Spring Security OAuth2配置：部分URL返回401，其余跳转登录页

要实现未登录时/ui/*跳转登录页、/api/*返回401状态码，核心是正确配置多优先级的SecurityWebFilterChain，并为不同路径指定对应的未授权处理逻辑。之前配置失败大概率是因为未明确过滤器链的优先级或请求匹配范围，以下是可行的实现方案：

关键配置思路 #

1. 为UI和API分别创建独立的SecurityWebFilterChain，通过@Order指定优先级（数字越小优先级越高）
2. 用securityMatcher明确每个过滤器链负责的路径范围，避免冲突
3. 针对UI路径配置OAuth2登录跳转逻辑，针对API路径配置资源服务器的401响应逻辑

具体代码实现 #

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;
import org.springframework.security.oauth2.server.resource.web.BearerTokenAuthenticationEntryPoint;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    // 处理UI路径的过滤器链，优先级更高
    @Bean
    @Order(1)
    public SecurityFilterChain uiSecurityFilterChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/ui/**") // 仅匹配/ui开头的请求
            .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            .oauth2Login() // 启用OAuth2登录流程
            .and()
            .exceptionHandling(ex -> ex
                .authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/oauth2/authorization/your-client-id"))
                // 替换为你的OAuth2客户端授权入口，或者自定义登录页路径如"/login"
            );
        return http.build();
    }

    // 处理API路径的过滤器链，优先级次之
    @Bean
    @Order(2)
    public SecurityFilterChain apiSecurityFilterChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/api/**") // 仅匹配/api开头的请求
            .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            .oauth2ResourceServer(oauth2 -> oauth2.jwt()) // 启用JWT资源服务器模式（根据令牌类型调整）
            .exceptionHandling(ex -> ex
                .authenticationEntryPoint(new BearerTokenAuthenticationEntryPoint())
                // 未授权时返回标准401 Unauthorized响应
            )
            .csrf(csrf -> csrf.disable()); // API场景通常禁用CSRF保护
        return http.build();
    }
}

核心要点说明 #

• @Order注解：必须为每个过滤器链指定唯一的优先级，确保UI路径的请求先被匹配处理
• securityMatcher：精准限定过滤器链的处理范围，避免两个链重复处理同一请求
• 未授权逻辑适配：
  • UI链使用LoginUrlAuthenticationEntryPoint，将未认证请求重定向到OAuth2授权登录页或自定义登录页
  • API链使用BearerTokenAuthenticationEntryPoint，返回符合REST规范的401状态码及Bearer令牌错误信息
• OAuth2基础配置：需在application.yml中补充客户端/资源服务器的基础信息（示例如下）

spring:
  security:
    oauth2:
      client:
        registration:
          your-client-id:
            client-id: your-client-id
            client-secret: your-client-secret
            scope: openid, profile
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/your-client-id"
        provider:
          your-client-id:
            issuer-uri: https://your-auth-server.com/realms/your-realm
      resourceserver:
        jwt:
          issuer-uri: https://your-auth-server.com/realms/your-realm

内容的提问来源于stack exchange，提问作者kai