Spring Boot REST API如何实现无状态OAuth2社交登录？

核心思路 #

OAuth2授权码流程本身是无状态的，但Spring OAuth2客户端默认依赖JSESSIONID存储授权请求状态。要实现无状态集成，核心是：

1. 替换默认的session-based授权请求存储，改用Redis/加密Cookie等无状态方式保存授权状态
2. 在OAuth2登录成功后，生成自有体系的JWT返回给前端，后续所有请求用该JWT做鉴权，彻底抛弃session

具体实现步骤 #

1. 配置Spring Security，禁用Session并自定义OAuth2流程

修改SecurityFilterChain配置，强制设置无状态会话，同时替换授权请求仓库，并在登录成功后生成自有JWT：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http, JwtUtil jwtUtil, RedisTemplate<String, Object> redisTemplate) throws Exception {
    http
        .csrf(csrf -> csrf.disable()) // 若前端用Cookie存JWT需开启，根据实际场景调整
        .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
        .oauth2Login(oauth2 -> oauth2
            // 自定义授权请求仓库，用Redis存储state关联的授权信息
            .authorizationEndpoint(auth -> auth
                .authorizationRequestRepository(new OAuth2AuthorizationRequestRepository<OAuth2AuthorizationRequest>() {
                    @Override
                    public void saveAuthorizationRequest(OAuth2AuthorizationRequest authRequest, HttpServletRequest request, HttpServletResponse response) {
                        String state = authRequest.getState();
                        // 用state作为key，10分钟过期，避免无效请求
                        redisTemplate.opsForValue().set("oauth2:state:" + state, authRequest, 10, TimeUnit.MINUTES);
                    }

                    @Override
                    public OAuth2AuthorizationRequest loadAuthorizationRequest(HttpServletRequest request) {
                        String state = request.getParameter("state");
                        return state == null ? null : (OAuth2AuthorizationRequest) redisTemplate.opsForValue().getAndDelete("oauth2:state:" + state);
                    }

                    @Override
                    public OAuth2AuthorizationRequest removeAuthorizationRequest(HttpServletRequest request, HttpServletResponse response) {
                        return loadAuthorizationRequest(request);
                    }
                })
            )
            // 登录成功后生成自有JWT并返回给前端
            .successHandler((request, response, authentication) -> {
                OAuth2User oAuth2User = (OAuth2User) authentication.getPrincipal();
                // 从OAuth2用户信息中提取核心字段（如邮箱、用户名）
                String userEmail = oAuth2User.getAttribute("email");
                // 关联自有数据库用户（首次登录可自动创建）
                User user = userService.findOrCreateByEmail(userEmail);
                // 生成自有JWT
                String token = jwtUtil.generateToken(user.getUsername(), user.getAuthorities());
                // 返回JSON格式的令牌给前端
                response.setContentType(MediaType.APPLICATION_JSON_VALUE);
                new ObjectMapper().writeValue(response.getWriter(), Map.of("token", token));
            })
        )
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/login/**", "/oauth2/**").permitAll()
            .anyRequest().authenticated()
        );

    // 添加JWT鉴权过滤器，在OAuth2过滤器之前执行
    http.addFilterBefore(jwtAuthenticationFilter(jwtUtil), UsernamePasswordAuthenticationFilter.class);
    return http.build();
}

2. 实现JWT鉴权过滤器

编写自定义过滤器，从请求头读取JWT并验证，将认证信息放入SecurityContext，替代session鉴权：

public class JwtAuthenticationFilter extends OncePerRequestFilter {
    private final JwtUtil jwtUtil;
    private final UserDetailsService userDetailsService;

    public JwtAuthenticationFilter(JwtUtil jwtUtil, UserDetailsService userDetailsService) {
        this.jwtUtil = jwtUtil;
        this.userDetailsService = userDetailsService;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        String authHeader = request.getHeader("Authorization");
        if (authHeader != null && authHeader.startsWith("Bearer ")) {
            String token = authHeader.substring(7);
            if (jwtUtil.isTokenValid(token)) {
                String username = jwtUtil.extractUsername(token);
                UserDetails userDetails = userDetailsService.loadUserByUsername(username);
                UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
                        userDetails, null, userDetails.getAuthorities()
                );
                authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(authToken);
            }
        }
        filterChain.doFilter(request, response);
    }
}

@Bean
public JwtAuthenticationFilter jwtAuthenticationFilter(JwtUtil jwtUtil, UserDetailsService userDetailsService) {
    return new JwtAuthenticationFilter(jwtUtil, userDetailsService);
}

3. 关联自有用户体系

在OAuth2登录成功的successHandler中，需要将Google返回的用户信息与自有数据库的用户关联：

• 若用户已存在：直接用现有用户生成JWT
• 若用户不存在：自动创建新用户（需处理昵称、邮箱等字段映射）

关键注意事项 #

• State参数安全：用Redis存储授权请求状态，避免前端篡改，同时设置合理的过期时间（如10分钟）
• 彻底禁用Session：必须设置SessionCreationPolicy.STATELESS，确保Spring Security不创建任何session
• JWT存储建议：前端优先将JWT存在HttpOnly Cookie中（配合CSRF保护），避免XSS风险；若用localStorage需额外做XSS防护
• 跨域配置：确保CORS配置允许前端域名访问，同时允许携带Authorization头和必要的Cookie

内容的提问来源于stack exchange，提问作者ZZBL