React+MSAL生成Bearer令牌对接Spring Security WebFlux鉴权异常

你的配置未生效、认证管理器断点未触发的核心原因是：缺少Bearer令牌的提取与转换逻辑——Spring Security无法自动识别请求头Authorization中的Bearer Token，也就无法生成对应的Authentication对象传递给自定义认证管理器。此外还有几处细节问题需要修正：

1. 核心配置修正：添加Bearer Token支持 #

修改SecurityWebFilterChain配置，引入Spring Security的OAuth2资源服务器支持，让框架自动处理Authorization: Bearer <token>头的解析：

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

    private final ReactiveAuthenticationManager authenticationManager;

    public SecurityConfig(ReactiveAuthenticationManager authenticationManager) {
        this.authenticationManager = authenticationManager;
    }
    
    @Bean
    public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
        return http
                // 配置CORS，允许React客户端跨域携带Authorization头
                .cors(cors -> cors.configurationSource(corsConfigurationSource()))
                .authorizeExchange(exchanges -> exchanges.anyExchange().authenticated())
                // 指定使用自定义认证管理器处理Bearer Token
                .oauth2ResourceServer(oauth2 -> oauth2.authenticationManager(authenticationManager))
                .build();
    }

    // CORS配置，替换为你的React客户端实际地址
    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Collections.singletonList("http://localhost:3000"));
        configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
        configuration.setAllowedHeaders(Arrays.asList("Authorization", "Content-Type"));
        configuration.setAllowCredentials(true);
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

2. 异步化认证逻辑（适配WebFlux非阻塞模型） #

你的原认证管理器使用同步调用Graph API，会阻塞WebFlux线程池，需改为异步实现：

@Configuration
public class AuthenticationConfig {

    @Bean
    ReactiveAuthenticationManager customAuthenticationManager(AuthenticateService authenticateService) {
        return authentication -> {
            String token = authentication.getCredentials().toString();
            // 异步调用Graph API验证令牌
            return authenticateService.validateTokenWithGraphApi(token)
                    .switchIfEmpty(Mono.error(new BadCredentialsException("无效令牌: " + token)))
                    .map(userInfo -> new UsernamePasswordAuthenticationToken(userInfo, token, Collections.emptyList()));
        };
    }
}

@Service
public class AuthenticateService {

    private final WebClient webClient;

    public AuthenticateService(WebClient.Builder webClientBuilder) {
        // 注意Graph API的正确路径是v1.0，不是v1
        this.webClient = webClientBuilder.baseUrl("https://graph.microsoft.com/v1.0").build();
    }

    public Mono<MsAuthResponse> validateTokenWithGraphApi(String token) {
        return webClient.get()
                .uri("/me")
                .header(HttpHeaders.AUTHORIZATION, "Bearer " + token)
                .retrieve()
                // 令牌无效时返回空，后续触发认证失败
                .onStatus(HttpStatus::is4xxClientError, resp -> Mono.empty())
                .onStatus(HttpStatus::is5xxServerError, resp -> Mono.empty())
                .bodyToMono(MsAuthResponse.class);
    }
}

3. 其他关键修正 #

• Graph API路径修正：原代码中https://graph.microsoft.com/v1/me是错误路径，正确路径为https://graph.microsoft.com/v1.0/me
• 权限校验：确保React客户端获取的Access Token包含User.Read权限（调用/me接口必需）
• MsAuthResponse映射：确保该类能正确序列化Graph API返回的用户字段，示例：

public class MsAuthResponse {
    private String id;
    private String displayName;
    private String userPrincipalName;
    // 按需添加其他字段，生成getter/setter
}

验证步骤 #

1. 启动后端服务，确保CORS配置与React客户端地址匹配
2. 在React客户端中，确保请求头正确携带Authorization: Bearer <access_token>
3. 访问/secure-api，此时认证管理器断点会触发，令牌验证通过后返回"Secure Response"

内容的提问来源于stack exchange，提问作者Pritam Chakraborty