You need to enable JavaScript to run this app.
优惠活动
大模型
产品
解决方案
定价
更多

Spring Authorization Server测试用例中无client-id能否实现用户登录?

Spring Authorization Server登录时无Client-ID的场景疑问

我对Spring Authorization Server的defaultAuthorizationServer示例项目中的测试用例感到好奇:该测试用例未关联client-id,但用户仍可完成登录:

@Test
public void whenLoggingInAndRequestingTokenThenRedirectsToClientApplication() throws IOException {
    // Log in
    this.webClient.getOptions().setThrowExceptionOnFailingStatusCode(false);
    this.webClient.getOptions().setRedirectEnabled(false);
    signIn(this.webClient.getPage("/login"), "user1", "password");

    // Request token
    WebResponse response = this.webClient.getPage(AUTHORIZATION_REQUEST).getWebResponse();

    assertThat(response.getStatusCode()).isEqualTo(HttpStatus.MOVED_PERMANENTLY.value());
    String location = response.getResponseHeaderValue("location");
    assertThat(location).startsWith(REDIRECT_URI);
    assertThat(location).contains("code=");
}

我在自己的项目中运行了该测试用例,并且实现了AuthenticationProvider,通过RequestCache检测到clientId始终为null。我想知道是否存在用户无需client-id即可登录授权服务器的场景?我认为用户登录登录页面时应始终关联客户端应用或client-id。

以下是我的AuthenticationProvider实现:

@Service
public class AuthenticationCallout implements AuthenticationProvider {
    private static final Logger LOG = LoggerFactory.getLogger(AuthenticationCallout.class);

    private RequestCache requestCache;
    private WebClient.Builder webClientBuilder;


    public AuthenticationCallout(WebClient.Builder webClientBuilder, RequestCache requestCache) {
        this.webClientBuilder = webClientBuilder;
        this.requestCache = requestCache;
    }


    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        LOG.info("authenticate with username and password");

        final String clientId = ClientIdUtil.getClientId(requestCache);
        LOG.info("clientId: {}", clientId);  //client-id is always null because the login does not have a client association
        // ... 省略后续代码
    }
}

对应的ClientIdUtil实现:

public class ClientIdUtil {
    private static final Logger LOG = LoggerFactory.getLogger(ClientIdUtil.class);

    public static String getClientId(RequestCache requestCache) {
        var requestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
        var request = requestAttributes.getRequest();
        var response = requestAttributes.getResponse();
        var savedRequest = requestCache.getRequest(request, response);
        return ClientIdUtil.getParameter(savedRequest, OAuth2ParameterNames.CLIENT_ID);
    }
}

内容的提问来源于stack exchange,提问作者Katlock

相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级,最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分), 限时 9.9 元起

最近更新时间:2026.07.08 07:28:33