如何在JHipster中配置Spring OAuth2以实现针对GitLab的无状态认证？

你遇到的问题核心在于Spring OAuth2默认的HttpSessionOAuth2AuthorizationRequestRepository依赖HttpSession存储授权请求状态，这和JHipster的无状态JWT认证理念完全冲突，同时也会在会话过期、负载均衡场景下引发异常。要实现无状态的GitLab OAuth2对接，我们可以通过自定义授权请求仓库+配置无状态会话来解决。

解决方案步骤 #

1. 自定义基于Cookie的授权请求仓库 #

我们可以用加密Cookie替代HttpSession来存储OAuth2授权请求状态，这样完全摆脱对会话的依赖。创建如下实现类：

import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRepository;
import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
import org.springframework.stereotype.Component;
import org.springframework.util.SerializationUtils;

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.Base64;
import java.util.Optional;

@Component
public class CookieOAuth2AuthorizationRequestRepository implements OAuth2AuthorizationRequestRepository<OAuth2AuthorizationRequest> {

    private static final String AUTH_REQUEST_COOKIE = "oauth2_auth_request";
    private static final String REDIRECT_URI_COOKIE = "oauth2_redirect_uri";
    private static final int COOKIE_EXPIRE_SECONDS = 180;

    @Override
    public OAuth2AuthorizationRequest loadAuthorizationRequest(HttpServletRequest request) {
        return getCookie(request, AUTH_REQUEST_COOKIE)
                .map(this::deserialize)
                .orElse(null);
    }

    @Override
    public void saveAuthorizationRequest(OAuth2AuthorizationRequest authRequest, HttpServletRequest request, HttpServletResponse response) {
        if (authRequest == null) {
            removeAuthRequestCookies(request, response);
            return;
        }
        addCookie(response, AUTH_REQUEST_COOKIE, serialize(authRequest));
        
        String redirectUri = request.getParameter(REDIRECT_URI_COOKIE);
        if (redirectUri != null) {
            addCookie(response, REDIRECT_URI_COOKIE, redirectUri);
        }
    }

    @Override
    public OAuth2AuthorizationRequest removeAuthorizationRequest(HttpServletRequest request, HttpServletResponse response) {
        OAuth2AuthorizationRequest authRequest = loadAuthorizationRequest(request);
        removeAuthRequestCookies(request, response);
        return authRequest;
    }

    private void removeAuthRequestCookies(HttpServletRequest request, HttpServletResponse response) {
        deleteCookie(request, response, AUTH_REQUEST_COOKIE);
        deleteCookie(request, response, REDIRECT_URI_COOKIE);
    }

    private void addCookie(HttpServletResponse response, String name, String value) {
        Cookie cookie = new Cookie(name, value);
        cookie.setPath("/");
        cookie.setHttpOnly(true);
        cookie.setSecure(true); // 生产环境HTTPS下启用
        cookie.setMaxAge(COOKIE_EXPIRE_SECONDS);
        response.addCookie(cookie);
    }

    private void deleteCookie(HttpServletRequest request, HttpServletResponse response, String name) {
        if (request.getCookies() == null) return;
        for (Cookie cookie : request.getCookies()) {
            if (name.equals(cookie.getName())) {
                cookie.setValue("");
                cookie.setPath("/");
                cookie.setMaxAge(0);
                response.addCookie(cookie);
            }
        }
    }

    private String serialize(OAuth2AuthorizationRequest request) {
        return Base64.getUrlEncoder().encodeToString(SerializationUtils.serialize(request));
    }

    private OAuth2AuthorizationRequest deserialize(String value) {
        return SerializationUtils.deserialize(Base64.getUrlDecoder().decode(value));
    }

    private Optional<Cookie> getCookie(HttpServletRequest request, String name) {
        if (request.getCookies() == null) return Optional.empty();
        for (Cookie cookie : request.getCookies()) {
            if (name.equals(cookie.getName())) {
                return Optional.of(cookie);
            }
        }
        return Optional.empty();
    }
}

2. 配置Spring Security启用无状态模式 #

修改你的Security配置类，替换默认的授权请求仓库，并明确设置会话为无状态：

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private final CookieOAuth2AuthorizationRequestRepository cookieAuthRequestRepo;

    public SecurityConfig(CookieOAuth2AuthorizationRequestRepository cookieAuthRequestRepo) {
        this.cookieAuthRequestRepo = cookieAuthRequestRepo;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf().disable() // 保持JHipster原有CSRF配置逻辑
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS) // 彻底禁用HttpSession
                .and()
            .oauth2Login()
                .authorizationEndpoint()
                    .authorizationRequestRepository(cookieAuthRequestRepo) // 使用自定义Cookie仓库
                    .and()
                .redirectionEndpoint()
                    .baseUri("/login/oauth2/code/*")
                    .and()
                .userInfoEndpoint()
                    .userService(yourCustomOAuth2UserService); // 保留你原有的用户服务实现
        // 继续添加JHipster原有的JWT过滤器等配置
    }
}

3. 调整application.yml配置 #

确保GitLab的OAuth2配置正确，并强化无状态相关设置：

spring:
  security:
    oauth2:
      client:
        provider:
          oidc:
            issuer-uri: https://gitlab.mysite.com
        registration:
          oidc:
            client-id: 1234123412322312312312312312321312321312
            client-secret: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
            scope: openid,profile,email # 根据GitLab需求调整scope
server:
  servlet:
    session:
      cookie:
        http-only: true
        secure: true # HTTPS环境下启用
      tracking-modes: COOKIE

方案说明 #

• 无状态实现：通过Cookie存储授权请求状态，完全脱离HttpSession，符合JHipster的JWT无状态设计理念。
• 异常解决：禁用HttpSession后，不会再出现Session is invalid的异常，同时适配负载均衡场景（无需会话同步）。
• 安全性：使用HttpOnly、Secure属性的Cookie，配合Base64序列化（生产环境建议额外添加加密逻辑），避免状态泄露或篡改。

内容的提问来源于stack exchange，提问作者Wallenstein