Spring Boot对接IdentityServer4：添加PKCE code_challenge遇配置错误求助

问题根源 #

你之前新增的OAuth2ClientConfiguration用了WebFlux栈的ServerHttpSecurity和SecurityWebFilterChain，但你的项目是Servlet栈（现有SecurityConfig用的是HttpSecurity和SecurityFilterChain），两者不兼容，所以Spring找不到ServerHttpSecurity的bean导致报错。

正确配置方案 #

直接在现有SecurityConfig中修改，添加PKCE支持，无需额外创建WebFlux相关配置类：

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    private static final String[] WHITE_LIST_URLS = {
            "/user",
            "/helloPublic",
            "/register",
            "/verifyRegistration*",
            "/resendVerifyToken*"
    };

    @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity http, OAuth2AuthorizationRequestResolver pkceAuthorizationRequestResolver) throws Exception {
        http
                .cors()
                .and()
                .csrf()
                .disable()
                .authorizeHttpRequests()
                .antMatchers(WHITE_LIST_URLS).permitAll()
                .antMatchers("/api/**").authenticated()
                .and()
                .oauth2Login(oauth2login ->
                        oauth2login
                                .loginPage("/auth2/authorization/landstar")
                                .authorizationRequestResolver(pkceAuthorizationRequestResolver)) // 配置PKCE的resolver
                .logout(l -> l
                        .logoutSuccessUrl("/").permitAll()
                )
                .oauth2Client(Customizer.withDefaults());

        return http.build();
    }

    // 配置支持PKCE的AuthorizationRequestResolver
    @Bean
    public OAuth2AuthorizationRequestResolver pkceAuthorizationRequestResolver(ClientRegistrationRepository clientRegistrationRepository) {
        DefaultOAuth2AuthorizationRequestResolver resolver = new DefaultOAuth2AuthorizationRequestResolver(
                clientRegistrationRepository, "/oauth2/authorization");
        resolver.setAuthorizationRequestCustomizer(OAuth2AuthorizationRequestCustomizers.withPkce());
        return resolver;
    }
}

关键说明 #

• 移除之前的OAuth2ClientConfiguration类，避免WebFlux和Servlet栈冲突
• 新增pkceAuthorizationRequestResolver Bean，通过OAuth2AuthorizationRequestCustomizers.withPkce()自动添加code_challenge和code_challenge_method参数
• 在oauth2Login配置中指定这个自定义的resolver，替换默认实现

这样配置后，Spring Boot客户端在向IdentityServer4发起授权请求时，会自动携带PKCE相关参数，解决code_challenge is missing的错误。

内容的提问来源于stack exchange，提问作者debowsley