如何为Spring Boot 2 OAuth2客户端创建动态Scope自定义重定向控制器

1. 注入必要依赖Bean #

在自定义Controller中注入Spring Security OAuth2核心组件，用于获取客户端配置、构建授权请求和存储请求状态：

@RestController
public class CustomLoginController {
    private final OAuth2ClientRegistrationRepository clientRegistrationRepository;
    private final OAuth2AuthorizationRequestRedirectUriBuilder redirectUriBuilder;
    private final HttpSessionOAuth2AuthorizationRequestRepository authorizationRequestRepository;

    // 构造方法注入（推荐方式）
    public CustomLoginController(OAuth2ClientRegistrationRepository clientRegistrationRepository,
                                 OAuth2AuthorizationRequestRedirectUriBuilder redirectUriBuilder,
                                 HttpSessionOAuth2AuthorizationRequestRepository authorizationRequestRepository) {
        this.clientRegistrationRepository = clientRegistrationRepository;
        this.redirectUriBuilder = redirectUriBuilder;
        this.authorizationRequestRepository = authorizationRequestRepository;
    }
}

2. 实现动态Scope的登录跳转接口 #

完善/redirect-to-login接口，根据传入的scope参数构建自定义授权请求，并重定向到OAuth2提供商的登录页：

@GetMapping(path = "/redirect-to-login")
public ResponseEntity<?> proxyLogin(@RequestParam("scope") final String scope,
                                    HttpServletRequest request,
                                    HttpServletResponse response) {
    // 获取配置的客户端注册信息
    ClientRegistration clientRegistration = clientRegistrationRepository.findByRegistrationId("my-client");
    if (clientRegistration == null) {
        return ResponseEntity.badRequest().body("未找到对应的客户端配置");
    }

    // 将传入的scope字符串解析为集合格式
    Set<String> requestedScopes = Arrays.stream(scope.split("\\s+"))
                                        .collect(Collectors.toSet());

    // 构建自定义OAuth2授权请求，替换默认scope
    OAuth2AuthorizationRequest authorizationRequest = OAuth2AuthorizationRequest.authorizationCode()
            .clientId(clientRegistration.getClientId())
            .authorizationUri(clientRegistration.getProviderDetails().getAuthorizationUri())
            // 生成符合配置的回调地址（需确保配置中redirectUri为模板格式，如"{baseUrl}/login/oauth2/code/my-client"）
            .redirectUri(redirectUriBuilder.build(clientRegistration, request))
            .scopes(requestedScopes)
            // 生成随机state值，防止CSRF攻击
            .state(UUID.randomUUID().toString())
            .build();

    // 将授权请求存入Session，供后续回调流程读取使用
    authorizationRequestRepository.saveAuthorizationRequest(authorizationRequest, request, response);

    // 重定向到OAuth2提供商的授权登录页
    return ResponseEntity.status(HttpStatus.FOUND)
            .location(URI.create(authorizationRequest.getAuthorizationRequestUri()))
            .build();
}

3. 调整Spring Security配置 #

确保未认证用户可访问跳转接口，同时保证OAuth2回调流程正常工作：

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers("/redirect-to-login").permitAll()
                        .anyRequest().authenticated()
                )
                .oauth2Login(oauth2 -> oauth2
                        .authorizationRequestRepository(new HttpSessionOAuth2AuthorizationRequestRepository())
                );
        return http.build();
    }
}

关键注意事项 #

• ClientRegistration不可变性：不要尝试修改已有的ClientRegistration对象（它是不可变类），通过构建新的OAuth2AuthorizationRequest动态设置scope是标准做法。
• RedirectUri模板配置：配置文件中redirectUri需使用模板格式（如"{baseUrl}/login/oauth2/code/{registrationId}"），否则redirectUriBuilder无法生成正确的回调地址，导致授权服务器回调失败。
• State参数必填：随机生成的state参数是OAuth2流程的安全要求，用于防止CSRF攻击，不可省略。

内容的提问来源于stack exchange，提问作者3rr0r 404