SpringBoot 3 OAuth2资源服务器缺失JwtDecoder Bean问题求助

问题根源 #

当你配置spring.security.oauth2.resourceserver.jwt.issuer-uri时，Spring Boot会通过自动配置条件化创建JwtDecoder bean，但这个bean的创建时机可能晚于你的MyService初始化，导致Service注入时找不到该bean；或者自动配置的条件被意外破坏。

解决方案 #

方案一：显式定义JwtDecoder bean #

手动创建JwtDecoder bean，不依赖自动配置的条件性创建，确保Service能稳定找到该bean：

import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.jwt.JwtDecoders;

@Configuration
public class OAuth2Config {

    @Bean
    public JwtDecoder jwtDecoder(OAuth2ResourceServerProperties properties) {
        // 直接复用配置文件中的issuer-uri配置
        return JwtDecoders.fromIssuerLocation(properties.getJwt().getIssuerUri());
    }
}

如果需要更灵活的配置（比如自定义JWKS地址），可以用NimbusJwtDecoder：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;

@Configuration
public class OAuth2Config {

    @Bean
    public JwtDecoder jwtDecoder() {
        return NimbusJwtDecoder.withJwkSetUri("https://你的授权服务器地址/.well-known/jwks.json").build();
    }
}

方案二：延迟初始化Service或JwtDecoder注入 #

通过@Lazy注解延迟MyService的初始化，或者仅延迟JwtDecoder的注入，让Spring先完成自动配置的JwtDecoder bean创建：

方式1：给Service添加@Lazy

@Slf4j
@Service
@Lazy
public class MyService {

    private final JwtDecoder jwtDecoder;
    private final WebClient webClient;

    public MyService(JwtDecoder jwtDecoder, WebClient webClient) {
        this.jwtDecoder = jwtDecoder;
        this.webClient = webClient;
    }

    // 业务方法
}

方式2：仅给JwtDecoder注入添加@Lazy

@Slf4j
@Service
public class MyService {

    private final JwtDecoder jwtDecoder;
    private final WebClient webClient;

    public MyService(@Lazy JwtDecoder jwtDecoder, WebClient webClient) {
        this.jwtDecoder = jwtDecoder;
        this.webClient = webClient;
    }

    // 业务方法
}

方案三：检查自定义Security配置 #

如果你有自定义的SecurityFilterChain配置类，确保正确配置了OAuth2资源服务器的JWT支持，避免干扰自动配置的JwtDecoder创建：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
                .oauth2ResourceServer(oauth2 -> oauth2.jwt()); // 启用JWT资源服务器配置
        return http.build();
    }
}

内容的提问来源于stack exchange，提问作者slt