Spring Cloud Gateway中ReactiveAuthenticationManager调用FeignClient无响应问题

问题根源 #

FeignClient本质是阻塞式HTTP客户端，而ReactiveAuthenticationManager的authenticate()方法处于Reactor响应式流中。直接在响应式流里调用阻塞的Feign接口会导致Reactor的IO线程被阻塞，响应式流无法正常推进，这就是你看到flatMap代码块不执行的原因；而强行用block()会触发Reactor的阻塞检测机制，抛出block()/blockfirst()/blocklast() are blocking错误。

可行解决方案 #

1. 替换Feign为响应式客户端（推荐）

用WebClient配合Spring Cloud LoadBalancer实现负载均衡的响应式调用，完全契合WebFlux的响应式模型：

• 配置LoadBalanced WebClient：

@Configuration
public class WebClientConfig {
    @Bean
    @LoadBalanced
    public WebClient.Builder loadBalancedWebClientBuilder() {
        return WebClient.builder();
    }
}

• 在ReactiveAuthenticationManager中使用WebClient：

@Component
public class CustomReactiveAuthenticationManager implements ReactiveAuthenticationManager {
    private final WebClient webClient;

    public CustomReactiveAuthenticationManager(WebClient.Builder webClientBuilder) {
        this.webClient = webClientBuilder.baseUrl("http://auth-service").build();
    }

    @Override
    public Mono<Authentication> authenticate(Authentication authentication) {
        String token = authentication.getCredentials().toString();
        return webClient.get()
                .uri("/validate?token={token}", token)
                .retrieve()
                .bodyToMono(AuthValidationResponse.class)
                .flatMap(response -> {
                    if (response.isValid()) {
                        // 构造认证通过的Authentication对象返回
                        return Mono.just(new UsernamePasswordAuthenticationToken(
                                response.getUsername(),
                                null,
                                Collections.emptyList()
                        ));
                    } else {
                        return Mono.error(new BadCredentialsException("Invalid token"));
                    }
                })
                .onErrorResume(e -> Mono.error(new AuthenticationServiceException("Auth service unavailable", e)));
    }
}

2. 保留FeignClient但适配响应式流（妥协方案）

如果必须使用Feign，需要将阻塞调用包装在Mono.fromCallable()中，并指定单独的线程池避免阻塞Reactor线程：

@Component
public class CustomReactiveAuthenticationManager implements ReactiveAuthenticationManager {
    private final AuthFeignClient authFeignClient;

    public CustomReactiveAuthenticationManager(AuthFeignClient authFeignClient) {
        this.authFeignClient = authFeignClient;
    }

    @Override
    public Mono<Authentication> authenticate(Authentication authentication) {
        String token = authentication.getCredentials().toString();
        return Mono.fromCallable(() -> authFeignClient.validateToken(token))
                .subscribeOn(Schedulers.boundedElastic()) // 将阻塞调用移到弹性线程池
                .flatMap(response -> {
                    if (response.isValid()) {
                        return Mono.just(new UsernamePasswordAuthenticationToken(
                                response.getUsername(),
                                null,
                                Collections.emptyList()
                        ));
                    } else {
                        return Mono.error(new BadCredentialsException("Invalid token"));
                    }
                })
                .onErrorResume(e -> Mono.error(new AuthenticationServiceException("Auth service call failed", e)));
    }
}

3. 用WebFilter实现认证逻辑（你提到的方向）

在Gateway的过滤链中实现认证，比在ReactiveAuthenticationManager中更灵活，天然适配响应式流：

@Component
public class AuthFilter implements WebFilter {
    private final WebClient webClient;

    public AuthFilter(WebClient.Builder webClientBuilder) {
        this.webClient = webClientBuilder.baseUrl("http://auth-service").build();
    }

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
        String token = exchange.getRequest().getHeaders().getFirst("Authorization");
        if (token == null || !token.startsWith("Bearer ")) {
            exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
            return exchange.getResponse().setComplete();
        }
        token = token.substring(7);
        return webClient.get()
                .uri("/validate?token={token}", token)
                .retrieve()
                .bodyToMono(AuthValidationResponse.class)
                .flatMap(response -> {
                    if (response.isValid()) {
                        // 将用户信息存入请求属性，后续路由可用
                        exchange.getAttributes().put("username", response.getUsername());
                        return chain.filter(exchange);
                    } else {
                        exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
                        return exchange.getResponse().setComplete();
                    }
                })
                .onErrorResume(e -> {
                    exchange.getResponse().setStatusCode(HttpStatus.INTERNAL_SERVER_ERROR);
                    return exchange.getResponse().setComplete();
                });
    }
}

关键注意事项 #

• 绝对禁止在Reactive流中使用block()/blockFirst()/blockLast()，这会破坏响应式模型，导致线程阻塞甚至死锁。
• 所有外部调用必须保持响应式链式调用，用flatMap/map/onErrorResume等操作符处理流的转换和错误。
• 如果使用WebFilter，注意过滤链的执行顺序，可以通过@Order注解指定优先级，确保认证逻辑在路由前执行。

内容的提问来源于stack exchange，提问作者Sagar Nayak