Nginx Ingress导致Keycloak登录跳转及invalid token specified错误排查

问题根因 #

你遇到的token失效报错核心是Nginx Ingress默认未完整透传OAuth2认证所需的请求头、CORS规则不满足带认证信息的跨域请求要求，部分场景下还可能因为JWT token过长被Nginx截断。

需要补充的Ingress配置项 #

你需要在现有Ingress的annotations字段中新增以下配置：

• 跨域规则补充：允许携带认证凭证、放行Authorization请求头
• 透传原生请求头：将前端携带的Authorization头、原请求协议/域名/端口完整透传给后端Spring服务，避免Keycloak token issuer校验失败
• 调大请求头缓冲区：避免过长的JWT token被Nginx默认缓冲区截断

修改后的完整Ingress配置示例 #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: main-ingress-prd
  namespace: default
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/use-regex: "true"
    # 原有CORS配置保留
    nginx.ingress.kubernetes.io/enable-cors: "true"
    nginx.ingress.kubernetes.io/cors-allow-origin: "https://auth.xxxxx.com, https://001.xxxxxx.com, http://localhost:4200"
    # 新增CORS补充配置
    nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
    nginx.ingress.kubernetes.io/cors-allow-methods: "GET, PUT, POST, DELETE, PATCH, OPTIONS"
    nginx.ingress.kubernetes.io/cors-allow-headers: "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization"
    # 透传认证与转发头
    nginx.ingress.kubernetes.io/proxy-set-header: |
      Authorization $http_authorization;
      X-Forwarded-Proto $scheme;
      X-Forwarded-Host $host;
      X-Forwarded-Port $server_port;
    # 调大请求头缓冲区，避免JWT过长被截断
    nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
spec:
  tls:
  - hosts:
    - mainservice.xxxxxxx.com
    secretName: mainservice-com-06-01-2021
  rules:
  - host: mainservice.xxxxxxx.com
    http:
      paths:
        - path: /*
          pathType: Prefix
          backend:
            service:
              name: main-service-prd
              port:
                number: 80

可选排查项 #

如果修改配置后问题仍存在，可在Spring Webflux服务中新增日志打印请求的Authorization头值，确认后端是否能完整拿到前端传递的Bearer token，同时确认Spring Security OAuth2配置中Keycloak的issuer uri和前端使用的公网Keycloak地址完全一致。

内容的提问来源于stack exchange，提问作者vv01