Spring Security鉴权后返回空200响应，请求未执行问题排查

你的问题核心是JwtAuthetificationFilter过滤器未继续执行过滤器链。完成JWT验证并设置Authentication后，没有调用filterChain.doFilter(request, response)，导致请求被卡在过滤器环节，无法到达控制器处理，因此返回空的200响应。

修正JwtAuthFilter代码 #

修改doFilterInternal方法，在方法末尾添加过滤器链调用，确保请求能传递到后续环节：

@Component
@RequiredArgsConstructor
public class JwtAuthetificationFilter extends OncePerRequestFilter {
    private final JwtService jwtService;
    @Autowired
    private UserDetailsService userDetailsService;
    
    @Override
    protected void doFilterInternal(
            @NonNull HttpServletRequest request,
            @NonNull HttpServletResponse response,
            @NonNull FilterChain filterChain
    ) throws ServletException, IOException {
        final String authorizationHeader = request.getHeader("Authorization");
        final String jwt;
        final String email;
        
        if (authorizationHeader == null || !authorizationHeader.startsWith("Bearer ")) {
            filterChain.doFilter(request, response);
            return;
        }
        
        jwt = authorizationHeader.substring(7);
        email = jwtService.extractEmail(jwt);
        
        if (email != null && SecurityContextHolder.getContext().getAuthentication() == null){
            UserDetails userDetails = userDetailsService.loadUserByUsername(email);
            if (jwtService.isTokenValid(jwt, userDetails)){
                UsernamePasswordAuthenticationToken authenticationToken
                        = new UsernamePasswordAuthenticationToken(
                        userDetails, null, userDetails.getAuthorities());
                authenticationToken.setDetails(
                        new WebAuthenticationDetailsSource().buildDetails(request)
                );
                SecurityContextHolder.getContext().setAuthentication(authenticationToken);
            }
        }
        // 关键：添加此行，让请求继续流向控制器
        filterChain.doFilter(request, response);
    }
}

额外检查点 #

• 确认SECRET_KEY是有效的Base64编码字符串，HS256要求密钥至少256位（32字节），避免因密钥不合法导致JWT解析静默失败
• 检查User类是否正确实现UserDetails接口，getAuthorities()方法需返回非空权限集合（普通用户可返回Collections.singletonList(new SimpleGrantedAuthority("ROLE_USER"))）
• 可在控制器方法开头添加日志，验证请求是否成功到达

内容的提问来源于stack exchange，提问作者sBeran23