Spring WebFlux集成Swagger UI遇Bearer Token及CSRF问题求助

问题1：Swagger UI不显示Bearer Token输入框 #

问题根源 #

没在OpenAPI配置里明确声明Bearer Token的认证规则，Swagger UI不知道要渲染Token输入框；另外如果Spring Security没放行Swagger相关路径，配置也没法生效。

解决步骤 #

1. 新增OpenAPI配置类，指定Bearer认证方案：

import io.swagger.v3.oas.models.Components;
import io.swagger.v3.oas.models.OpenAPI;
import io.swagger.v3.oas.models.security.SecurityRequirement;
import io.swagger.v3.oas.models.security.SecurityScheme;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class OpenApiConfig {
    @Bean
    public OpenAPI customOpenAPI() {
        return new OpenAPI()
                .components(new Components()
                        .addSecuritySchemes("bearerAuth", new SecurityScheme()
                                .type(SecurityScheme.Type.HTTP)
                                .scheme("bearer")
                                .bearerFormat("JWT")))
                .addSecurityItem(new SecurityRequirement().addList("bearerAuth"));
    }
}

2. 确保Spring Security放行Swagger相关路径，要么在securityProperties.getIgnoredPaths()里加上这些路径：
   • /v3/api-docs/**
   • /swagger-ui/**
   • /swagger-ui.html
     或者直接在SecurityFilterChain里修改安全匹配器：

// 替换原securityMatcher部分
.securityMatcher(new NegatedServerWebExchangeMatcher(ServerWebExchangeMatchers.pathMatchers(
        securityProperties.getIgnoredPaths(),
        "/v3/api-docs/**",
        "/swagger-ui/**",
        "/swagger-ui.html"
)))

问题2：CSRF校验一直失败 #

问题根源 #

仅设置springdoc.swagger-ui.csrf.enabled=true不够，Spring WebFlux的CSRF需要正确配置令牌存储方式，让Swagger UI能拿到并携带CSRF令牌，而且你的Security配置里在启用安全时没开启CSRF配置。

解决步骤 #

修改Security配置，启用CSRF并使用Cookie存储令牌（允许前端访问）：

@Bean
public SecurityWebFilterChain securityFilterChain(ServerHttpSecurity security) {
    if (securityProperties.isEnabled()) {
        return security
                .securityMatcher(new NegatedServerWebExchangeMatcher(ServerWebExchangeMatchers.pathMatchers(
                        securityProperties.getIgnoredPaths(),
                        "/v3/api-docs/**",
                        "/swagger-ui/**",
                        "/swagger-ui.html"
                )))
                .exceptionHandling()
                .accessDeniedHandler(accessDeniedHandler)
                .authenticationEntryPoint(entryPoint)
                .and()
                .cors()
                .and()
                .csrf(csrf -> csrf
                        .csrfTokenRepository(CookieServerCsrfTokenRepository.withHttpOnlyFalse())
                )
                .authorizeExchange(spec -> spec.anyExchange().authenticated())
                .oauth2ResourceServer(ServerHttpSecurity.OAuth2ResourceServerSpec::jwt)
                .build();
    }
    return security
            .securityMatcher(new PathPatternParserServerWebExchangeMatcher("/**"))
            .authorizeExchange(spec -> spec.anyExchange().permitAll())
            .csrf()
            .disable()
            .build();
}

同时保持配置文件里的设置：

springdoc.swagger-ui.csrf.enabled=true

这样Swagger UI会自动从Cookie读取XSRF-TOKEN，并在请求时带上X-XSRF-TOKEN请求头，就能通过CSRF校验了。

内容的提问来源于stack exchange，提问作者vkourt