Spring Boot 2.7.3集成Spring Security时JWEHeader转JWSHeader报错

集成Spring Boot 2.7.3与Spring Security，使用Auth0作为身份认证提供商时，出现如下JWT解码失败的类型转换错误：

[or-http-epoll-1] o.s.s.w.s.a.AuthenticationWebFilter: 
Authentication failed: An error occurred while attempting to decode the Jwt: 
class com.nimbusds.jose.JWEHeader cannot be cast to class 
com.nimbusds.jose.JWSHeader (com.nimbusds.jose.JWEHeader and 
com.nimbusds.jose.JWSHeader are in unnamed module of loader 
org.springframework.boot.loader.LaunchedURLClassLoader @43da41e)

对应的自定义jwtDecoder Bean代码如下：

import org.springframework.security.oauth2.jwt.Jwt
import org.springframework.security.oauth2.jwt.JwtValidators
import org.springframework.security.oauth2.jwt.NimbusReactiveJwtDecoder
import org.springframework.security.oauth2.jwt.ReactiveJwtDecoder
import org.springframework.security.oauth2.jwt.ReactiveJwtDecoders

@Bean
fun jwtDecoder(properties: OAuth2ResourceServerProperties): ReactiveJwtDecoder {
    val issuerUri = properties.jwt.issuerUri
    val jwtDecoder = ReactiveJwtDecoders.fromOidcIssuerLocation(issuerUri) as NimbusReactiveJwtDecoder

    val audienceValidator: OAuth2TokenValidator<Jwt> = AudienceValidator(audience)
    val withIssuer: OAuth2TokenValidator<Jwt> = JwtValidators.createDefaultWithIssuer(issuerUri)
    val withAudience: OAuth2TokenValidator<Jwt> = DelegatingOAuth2TokenValidator(withIssuer, audienceValidator)

    jwtDecoder.setJwtValidator(withAudience)
    return jwtDecoder
}

问题根源 #

错误核心是JWE（JSON Web Encryption）格式的Token被当作JWS（JSON Web Signature）处理，同时代码中直接强制类型转换ReactiveJwtDecoder为NimbusReactiveJwtDecoder的方式缺乏容错，且默认通过fromOidcIssuerLocation创建的解码器未自动配置JWE解析支持。

修复步骤 #

1. 替换强制类型转换为安全转换（可选但推荐）
   避免直接as强制转换，改用as?配合空判断，防止类型不匹配时抛出异常：

   val jwtDecoder = ReactiveJwtDecoders.fromOidcIssuerLocation(issuerUri) as? NimbusReactiveJwtDecoder 
       ?: throw IllegalArgumentException("Failed to cast decoder to NimbusReactiveJwtDecoder")
   

2. 手动构建支持JWE的Nimbus解码器
   直接基于JWK源构建解码器，确保支持JWE解密，适配Auth0的Token格式：

import org.springframework.security.oauth2.jwt.Jwt
import org.springframework.security.oauth2.jwt.JwtValidators
import org.springframework.security.oauth2.jwt.NimbusReactiveJwtDecoder
import org.springframework.security.oauth2.jwt.ReactiveJwtDecoder
import com.nimbusds.jose.jwk.source.JWKSource
import com.nimbusds.jose.proc.SecurityContext

@Bean
fun jwtDecoder(properties: OAuth2ResourceServerProperties, jwkSource: JWKSource<SecurityContext>): ReactiveJwtDecoder {
    val issuerUri = properties.jwt.issuerUri
    // 手动构建解码器，显式支持JWE
    val jwtDecoder = NimbusReactiveJwtDecoder.withJwkSource(jwkSource)
        .issuer(issuerUri)
        .build()

    val audienceValidator: OAuth2TokenValidator<Jwt> = AudienceValidator(audience)
    val withIssuer: OAuth2TokenValidator<Jwt> = JwtValidators.createDefaultWithIssuer(issuerUri)
    val withAudience: OAuth2TokenValidator<Jwt> = DelegatingOAuth2TokenValidator(withIssuer, audienceValidator)

    jwtDecoder.setJwtValidator(withAudience)
    return jwtDecoder
}

3. 校验依赖完整性
   确保项目依赖中包含完整的Nimbus JWT库（版本需与Spring Boot 2.7.3兼容）：
   Gradle Kotlin DSL示例：

   implementation("com.nimbusds:nimbus-jose-jwt:9.25.6")
   

   Maven示例：

   <dependency>
       <groupId>com.nimbusds</groupId>
       <artifactId>nimbus-jose-jwt</artifactId>
       <version>9.25.6</version>
   </dependency>
   

内容的提问来源于stack exchange，提问作者Sami