Spring Boot集成Apple登录：无Scope下POST请求授权失败求助

使用Spring Boot开发基于「Sign in with Apple」令牌认证的服务器，因Apple返回的access token仅标识验证成功、无额外信息，故采用ID Token而非access token。当前GET请求可通过ID Token正常授权，但POST请求返回403状态码，提示insufficient_scope。应用无角色或scope概念，仅需验证请求者身份，希望POST请求能像GET一样无需scope即可授权。

服务器错误响应 #

Status = 403
Headers = [WWW-Authenticate:"Bearer error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token."...

现有Security Filter Chain配置 #

@Configuration
@EnableWebSecurity
class SecurityConfig(
    private val tokenService: TokenService,
) {
    @Bean
    fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
        http.csrf { it.disable() }
        http.authorizeHttpRequests {
            it.requestMatchers(
                "/api/auth/token",
                "/api/compatible-version",
                "/api/webhook/*",
            ).permitAll()

            it.requestMatchers(
                "/api/user/register",
                "/api/project/*",
            ).authenticated()
        }
        http.oauth2ResourceServer { oauth2 ->
            oauth2.jwt { }
        }
        http.authenticationManager { auth ->
            val bearerToken = auth as BearerTokenAuthenticationToken
            val user = tokenService.parseToken(bearerToken.token) ?: throw InvalidBearerTokenException("Invalid token")
            UsernamePasswordAuthenticationToken(user, "", listOf(SimpleGrantedAuthority("USER")))
        }
        return http.build()
    }
}

application.yml配置 #

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          jwk-set-uri: https://appleid.apple.com/auth/keys

已尝试操作 #

• 显式拆分GET/POST请求配置：

it.requestMatchers(HttpMethod.GET, "/api/user/register", "/api/project/*").authenticated()
it.requestMatchers(HttpMethod.POST, "/api/project/*").authenticated()

问题根源是同时配置了OAuth2资源服务器的JWT自动校验和自定义AuthenticationManager，导致Spring Security对POST请求触发了默认的JWT scope校验，但Apple的ID Token不包含scope声明，因此返回insufficient_scope错误。

方案一：移除OAuth2 JWT自动配置，完全使用自定义认证逻辑 #

既然已经通过tokenService自定义解析ID Token，可直接移除oauth2ResourceServer下的JWT配置，让自定义AuthenticationManager全权处理令牌验证：

修改后的SecurityConfig：

@Configuration
@EnableWebSecurity
class SecurityConfig(
    private val tokenService: TokenService,
) {
    @Bean
    fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
        http.csrf { it.disable() }
        http.authorizeHttpRequests {
            it.requestMatchers(
                "/api/auth/token",
                "/api/compatible-version",
                "/api/webhook/*",
            ).permitAll()

            it.requestMatchers(
                "/api/user/register",
                "/api/project/*",
            ).authenticated()
        }
        // 移除OAuth2资源服务器的JWT自动配置
        http.authenticationManager { auth ->
            val bearerToken = auth as BearerTokenAuthenticationToken
            val user = tokenService.parseToken(bearerToken.token) ?: throw InvalidBearerTokenException("Invalid token")
            // 因无需角色/scope，可返回空权限列表，或保留原USER权限不影响
            UsernamePasswordAuthenticationToken(user, "", emptyList())
        }
        return http.build()
    }
}

方案二：自定义JWT认证转换器，替代默认scope校验 #

若需保留OAuth2资源服务器配置，可通过JwtAuthenticationConverter自定义认证逻辑，跳过scope校验：

修改后的SecurityConfig：

@Configuration
@EnableWebSecurity
class SecurityConfig(
    private val tokenService: TokenService,
) {
    @Bean
    fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
        http.csrf { it.disable() }
        http.authorizeHttpRequests {
            it.requestMatchers(
                "/api/auth/token",
                "/api/compatible-version",
                "/api/webhook/*",
            ).permitAll()

            it.requestMatchers(
                "/api/user/register",
                "/api/project/*",
            ).authenticated()
        }
        http.oauth2ResourceServer { oauth2 ->
            oauth2.jwt { jwt ->
                jwt.jwtAuthenticationConverter { jwtToken ->
                    val user = tokenService.parseToken(jwtToken.tokenValue) ?: throw InvalidBearerTokenException("Invalid token")
                    // 返回无权限的认证对象，绕过scope校验
                    UsernamePasswordAuthenticationToken(user, "", emptyList())
                }
            }
        }
        // 移除自定义AuthenticationManager，由OAuth2资源服务器接管认证
        return http.build()
    }
}

两种方案均可实现仅验证ID Token有效性、无需scope即可授权POST请求的需求，推荐方案一（逻辑更简洁，避免双重认证逻辑冲突）。

内容的提问来源于stack exchange，提问作者Shion