Spring Security OAuth2自定义授权端点URL，避免附加注册ID

核心问题分析 #

Spring Security OAuth2要求ClientRegistration必须有非空的注册ID，且默认会在授权跳转路径后附加该ID。要实现完全自定义的授权URL（不附加任何注册ID），需要结合合法的注册ID配置和自定义授权请求解析器来覆盖默认逻辑。

步骤1：修正ClientRegistration配置 #

首先必须给ClientRegistration设置非空的注册ID（比如custom-provider），同时修正之前配置中的明显错误（tokenUri不能填clientSecret，需替换为实际的Token端点URL）：

@Bean
@Profile("dev")
public ClientRegistration devClientRegistration() {
    // 替换为实际的端点地址
    String authorizationUri = "http://localhost:8080/myoauthserver/oauthservlet";
    String tokenUri = "http://localhost:8080/myoauthserver/oauthservlet/token";
    String userInfoUri = "http://localhost:8080/myoauthserver/oauthservlet/userinfo";

    return ClientRegistration
            .withRegistrationId("custom-provider") // 必须设置非空注册ID
            .clientId(clientId)
            .clientSecret(clientSecret)
            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
            .authorizationUri(authorizationUri)
            .tokenUri(tokenUri) // 修正：填入实际Token端点URL
            .userInfoUri(userInfoUri)
            .userNameAttributeName(userNameAttribute)
            .redirectUri(redirectUrl)
            .providerConfigurationMetadata(providerDetails)
            .build();
}

步骤2：自定义授权请求解析器 #

实现OAuth2AuthorizationRequestResolver，直接替换生成的授权URL为指定地址，避免附加注册ID：

public class CustomAuthorizationRequestResolver implements OAuth2AuthorizationRequestResolver {
    private final OAuth2AuthorizationRequestResolver defaultResolver;
    private final String customAuthorizationUri;

    public CustomAuthorizationRequestResolver(ClientRegistrationRepository repo, String customUri) {
        this.defaultResolver = new DefaultOAuth2AuthorizationRequestResolver(repo, "/oauth2/authorization");
        this.customAuthorizationUri = customUri;
    }

    @Override
    public OAuth2AuthorizationRequest resolve(HttpServletRequest request) {
        OAuth2AuthorizationRequest req = defaultResolver.resolve(request);
        return customizeRequest(req);
    }

    @Override
    public OAuth2AuthorizationRequest resolve(HttpServletRequest request, String registrationId) {
        OAuth2AuthorizationRequest req = defaultResolver.resolve(request, registrationId);
        return customizeRequest(req);
    }

    private OAuth2AuthorizationRequest customizeRequest(OAuth2AuthorizationRequest req) {
        if (req == null) return null;
        // 替换为自定义的授权URL，不附加任何路径
        return OAuth2AuthorizationRequest.from(req)
                .authorizationUri(customAuthorizationUri)
                .build();
    }
}

步骤3：在安全链中配置自定义解析器 #

修改SecurityFilterChain，将自定义解析器绑定到授权端点：

@Bean
@Profile("dev")
public SecurityFilterChain securityWebFilterChain(HttpSecurity http) throws Exception {
    String customAuthorizationUri = "http://localhost:8080/myoauthserver/oauthservlet";

    http
        .authorizeRequests()
            .antMatchers("/login/**","/error/**", "/oauth2/**").permitAll() // 允许所有用户访问这些路径
            .anyRequest().authenticated()
        .and()
        .oauth2Login(oauth2 -> oauth2
            .authorizationEndpoint(endpoint -> endpoint
                .authorizationRequestResolver(new CustomAuthorizationRequestResolver(
                    clientRegistrationRepository(), customAuthorizationUri
                ))
            )
        );

    return http.build();
}

关键说明 #

• 注册ID仅用于Spring内部标识客户端配置，不会出现在最终的授权跳转URL中；
• 自定义解析器完全覆盖了默认的授权URL生成逻辑，确保跳转地址严格匹配你指定的URL；
• 修正了原配置中tokenUri的错误，避免后续Token获取流程失败。

内容的提问来源于stack exchange，提问作者Jason