2 -> oauth2
                // 设置默认客户端ID，直接触发授权流程，跳过选择页面
                .authorizationRequestResolver(defaultAuthorizationRequestResolver())
                // 登录成功后重定向到原请求地址或首页
                .authenticationSuccessHandler(loginSuccessHandler())
            )
            .logout(logout -> logout
                // 登出成功后直接跳转到认证服务器的登出端点，避免回到/login
                .logoutSuccessHandler(logoutSuccessHandler())
            );

        return http.build();
    }

    private ServerOAuth2AuthorizationRequestResolver defaultAuthorizationRequestResolver() {
        DefaultServerOAuth2AuthorizationRequestResolver resolver =
                new DefaultServerOAuth2AuthorizationRequestResolver(
                        clientRegistrationRepository,
                        "/oauth2/authorization/{registrationId}"
                );
        // 替换为你的OAuth2客户端ID，比如"gateway-client"
        resolver.setDefaultClientRegistrationId("gateway-client");
        return resolver;
    }

    private ServerAuthenticationSuccessHandler loginSuccessHandler() {
        RedirectServerAuthenticationSuccessHandler handler = new RedirectServerAuthenticationSuccessHandler();
        // 登录成功后重定向到原请求地址，{redirectUri}会自动替换为登录前的地址
        handler.setRedirectUri("{redirectUri}");
        return handler;
    }

    private ServerLogoutSuccessHandler logoutSuccessHandler() {
        RedirectServerLogoutSuccessHandler handler = new RedirectServerLogoutSuccessHandler();
        // 替换为你的认证服务器登出地址，比如http://auth-server:8080/logout
        handler.setLogoutSuccessUrl("http://your-auth-server-domain/logout");
        return handler;
    }
}

2. 确保OAuth2客户端配置正确 #

在application.yml中确认客户端注册信息，保证client-id和配置类中设置的默认ID一致：

spring:
  security:
    oauth2:
      client:
        registration:
          gateway-client: # 这里要和配置类中的默认客户端ID一致
            client-id: your-client-id
            client-secret: your-client-secret
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
            scope: openid, profile, email
        provider:
          auth-server-provider:
            authorization-uri: http://your-auth-server-domain/oauth2/authorize
            token-uri: http://your-auth-server-domain/oauth2/token
            user-info-uri: http://your-auth-server-domain/oauth2/userinfo
            user-name-attribute: sub

关键说明 #

• 之前尝试用控制器覆盖/login端点无效，是因为Spring Security的过滤器链优先级高于WebFlux控制器，必须通过Security配置处理该端点。
• 设置默认客户端ID后，访问/login会直接触发对应客户端的授权请求，自动重定向到认证服务器的登录页，跳过Gateway的默认选择页面。
• 配置登出成功处理器是为了避免登出后默认跳回/login，直接引导用户到认证服务器完成登出清理。

内容的提问来源于stack exchange，提问作者Eren Yilmaz