Spring Boot OAuth2客户端提取access_token及回调跳转异常排查

我搭建了对接GitHub OAuth2的Spring Boot应用，授权功能正常，但无法提取access_token，也搞不清Spring Boot里的跳转逻辑。原本以为浏览器会重定向到/login/oauth2/code/github端点，但实际没触发这个回调。

现有配置与代码 #

application.yml #

spring:
  security:
    oauth2:
      client:
        registration:
          github:
            client-id: ea54290955115164855a
            client-secret: d4987ca45405bb75adc78175f9aa5c11ab9e2b2a
            scope: user:email
            authorization-grant-type: authorization_code
            redirect-uri: '{baseUrl}/login/oauth2/code/github'
        provider:
          github:
            authorization-uri: https://github.com/login/oauth/authorize
            token-uri: https://github.com/login/oauth/access_token

SecurityConfig.java #

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
        return httpSecurity
                .authorizeHttpRequests(auth -> {
                    auth.requestMatchers("/").permitAll();
                    auth.requestMatchers("/favicon.ico").permitAll();
                    auth.anyRequest().authenticated();
                })
                .oauth2Login(withDefaults())
                .formLogin(withDefaults())
                .build();

    }
}

AuthController.java #

@RestController
public class AuthController {

    @GetMapping("/login/github")
    public String redirectToGitHub() {
        // This will automatically redirect the user to the GitHub authorization URL
        return "redirect:https://github.com/login/oauth/authorize";
    }

    @GetMapping("/login/oauth2/code/github")
    public String handleGitHubCallback(@AuthenticationPrincipal OAuth2User principal) {
        // Handle the callback and extract the access token
        String accessToken = principal.getAttribute("access_token");

        // Use the access token for GitHub API requests or store it as needed
        // Redirect or display user information as required

        return "redirect:/profile"; // Redirect to a profile page, for example
    }
}

GitHub客户端注册配置 #

问题原因解析 #

1. 回调端点被框架接管：/login/oauth2/code/github是Spring Security OAuth2默认的回调处理端点，框架会自动完成code换token的流程，自定义的Controller方法会被覆盖，因此不会触发。
2. 手动跳转逻辑冗余：/login/github的手动重写完全没必要，oauth2Login()已经内置了跳转授权页面的逻辑，用户访问需要认证的接口时，会自动跳转到GitHub授权页。
3. access_token获取方式错误：OAuth2User对象中不会直接包含access_token，需要从OAuth2授权上下文里提取。

解决方案 #

1. 清理冗余代码 #

删除AuthController中的redirectToGitHub()和自定义的/login/oauth2/code/github方法，让Spring Security处理默认流程。

2. 正确获取access_token #

有两种常用方式可以获取access_token：

方式一：通过OAuth2AuthorizedClientService获取

@RestController
public class ProfileController {

    private final OAuth2AuthorizedClientService authorizedClientService;

    public ProfileController(OAuth2AuthorizedClientService authorizedClientService) {
        this.authorizedClientService = authorizedClientService;
    }

    @GetMapping("/profile")
    public String getProfile(Authentication authentication) {
        OAuth2AuthorizedClient client = authorizedClientService.loadAuthorizedClient(
                "github", authentication.getName());
        String accessToken = client.getAccessToken().getTokenValue();
        
        // 此处可调用GitHub API或存储token
        return "Access Token: " + accessToken;
    }
}

方式二：自定义登录成功处理器

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity, OAuth2AuthorizedClientService authorizedClientService) throws Exception {
        return httpSecurity
                .authorizeHttpRequests(auth -> {
                    auth.requestMatchers("/").permitAll();
                    auth.requestMatchers("/favicon.ico").permitAll();
                    auth.anyRequest().authenticated();
                })
                .oauth2Login(oauth2 -> oauth2
                        .successHandler((request, response, authentication) -> {
                            OAuth2AuthenticationToken oauthToken = (OAuth2AuthenticationToken) authentication;
                            OAuth2AuthorizedClient client = authorizedClientService.loadAuthorizedClient(
                                    oauthToken.getAuthorizedClientRegistrationId(),
                                    authentication.getName());
                            String accessToken = client.getAccessToken().getTokenValue();
                            
                            // 可在此处存储token或执行后续逻辑
                            response.sendRedirect("/profile");
                        })
                )
                .formLogin(withDefaults())
                .build();
    }

    @Bean
    OAuth2AuthorizedClientService authorizedClientService(ClientRegistrationRepository clientRegistrationRepository) {
        return new InMemoryOAuth2AuthorizedClientService(clientRegistrationRepository);
    }
}

3. 校验GitHub配置 #

确保GitHub客户端的Authorization callback URL与application.yml中的redirect-uri完全一致，例如http://localhost:8080/login/oauth2/code/github（根据实际端口调整）。

Spring Boot OAuth2跳转逻辑说明 #

1. 用户访问需要认证的接口（如/profile），Spring Security检测到未认证，自动跳转到GitHub授权页面。
2. 用户完成授权后，GitHub重定向到默认回调端点，Spring Security自动用授权码交换access_token。
3. 认证成功后，框架将用户信息存入上下文，跳转至用户最初访问的页面（或配置的默认成功页）。

内容的提问来源于stack exchange，提问作者driftwood