Spring Boot 5非响应式OAuth客户端配置PKCE的实现疑问

问题描述 #

我尝试在Spring Boot 5的OAuth客户端中启用PKCE，能找到的示例均为响应式客户端的实现代码：

SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http, ReactiveClientRegistrationRepository clientRegistrationRepository) {
        DefaultServerOAuth2AuthorizationRequestResolver pkceResolver = new DefaultServerOAuth2AuthorizationRequestResolver(clientRegistrationRepository);
        pkceResolver.setAuthorizationRequestCustomizer(OAuth2AuthorizationRequestCustomizers.withPkce());

http.oauth2Login(login -> login
    .authorizationRequestResolver(pkceResolver)

将其转换为servlet版本时，我发现OAuth2LoginConfigurer没有authorizationRequestResolver方法来设置PKCE解析器，以下是我目前编写的代码：

@Bean
  public SecurityFilterChain filterChain(HttpSecurity http
          ,ClientRegistrationRepository repo
  ) 
  throws Exception {

    var resolver = new DefaultOAuth2AuthorizationRequestResolver(repo,"https://myoauthserver.com");
    resolver.setAuthorizationRequestCustomizer(OAuth2AuthorizationRequestCustomizers.withPkce());
    
    http
        .authorizeRequests(a -> a
            .antMatchers("/").permitAll()
            .anyRequest().authenticated())
        .oauth2Login(); // 没有响应式版本里的authorizationRequestResolver方法


    return http.build();
  }

请问如何在servlet环境下实现PKCE的配置？

解决方案 #

在Servlet环境的Spring Security中，OAuth2LoginConfigurer通过authorizationEndpoint()方法配置授权请求解析器，而非直接暴露authorizationRequestResolver方法。修改后的代码如下：

@Bean
public SecurityFilterChain filterChain(HttpSecurity http, ClientRegistrationRepository repo) throws Exception {
    // 创建授权请求解析器并启用PKCE
    DefaultOAuth2AuthorizationRequestResolver pkceResolver = 
        new DefaultOAuth2AuthorizationRequestResolver(repo, "/oauth2/authorization");
    pkceResolver.setAuthorizationRequestCustomizer(OAuth2AuthorizationRequestCustomizers.withPkce());
    
    http
        .authorizeRequests(a -> a
            .antMatchers("/").permitAll()
            .anyRequest().authenticated())
        .oauth2Login(oauth2 -> oauth2
            .authorizationEndpoint(endpoint -> endpoint
                .authorizationRequestResolver(pkceResolver)
            )
        );

    return http.build();
}

关键说明 #

• DefaultOAuth2AuthorizationRequestResolver的第二个参数是授权请求的基础路径，默认值为/oauth2/authorization，无需硬编码OAuth服务器地址，保持默认路径即可适配多数场景。
• 从Spring Security 5.2版本开始，针对无客户端密钥的公共客户端（如SPA、移动应用），PKCE是默认启用的。若你使用的Spring Boot 5对应Spring Security 6.x，可先检查客户端配置是否将client-authentication-method设为none，这种场景下无需手动配置解析器，框架会自动启用PKCE。

内容的提问来源于stack exchange，提问作者bradley