Spring Security OAuth2 Client中如何为Google登录启用PKCE？

Google的OAuth2授权服务器支持PKCE与客户端密钥（Client Secret）结合使用，针对你的场景，不需要将clientAuthenticationMethod设为none，而是通过显式配置强制启用PKCE即可，具体步骤如下：

1. application.yml配置 #

保留Client Secret的同时，指定标准的客户端认证方式（Google支持client_secret_basic或client_secret_post），配置示例：

spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: 你的Google客户端ID
            client-secret: 你的Google客户端密钥
            scope: openid,email,profile
            client-authentication-method: client_secret_basic
            authorization-grant-type: authorization_code
        provider:
          google:
            authorization-uri: https://accounts.google.com/o/oauth2/v2/auth
            token-uri: https://oauth2.googleapis.com/token
            user-info-uri: https://www.googleapis.com/oauth2/v3/userinfo
            user-name-attribute: sub

2. 自定义SecurityConfig强制启用PKCE #

Spring Security默认不会为机密客户端（Confidential Client，即带有Client Secret的客户端）自动启用PKCE，因此需要通过自定义OAuth2AuthorizationRequestResolver来为Google客户端强制开启PKCE：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizationRequestResolver;
import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestResolver;
import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
import org.springframework.security.web.SecurityFilterChain;

import java.util.function.Consumer;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
                .oauth2Login(oauth2 -> oauth2
                        .authorizationEndpoint(authEndpoint -> authEndpoint
                                .authorizationRequestResolver(authorizationRequestResolver(clientRegistrationRepository()))
                        )
                );
        return http.build();
    }

    private OAuth2AuthorizationRequestResolver authorizationRequestResolver(ClientRegistrationRepository clientRegistrationRepository) {
        DefaultOAuth2AuthorizationRequestResolver resolver = new DefaultOAuth2AuthorizationRequestResolver(
                clientRegistrationRepository, "/oauth2/authorization");
        resolver.setAuthorizationRequestCustomizer(googlePkceCustomizer());
        return resolver;
    }

    private Consumer<OAuth2AuthorizationRequest.Builder> googlePkceCustomizer() {
        return request -> {
            if ("google".equals(request.getClientRegistration().getRegistrationId())) {
                // 强制为Google客户端启用PKCE
                request.attributes(attrs -> attrs.put(OAuth2AuthorizationRequest.Builder.PKCE_ENABLED_ATTR_NAME, true));
            }
        };
    }
}

关键说明 #

• Google的授权服务器允许机密客户端同时使用PKCE和Client Secret，这符合OAuth2规范（PKCE并非仅针对公共客户端，机密客户端也可通过PKCE提升安全性）。
• 配置后，授权请求会自动携带code_challenge和code_challenge_method参数，令牌交换请求会携带code_verifier参数，同时Client Secret会通过client_secret_basic（即Basic Auth）方式发送，满足Google的端点要求。

内容的提问来源于stack exchange，提问作者Holm