Spring Boot OAuth2授权码模式：免表单登录及自定义校验问询

一、能否避免授权码模式下的表单登录，通过REST调用授权端点？ #

授权码模式的核心设计是用户交互式认证与授权，这是OAuth2规范的强制要求——必须确保是用户本人发起授权操作，因此默认情况下/oauth2/authorize端点会跳转至表单登录页面，无法直接通过无交互的REST请求跳过这一步骤。

如果强行实现非交互式的REST调用，会打破OAuth2的安全模型（无法验证用户身份真实性），不推荐。如果你的场景不需要用户交互，建议选择更合适的授权类型：

• 客户端凭证模式：适用于服务间调用，无需用户参与；
• 密码模式：虽支持非交互式，但会暴露用户密码，仅适合完全信任的内部系统。

若因特殊需求必须在授权码模式下实现非交互式登录，需自定义Spring Security的认证过滤器，接收JSON格式的登录参数并绕过表单页面，但这种方式存在安全风险，需谨慎评估。

二、能否给登录表单添加额外字段并自定义校验逻辑？ #

完全可行，以下是具体实现步骤：

1. 自定义登录表单与请求参数 #

在登录页面添加employeeName、age字段，或者通过JSON请求传递这些参数。

2. 自定义AuthenticationProvider实现校验逻辑 #

重写认证逻辑，在验证用户名密码后，额外检查员工信息：

@Component
public class CustomEmployeeAuthenticationProvider implements AuthenticationProvider {

    private final UserDetailsService userDetailsService;
    private final PasswordEncoder passwordEncoder;
    private final EmployeeRepository employeeRepo;

    // 构造注入依赖
    public CustomEmployeeAuthenticationProvider(UserDetailsService userDetailsService,
                                               PasswordEncoder passwordEncoder,
                                               EmployeeRepository employeeRepo) {
        this.userDetailsService = userDetailsService;
        this.passwordEncoder = passwordEncoder;
        this.employeeRepo = employeeRepo;
    }

    @Override
    public Authentication authenticate(Authentication auth) throws AuthenticationException {
        String username = auth.getName();
        String password = auth.getCredentials().toString();
        
        // 先验证用户名密码
        UserDetails user = userDetailsService.loadUserByUsername(username);
        if (!passwordEncoder.matches(password, user.getPassword())) {
            throw new BadCredentialsException("密码错误");
        }

        // 从请求参数中获取额外字段
        HttpServletRequest request = ((WebAuthenticationDetails) auth.getDetails()).getRequest();
        String employeeName = request.getParameter("employeeName");
        Integer age = Integer.parseInt(request.getParameter("age"));

        // 检查员工信息
        Employee employee = employeeRepo.findByUsername(username);
        if (employee == null) {
            throw new BadCredentialsException("员工不存在");
        }
        if (!employee.getName().equals(employeeName) || employee.getAge() <= 25) {
            throw new BadCredentialsException("员工信息不合法或年龄不符合要求");
        }

        return new UsernamePasswordAuthenticationToken(user, password, user.getAuthorities());
    }

    @Override
    public boolean supports(Class<?> authType) {
        return UsernamePasswordAuthenticationToken.class.isAssignableFrom(authType);
    }
}

3. 配置Spring Security使用自定义Provider #

替换默认的认证Provider，并调整登录相关配置：

@Configuration
public class SecurityConfig {

    private final CustomEmployeeAuthenticationProvider customAuthProvider;

    public SecurityConfig(CustomEmployeeAuthenticationProvider customAuthProvider) {
        this.customAuthProvider = customAuthProvider;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            .formLogin(form -> form
                .loginPage("/custom-login") // 自定义登录页路径
                .loginProcessingUrl("/login") // 登录提交接口
                .usernameParameter("username")
                .passwordParameter("password")
                .failureHandler((req, res, ex) -> {
                    // 自定义登录失败返回JSON
                    res.setContentType(MediaType.APPLICATION_JSON_VALUE);
                    res.setStatus(HttpStatus.UNAUTHORIZED.value());
                    new ObjectMapper().writeValue(res.getWriter(), 
                        Map.of("code", 401, "message", ex.getMessage()));
                })
            )
            .authenticationProvider(customAuthProvider)
            .csrf(csrf -> csrf.ignoringRequestMatchers("/login", "/oauth2/**"))
            .apply(authorizationServerConfigurer);

        return http.build();
    }
}

三、关于你之前的MediaType配置无效的原因 #

你之前配置的defaultAuthenticationEntryPointFor是针对资源服务器的异常处理：当请求为JSON格式且未认证时，跳转至登录页。但授权服务器的登录流程由UsernamePasswordAuthenticationFilter处理，该配置不会影响表单登录的跳转逻辑。

若要让登录支持JSON请求，需自定义UsernamePasswordAuthenticationFilter，替换默认过滤器以解析JSON参数：

public class JsonLoginFilter extends UsernamePasswordAuthenticationFilter {

    private final ObjectMapper objectMapper = new ObjectMapper();

    @Override
    public Authentication attemptAuthentication(HttpServletRequest req, HttpServletResponse res) 
            throws AuthenticationException {
        if (MediaType.APPLICATION_JSON_VALUE.equals(req.getContentType())) {
            try {
                LoginDto loginDto = objectMapper.readValue(req.getInputStream(), LoginDto.class);
                UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
                    loginDto.getUsername(), loginDto.getPassword(), Collections.emptyList()
                );
                authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(req));
                return getAuthenticationManager().authenticate(authToken);
            } catch (IOException e) {
                throw new AuthenticationServiceException("解析登录请求失败", e);
            }
        }
        return super.attemptAuthentication(req, res);
    }
}

// 登录请求DTO
public class LoginDto {
    private String username;
    private String password;
    private String employeeName;
    private Integer age;
    // getter和setter
}

然后在SecurityFilterChain中替换默认过滤器：

@Bean
public JsonLoginFilter jsonLoginFilter(AuthenticationManager authManager) {
    JsonLoginFilter filter = new JsonLoginFilter();
    filter.setAuthenticationManager(authManager);
    filter.setSuccessHandler(new SavedRequestAwareAuthenticationSuccessHandler());
    filter.setFailureHandler((req, res, ex) -> {
        res.setContentType(MediaType.APPLICATION_JSON_VALUE);
        res.setStatus(HttpStatus.UNAUTHORIZED.value());
        new ObjectMapper().writeValue(res.getWriter(), 
            Map.of("code", 401, "message", ex.getMessage()));
    });
    return filter;
}

// 在securityFilterChain中添加：
.addFilterAt(jsonLoginFilter(authenticationManagerBean()), UsernamePasswordAuthenticationFilter.class)

内容的提问来源于stack exchange，提问作者stuckWithIt