如何修改Spring Boot OAuth2配置实现仅Google认证登录并跳过应用自定义登录页

Got it, let's tweak your configuration to make unauthenticated users redirect straight to Google's auth server instead of your custom login page, while ditching the form login entirely. Here's what you need to change:

Key Modifications to Your HttpSecurity Configuration #

1. Remove all form login-related code: Since you don't need form-based authentication anymore, we can delete the entire formLogin() block.
2. Adjust allowed anonymous endpoints: Remove /login from the antMatchers list (we won't use the custom login page) and keep only the paths required for OAuth2 flow.
3. Remove the loginPage from oauth2Login: By omitting this, Spring Security will automatically redirect unauthenticated users directly to Google's authorization server instead of your custom page.

Modified Full Configuration #

protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
        .antMatchers("/", "/oauth2/**").permitAll() // Keep only necessary unprotected paths
        .anyRequest().authenticated()
        .and()
        .oauth2Login() // No loginPage config = auto-redirect to Google
        .userInfoEndpoint()
        .userService(oauthUserService)
        .and()
        .successHandler(yourSuccessHandler) // Keep your custom success logic
        .and()
        .logout()
        .logoutSuccessUrl("/")
        .permitAll()
        .and()
        .exceptionHandling()
        .accessDeniedPage("/403")
    ;
}

Breakdown of Changes #

• Form login removal: The entire formLogin().permitAll()... section is deleted—we're eliminating all form-based auth functionality entirely.
• Simplified antMatchers: We only allow anonymous access to the homepage (/) and OAuth2-related endpoints (/oauth2/**), which Spring Security uses to handle the Google auth callback flow.
• Auto-redirect to Google: Without setting loginPage("/login") on oauth2Login(), Spring Security will trigger the OAuth2 authorization flow automatically when an unauthenticated user hits a protected resource, sending them straight to Google's login screen.
• Retained custom logic: Your oauthUserService (for processing Google user data) and successHandler (for post-login actions) stay intact—these don't interfere with the redirect behavior.

Quick Pre-Requisite Check #

Make sure your application properties/YAML has the correct Google OAuth2 client configuration (this is required for the redirect to work):

spring.security.oauth2.client.registration.google.client-id=your-google-client-id
spring.security.oauth2.client.registration.google.client-secret=your-google-client-secret
spring.security.oauth2.client.registration.google.scopes=openid,email,profile

内容的提问来源于stack exchange，提问作者Priyshrm