Spring Boot响应式应用：复用入站JWT实现出站WebClient调用配置求助

1. 配置自动注入JWT令牌的WebClient #

创建WebClient配置类，通过过滤器从当前安全上下文提取已验证的JWT令牌，自动添加到出站请求的Authorization头中：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.ReactiveSecurityContextHolder;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.web.reactive.function.client.ExchangeFilterFunction;
import org.springframework.web.reactive.function.client.WebClient;
import reactor.core.publisher.Mono;

@Configuration
public class WebClientConfig {

    @Bean
    public WebClient jwtWebClient() {
        return WebClient.builder()
                .filter(addJwtTokenFilter())
                .build();
    }

    private ExchangeFilterFunction addJwtTokenFilter() {
        return (request, next) -> ReactiveSecurityContextHolder.getContext()
                .map(context -> context.getAuthentication())
                .filter(Authentication::isAuthenticated)
                .map(Authentication::getPrincipal)
                .filter(principal -> principal instanceof Jwt)
                .map(Jwt.class::cast)
                .map(Jwt::getTokenValue)
                .defaultIfEmpty("")
                .flatMap(token -> {
                    var modifiedRequest = request.mutate()
                            .header("Authorization", "Bearer " + token)
                            .build();
                    return next.exchange(modifiedRequest);
                });
    }
}

注：如果业务要求无有效令牌时拒绝请求，可以替换defaultIfEmpty("")为switchIfEmpty(Mono.error(new UnauthorizedException("No valid JWT token found")))。

2. 替换OpenAPI生成的ApiClient默认WebClient #

OpenAPI Generator生成的ApiClient支持替换内置WebClient，有两种常用方式：

方式1：全局注册配置好的ApiClient #

将ApiClient注册为Bean，直接注入自定义WebClient，全局所有API接口都会复用该配置：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.reactive.function.client.WebClient;

@Configuration
public class OpenApiClientConfig {

    @Bean
    public ApiClient apiClient(WebClient jwtWebClient) {
        ApiClient apiClient = new ApiClient();
        apiClient.setWebClient(jwtWebClient);
        // 可在此添加basePath、默认请求头等全局配置
        return apiClient;
    }
}

后续使用生成的API接口（如UserApi）时，直接注入即可自动使用该配置。

方式2：局部使用时手动替换 #

仅在特定服务中替换WebClient：

import org.springframework.web.reactive.function.client.WebClient;

@Service
public class BusinessService {

    private final UserApi userApi;

    public BusinessService(ApiClient apiClient, WebClient jwtWebClient) {
        this.userApi = new UserApi(apiClient);
        // 替换为带JWT自动注入的WebClient
        this.userApi.getApiClient().setWebClient(jwtWebClient);
    }

    // 调用userApi的业务方法
}

3. 关键注意事项 #

• 确保安全上下文有效性：由于你已通过JwtIssuerReactiveAuthenticationManagerResolver完成入站JWT验证，ReactiveSecurityContextHolder中会自动持有有效Jwt认证信息，无需额外处理。
• 避免OAuth2客户端自动覆盖：如果application.properties中有OAuth2客户端配置，需确保WebClient未被自动配置为OAuth2客户端（可排除OAuth2ClientAutoConfiguration），否则会覆盖手动注入的JWT令牌逻辑。

内容的提问来源于stack exchange，提问作者FourPee