Spring集成Google登录后CRUD请求异常排查求助

问题现象 #

• 浏览器发起GET请求localhost:8060端点可正常获取JSON数据，但Postman中发起相同GET请求返回无说明的400错误。
• 发起POST/PUT/DELETE请求时，系统提示An expected CSRF token cannot be found。

已尝试操作：在Google Cloud OAuth Client ID配置中为用户账号授予完整管理员权限，当前使用Google Cloud免费版。

相关配置代码 #

Google登录配置片段 #

security:
    oauth2:
      client:
        registration:
          google:
            client-id: 
         

网关application.yaml #

server:
    port: 8060

eureka:
  client:
    serviceUrl:
      defaultZone: http://eureka-discovery:8761/eureka/
    register-with-eureka: true
    fetch-registry: true
  instance:
    preferIpAddress: true
    hostName: api-gateway

spring:
  application:
    name: api-gateway
  cloud:
    gateway:
      routes:
        - id: spring-employee-service
          uri: http://spring-employee-service:8080
          predicates:
            - Path=/employees/**
        - id: login-service
          uri: http://login-service:8080
          predicates:
            - Path=/logins/**
security:
  oauth2:
    client:
      registration:
        google:
          client-id: INSERT ID
          client-secret: INSERT SECRET

POM.XML #

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" 
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 
         https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>3.1.0</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.gatewaydiscovery</groupId>
    <artifactId>gatewaydiscovery</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>gatewaydiscovery</name>
    <description>Demo project for Spring Boot</description>
    <properties>
        <java.version>17</java.version>
        <spring-cloud.version>2022.0.3</spring-cloud.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-webflux</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-gateway</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>
    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-dependencies</artifactId>
                <version>${spring-cloud.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

</project> 

Postman环境变量 #

已完成令牌交换，配置的环境变量包括：AUTH_CALLBACK_URL、AUTH_SCOPE、AUTH_CLIENT_ID、AUTH_CLIENT_SECRET、AUTH_URL、AUTH_TOKEN_URL。

排查方向 #

针对Postman GET请求400错误 #

• 检查请求头完整性：浏览器自动携带OAuth2会话Cookie，但Postman不会。确认Postman请求是否携带Authorization: Bearer {access_token}头，且令牌未过期。
• 验证令牌权限范围：检查Google OAuth2令牌的scope是否包含openid、email等必要权限，确保令牌具备访问目标端点的权限。
• 核对Google Cloud OAuth配置：确认Postman的AUTH_CALLBACK_URL与Google Cloud控制台中OAuth客户端的授权重定向URI完全一致（含协议、域名、端口、路径），不一致的话需添加到允许列表。
• 开启调试日志：在网关配置中添加日志级别，查看Spring Security OAuth2的详细错误信息：

  logging:
    level:
      org.springframework.security: DEBUG
      org.springframework.cloud.gateway: DEBUG
  

针对POST/PUT/DELETE请求的CSRF错误 #

• 手动携带CSRF令牌：先发起GET请求到网关，从响应Cookie中提取XSRF-TOKEN值，再在POST/PUT/DELETE请求中添加X-XSRF-TOKEN请求头，值为提取到的令牌内容。
• 配置网关CSRF传递：添加网关过滤器确保CSRF令牌正确传递给下游服务：

  @Bean
  public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
      http.csrf(csrf -> csrf.csrfTokenRepository(CookieServerCsrfTokenRepository.withHttpOnlyFalse()));
      // 其他OAuth2配置
      return http.build();
  }
  

• 测试环境临时关闭CSRF：若为纯API服务且无浏览器访问需求，可在测试环境临时关闭CSRF防护（生产环境禁用此操作）：

  security:
    oauth2:
      # 原有OAuth2配置
    csrf:
      enabled: false
  

内容的提问来源于stack exchange，提问作者Hamchops