Spring Boot OAuth认证场景下获取登录用户信息的最优方案

你当前用@AuthenticationPrincipal Jwt获取用户信息的方式是可行的，但确实不够直观自然，尤其是当需要频繁获取多个用户属性时。下面是几种更优的可选方案，适配不同场景：

1. 自定义UserDetails类 + JWT转换（推荐） #

通过自定义UserDetails实现类，把JWT中的Claims映射为业务友好的用户对象，控制器中直接注入该对象，代码更清晰。

步骤示例： #

1.1 定义自定义User类

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import java.util.Collection;

public class CustomUser implements UserDetails {
    private String username;
    private String email;
    // 按需添加其他属性，比如角色、用户ID等

    // 实现UserDetails的必要方法（根据业务需求重写）
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return null; // 按需返回用户权限集合
    }

    @Override
    public String getPassword() {
        return null; // OAuth场景下无需密码，返回null即可
    }

    @Override
    public String getUsername() {
        return username;
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }

    // Getter和Setter
    public void setUsername(String username) {
        this.username = username;
    }

    public String getEmail() {
        return email;
    }

    public void setEmail(String email) {
        this.email = email;
    }
}

1.2 配置JWT到CustomUser的转换器

import org.springframework.core.convert.converter.Converter;
import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class JwtAuthConverterConfig {
    @Bean
    public Converter<Jwt, AbstractAuthenticationToken> jwtAuthenticationConverter() {
        JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
        // 按需配置权限映射规则，比如从"roles" Claim提取权限

        return jwt -> {
            CustomUser customUser = new CustomUser();
            customUser.setUsername(jwt.getClaimAsString("username"));
            customUser.setEmail(jwt.getClaimAsString("email"));
            // 映射其他Claims到CustomUser属性

            return new JwtAuthenticationToken(jwt, grantedAuthoritiesConverter.convert(jwt), customUser.getUsername());
        };
    }
}

1.3 控制器中使用

public ResponseEntity<?> getResource(@AuthenticationPrincipal CustomUser user) {
    String username = user.getUsername();
    String email = user.getEmail();
    // 直接使用自定义用户对象的属性，更自然
    return ResponseEntity.ok("Hello " + username);
}

2. 通过SecurityContextHolder直接获取（适合非控制器层） #

如果需要在Service、工具类等非控制器层获取用户信息，可以直接从SecurityContext中提取：

import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;

// 在任意类中调用
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
if (authentication instanceof JwtAuthenticationToken jwtToken) {
    String username = jwtToken.getToken().getClaimAsString("username");
    String userId = jwtToken.getToken().getClaimAsString("user_id");
    // 处理其他属性
}

3. 封装工具类统一处理 #

为了避免重复代码，可以封装一个工具类，提供静态方法统一提取用户信息：

import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;

public class UserInfoUtils {
    private UserInfoUtils() {}

    public static String getCurrentUsername() {
        return getClaimAsString("username");
    }

    public static String getCurrentUserId() {
        return getClaimAsString("user_id");
    }

    private static String getClaimAsString(String claimName) {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth instanceof JwtAuthenticationToken jwtToken) {
            return jwtToken.getToken().getClaimAsString(claimName);
        }
        return null;
    }
}

使用时直接调用：

// 控制器或Service中
String username = UserInfoUtils.getCurrentUsername();

4. 自定义@CurrentUser注解（提升语义化） #

如果觉得@AuthenticationPrincipal不够语义化，可以自定义注解结合参数解析器，让代码更易读：

4.1 定义注解 #

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

@Target(ElementType.PARAMETER)
@Retention(RetentionPolicy.RUNTIME)
public @interface CurrentUser {
}

4.2 实现参数解析器 #

import org.springframework.core.MethodParameter;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
import org.springframework.web.bind.support.WebDataBinderFactory;
import org.springframework.web.context.request.NativeWebRequest;
import org.springframework.web.method.support.HandlerMethodArgumentResolver;
import org.springframework.web.method.support.ModelAndViewContainer;

public class CurrentUserArgumentResolver implements HandlerMethodArgumentResolver {
    @Override
    public boolean supportsParameter(MethodParameter parameter) {
        return parameter.hasParameterAnnotation(CurrentUser.class)
                && parameter.getParameterType().equals(CustomUser.class);
    }

    @Override
    public Object resolveArgument(MethodParameter parameter, ModelAndViewContainer mavContainer,
                                  NativeWebRequest webRequest, WebDataBinderFactory binderFactory) {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth instanceof JwtAuthenticationToken jwtToken) {
            CustomUser user = new CustomUser();
            user.setUsername(jwtToken.getToken().getClaimAsString("username"));
            user.setEmail(jwtToken.getToken().getClaimAsString("email"));
            return user;
        }
        return null;
    }
}

4.3 注册解析器 #

import org.springframework.context.annotation.Configuration;
import org.springframework.web.method.support.HandlerMethodArgumentResolver;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
import java.util.List;

@Configuration
public class WebMvcConfig implements WebMvcConfigurer {
    @Override
    public void addArgumentResolvers(List<HandlerMethodArgumentResolver> resolvers) {
        resolvers.add(new CurrentUserArgumentResolver());
    }
}

4.4 控制器中使用 #

public ResponseEntity<?> getResource(@CurrentUser CustomUser user) {
    return ResponseEntity.ok("Hello " + user.getUsername());
}

总结 #

你当前的方案是基础可行的，但自定义UserDetails结合@AuthenticationPrincipal是最推荐的方案，兼顾了代码的可读性和业务适配性；工具类适合跨层复用用户信息提取逻辑；自定义注解则进一步提升代码语义化。

内容的提问来源于stack exchange，提问作者OpenStack