Spring Boot中如何从OAuth2响应获取state参数

不需要重写OidcAuthorizationCodeAuthenticationProvider，最简便的方式是通过自定义OAuth2认证成功处理器来获取返回的State参数，具体实现如下：

1. 自定义OAuth2AuthenticationSuccessHandler #

在认证成功的回调中，你可以直接从请求参数中拿到授权服务器返回的State，或者从授权客户端的上下文里读取：

@Component
public class CustomOAuth2SuccessHandler extends SimpleUrlAuthenticationSuccessHandler {

    private final OAuth2AuthorizedClientService authorizedClientService;

    public CustomOAuth2SuccessHandler(OAuth2AuthorizedClientService authorizedClientService) {
        this.authorizedClientService = authorizedClientService;
    }

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        // 方式1：直接从回调请求参数中获取State（最直接）
        String state = request.getParameter("state");
        if (state != null) {
            // 解码你之前Base64编码的原始内容
            String originalState = new String(Base64.getDecoder().decode(state));
            // 这里可以根据业务需求使用该值，比如存入Session、传递到后续页面等
            request.getSession().setAttribute("customState", originalState);
        }

        // 方式2：从认证上下文的授权客户端中读取（更规范，适合复杂场景）
        if (authentication instanceof OAuth2AuthenticationToken) {
            OAuth2AuthenticationToken oauthToken = (OAuth2AuthenticationToken) authentication;
            OAuth2AuthorizedClient authorizedClient = authorizedClientService.loadAuthorizedClient(
                    oauthToken.getAuthorizedClientRegistrationId(),
                    oauthToken.getName()
            );
            if (authorizedClient != null) {
                String stateFromAuth = authorizedClient.getAuthorizationRequest().getState();
                String originalState = new String(Base64.getDecoder().decode(stateFromAuth));
                // 执行你的业务逻辑
            }
        }

        // 保留原有跳转逻辑
        super.onAuthenticationSuccess(request, response, authentication);
    }
}

2. 将自定义处理器配置到Spring Security #

在Security配置类中，把自定义的成功处理器绑定到OAuth2登录流程：

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    private final CustomOAuth2SuccessHandler customOAuth2SuccessHandler;
    private final ClientRegistrationRepository clientRegistrationRepository;

    public SecurityConfig(CustomOAuth2SuccessHandler customOAuth2SuccessHandler,
                          ClientRegistrationRepository clientRegistrationRepository) {
        this.customOAuth2SuccessHandler = customOAuth2SuccessHandler;
        this.clientRegistrationRepository = clientRegistrationRepository;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
                .oauth2Login(oauth2 -> oauth2
                        // 配置你的自定义AuthorizationRequestResolver
                        .authorizationEndpoint(endpoint -> endpoint
                                .authorizationRequestResolver(customAuthorizationRequestResolver())
                        )
                        // 绑定自定义成功处理器
                        .successHandler(customOAuth2SuccessHandler)
                );
        return http.build();
    }

    private OAuth2AuthorizationRequestResolver customAuthorizationRequestResolver() {
        DefaultOAuth2AuthorizationRequestResolver resolver = new DefaultOAuth2AuthorizationRequestResolver(
                clientRegistrationRepository, "/oauth2/authorization");
        resolver.setAuthorizationRequestCustomizer(this::customizeAuthorizationRequest);
        return resolver;
    }

    private OAuth2AuthorizationRequest customizeAuthorizationRequest(OAuth2AuthorizationRequest req,
                                                                    HttpServletRequest request) {
        String state = Base64.getEncoder().encodeToString("test".getBytes());
        return OAuth2AuthorizationRequest.from(req).state(state).build();
    }
}

原理说明 #

OAuth2授权流程中，授权服务器（谷歌）会将你发起请求时传入的state参数原样返回给回调地址，因此在认证成功的回调阶段，无论是直接从请求参数读取，还是从Spring Security维护的授权客户端上下文读取，都能轻松获取到你自定义的State值，无需修改核心认证提供者的逻辑。

内容的提问来源于stack exchange，提问作者Sameer Malhotra