AWS Lambda上的Spring Boot集成Azure AD时出现异常

核心原因 #

AWS Lambda是无状态执行环境，无原生HttpSession支持。Spring Security默认的HttpSessionRequestCache依赖HttpSession保存认证前的请求，但Lambda环境中session对象为空，调用saveRequest时触发空指针异常。

解决步骤 #

1. 自定义无Session依赖的RequestCache #

创建绕过HttpSession的RequestCache实现，跳过请求保存逻辑：

import org.springframework.security.web.savedrequest.RequestCache;
import org.springframework.security.web.savedrequest.SavedRequest;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

public class NoOpRequestCache implements RequestCache {
    @Override
    public void saveRequest(HttpServletRequest request, HttpServletResponse response) {}

    @Override
    public SavedRequest getRequest(HttpServletRequest request, HttpServletResponse response) {
        return null;
    }

    @Override
    public void removeRequest(HttpServletRequest request, HttpServletResponse response) {}

    @Override
    public HttpServletRequest getMatchingRequest(HttpServletRequest request, HttpServletResponse response) {
        return null;
    }
}

2. 替换Spring Security默认RequestCache #

修改Security配置类，用自定义实现替换默认的HttpSessionRequestCache：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.savedrequest.RequestCache;

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            .oauth2Login(oauth2 -> {
                // 保留你的Azure AD OAuth2配置
            })
            .requestCache(cache -> cache.requestCache(noOpRequestCache()));
        return http.build();
    }

    @Bean
    public RequestCache noOpRequestCache() {
        return new NoOpRequestCache();
    }
}

3. 适配Lambda请求处理逻辑 #

确保StreamLambdaHandler使用标准Spring Boot Lambda适配实现，避免额外session依赖：

import com.amazonaws.serverless.proxy.spring.SpringBootLambdaContainerHandler;
import com.amazonaws.serverless.proxy.model.AwsProxyRequest;
import com.amazonaws.serverless.proxy.model.AwsProxyResponse;
import com.amazonaws.services.lambda.runtime.Context;
import com.amazonaws.services.lambda.runtime.RequestStreamHandler;

import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;

public class StreamLambdaHandler implements RequestStreamHandler {
    private static final SpringBootLambdaContainerHandler<AwsProxyRequest, AwsProxyResponse> handler;

    static {
        try {
            handler = SpringBootLambdaContainerHandler.getAwsProxyHandler(YourSpringBootApplication.class);
        } catch (Exception e) {
            throw new RuntimeException("Failed to initialize Spring Boot app", e);
        }
    }

    @Override
    public void handleRequest(InputStream inputStream, OutputStream outputStream, Context context) throws IOException {
        handler.proxyStream(inputStream, outputStream, context);
    }
}

4. 禁用Session相关配置 #

在application.properties中添加配置，明确禁用session：

# 禁用Spring Session
spring.session.store-type=none
# 禁用HTTP Session
server.servlet.session.enabled=false

额外验证点 #

• 确认Azure AD的OAuth2回调URL指向Lambda关联的API Gateway端点
• 检查pom.xml中Spring Security与AWS Lambda依赖版本兼容性，避免版本冲突

内容的提问来源于stack exchange，提问作者poknovem