Java中配置HTTPS协议的Google OAuth2客户端（适配Spreadsheets API）

核心结论 #

1. AuthorizationCodeInstalledApp不适合生产Web应用：它是为桌面/本地运行的应用设计的，依赖LocalServerReceiver监听本地端口接收回调，完全不符合生产Web应用的部署场景，且依赖的google-oauth-client-java6是旧版Java 6适配依赖。
2. 生产环境必须切换到Web应用类型的OAuth2流程，而非Installed App流程，才能支持HTTPS回调。

一、推荐方案：切换到Web应用OAuth2流程 #

1. 先在Google Cloud Console配置正确的HTTPS重定向URI #

在你的OAuth2客户端设置中，添加生产环境的HTTPS回调地址，例如https://app.domain.com/callback，确保地址完全匹配（包括协议、域名、路径）。

2. 替换Credential获取逻辑 #

放弃LocalServerReceiver和AuthorizationCodeInstalledApp，手动处理授权码的获取与兑换：

2.1 生成授权跳转URL

@GetMapping("/auth/google")
public String redirectToGoogleAuth() throws IOException, GeneralSecurityException {
    HttpTransport httpTransport = GoogleNetHttpTransport.newTrustedTransport();
    InputStream credentialsStream = Talespire.class.getResourceAsStream(GOOGLE_SHEETS_CLIENT_SECRET_JSON);
    GoogleClientSecrets clientSecrets = GoogleClientSecrets.load(JSON_FACTORY, new InputStreamReader(credentialsStream));

    GoogleAuthorizationCodeFlow flow = new GoogleAuthorizationCodeFlow.Builder(
            httpTransport, JSON_FACTORY, clientSecrets, SCOPES)
            .setDataStoreFactory(new FileDataStoreFactory(new File("tokens"))) // 生产建议替换为数据库存储
            .setAccessType("offline")
            .setApprovalPrompt("force")
            .build();

    // 生产环境HTTPS回调地址
    String redirectUri = "https://app.domain.com/callback";
    String authorizationUrl = flow.newAuthorizationUrl()
            .setRedirectUri(redirectUri)
            .build();

    return "redirect:" + authorizationUrl;
}

2.2 处理回调并兑换Credential

@GetMapping("/callback")
public String handleGoogleCallback(@RequestParam("code") String code) throws IOException, GeneralSecurityException {
    HttpTransport httpTransport = GoogleNetHttpTransport.newTrustedTransport();
    InputStream credentialsStream = Talespire.class.getResourceAsStream(GOOGLE_SHEETS_CLIENT_SECRET_JSON);
    GoogleClientSecrets clientSecrets = GoogleClientSecrets.load(JSON_FACTORY, new InputStreamReader(credentialsStream));

    GoogleAuthorizationCodeFlow flow = new GoogleAuthorizationCodeFlow.Builder(
            httpTransport, JSON_FACTORY, clientSecrets, SCOPES)
            .setDataStoreFactory(new FileDataStoreFactory(new File("tokens")))
            .setAccessType("offline")
            .setApprovalPrompt("force")
            .build();

    String redirectUri = "https://app.domain.com/callback";
    TokenResponse tokenResponse = flow.newTokenRequest(code)
            .setRedirectUri(redirectUri)
            .execute();

    // 生成并存储Credential
    Credential credential = flow.createAndStoreCredential(tokenResponse, "user");

    // 后续业务逻辑，比如跳转首页
    return "redirect:/home";
}

二、临时方案：自定义HTTPS版LocalServerReceiver（不推荐生产用） #

如果仅用于临时测试，可通过继承LocalServerReceiver重写方法强制使用HTTPS，但绝对不适合生产环境：

public class HttpsLocalServerReceiver extends LocalServerReceiver {
    private final String httpsHost;

    public HttpsLocalServerReceiver(String httpsHost, int port) {
        super(port);
        this.httpsHost = httpsHost;
    }

    @Override
    protected String getRedirectUri() {
        return "https://" + httpsHost + ":" + getPort() + getCallbackPath();
    }

    @Override
    protected void configureServer(Server server) {
        // 配置Jetty SSL连接器，需提供SSL证书
        SslContextFactory.Server sslFactory = new SslContextFactory.Server();
        sslFactory.setKeyStorePath("/path/to/your/keystore.jks");
        sslFactory.setKeyStorePassword("your-keystore-password");

        ServerConnector sslConnector = new ServerConnector(server,
                new SslConnectionFactory(sslFactory, HttpVersion.HTTP_1_1.asString()),
                new HttpConnectionFactory(new HttpConfiguration()));
        sslConnector.setPort(getPort());
        server.setConnectors(new Connector[]{sslConnector});
    }
}

关于AuthorizationCodeInstalledApp的疑问解答 #

• 确实不适合生产Web应用：它的设计目标是桌面/本地应用（如桌面Java程序），这类应用没有公网HTTPS地址，因此通过监听本地端口接收回调。
• 替代方案：
  1. 手动基于GoogleAuthorizationCodeFlow处理授权码流程（如推荐方案）；
  2. 集成Spring Security OAuth2 Client，简化OAuth2流程（更适合Spring环境）。

生产环境额外注意事项 #

• 不要用FileDataStoreFactory存储token，建议改用数据库或分布式缓存，避免文件系统的单点问题；
• 确保Google Cloud Console中客户端类型选择Web应用，而非“桌面应用”或“其他”；
• 回调URI必须与控制台配置完全一致，包括HTTPS协议、域名、路径，生产环境默认443端口可省略。

内容的提问来源于stack exchange，提问作者kvitso