能否在Spring Security中仅使用/login/oauth2/code/:registration_id接口？

默认情况下，Spring Security的/login/oauth2/code/:registration_id端点依赖于/oauth2/authorization/:registration_id生成的会话绑定state参数，直接调用会因缺少合法state被拦截。要支持移动端SDK直接调用回调端点，需要调整授权请求和回调的处理逻辑，具体步骤如下：

1. 自定义OAuth2授权请求解析器，解绑state与HttpSession #

重写DefaultOAuth2AuthorizationRequestResolver，允许移动端传入自定义state，或生成不依赖会话的独立state，避免必须先走Web授权流程：

@Component
public class MobileOAuth2AuthorizationRequestResolver implements OAuth2AuthorizationRequestResolver {

    private final DefaultOAuth2AuthorizationRequestResolver delegate;

    public MobileOAuth2AuthorizationRequestResolver(ClientRegistrationRepository clientRegistrationRepository,
                                                   String authorizationRequestBaseUri) {
        this.delegate = new DefaultOAuth2AuthorizationRequestResolver(clientRegistrationRepository, authorizationRequestBaseUri);
        // 自定义state生成逻辑：优先使用移动端传入的state，否则生成随机UUID
        this.delegate.setAuthorizationRequestCustomizer(customizer -> customizer
                .stateGenerator(params -> {
                    String clientState = params.getFirst("state");
                    return clientState != null ? clientState : UUID.randomUUID().toString();
                })
        );
    }

    @Override
    public OAuth2AuthorizationRequest resolve(HttpServletRequest request) {
        return delegate.resolve(request);
    }

    @Override
    public OAuth2AuthorizationRequest resolve(HttpServletRequest request, String clientRegistrationId) {
        return delegate.resolve(request, clientRegistrationId);
    }
}

2. 配置Spring Security，开放回调端点并适配自定义逻辑 #

在Security配置中注册自定义解析器，开放回调端点的访问权限，同时调整OAuth2登录的相关配置：

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    private final MobileOAuth2AuthorizationRequestResolver authorizationRequestResolver;

    public SecurityConfig(MobileOAuth2AuthorizationRequestResolver authorizationRequestResolver) {
        this.authorizationRequestResolver = authorizationRequestResolver;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests(auth -> auth
                        // 允许移动端直接访问回调端点
                        .requestMatchers("/login/oauth2/code/**").permitAll()
                        .anyRequest().authenticated()
                )
                .oauth2Login(oauth2 -> oauth2
                        .authorizationEndpoint(endpoint -> endpoint
                                .authorizationRequestResolver(authorizationRequestResolver)
                        )
                        .redirectionEndpoint(endpoint -> endpoint
                                .baseUri("/login/oauth2/code/**")
                        )
                );
        return http.build();
    }
}

3. 移动端配合逻辑 #

• 移动端SDK调用第三方社交授权时，自行生成并本地存储state参数；
• 第三方授权成功后，回调到后端/login/oauth2/code/:registration_id时，携带该state参数；
• 后端通过自定义解析器接收state，后续token请求中会自动验证state一致性，完成授权码兑换。

安全注意事项 #

跳过会话绑定state后，需额外确保state的合法性：

• 建议移动端在请求时结合客户端ID对state进行签名，后端验证签名防止篡改；
• 避免使用过于简单的state值，降低CSRF攻击风险。

内容的提问来源于stack exchange，提问作者Ashe