如何使用OAuth2保护不同Spring Boot REST API？求最佳实现方案

Great question! Securing Spring Boot REST APIs with an OAuth2 Authorization Server is a common (and smart) requirement, and there's a clean, production-ready approach using Spring's official OAuth2 stack. Let me break down the optimal solution step by step, focusing on best practices and maintainable code.

First, use Spring Authorization Server—this is the official, maintained replacement for the old Spring Security OAuth project. It integrates seamlessly with Spring Boot and Spring Security, giving you full control over token issuance, client management, and authentication flows.

We'll set up two core components:

• Authorization Server: Handles token issuance, client validation, and user authentication.
• Resource Server: Your REST API that validates incoming tokens and enforces access controls.

2.1 Add Required Dependencies #

For Maven, add these to your pom.xml:

<dependencies>
    <!-- Spring Boot Web -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <!-- Spring Security -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <!-- OAuth2 Authorization Server -->
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-oauth2-authorization-server</artifactId>
        <version>1.2.3</version> <!-- Use the latest stable version -->
    </dependency>
</dependencies>

Adjust accordingly for Gradle in your build.gradle file.

2.2 Configure the Authorization Server #

Create a configuration class to set up the authorization server, client registrations, and security filters:

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.oauth2.core.AuthorizationGrantType;
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
import org.springframework.security.oauth2.core.oidc.OidcScopes;
import org.springframework.security.oauth2.server.authorization.client.InMemoryRegisteredClientRepository;
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration;
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;

@Configuration
@EnableWebSecurity
public class AuthorizationServerConfig {

    @Bean
    public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
        http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
                .oidc(oidc -> oidc.userInfoEndpoint(userInfo -> userInfo.userDetailsService(userDetailsService()))); // Enable OIDC if needed

        http.exceptionHandling(exceptions -> exceptions
                .authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/login")));

        return http.build();
    }

    @Bean
    public RegisteredClientRepository registeredClientRepository() {
        RegisteredClient apiClient = RegisteredClient.withId("api-client-id")
                .clientId("api-client")
                .clientSecret("{noop}api-client-secret") // Replace with BCrypt in production!
                .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
                .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
                .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
                .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
                .redirectUri("http://localhost:8080/login/oauth2/code/api-client")
                .scope(OidcScopes.OPENID)
                .scope("api:read")
                .scope("api:write")
                .build();

        return new InMemoryRegisteredClientRepository(apiClient);
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withUsername("user")
                .password("{noop}password") // Replace with BCrypt in production!
                .roles("USER")
                .build();

        return new InMemoryUserDetailsManager(user);
    }
}

Note: In production, replace in-memory stores with a database (e.g., JdbcRegisteredClientRepository, JdbcUserDetailsManager) and use strong password encoding like BCrypt.

2.3 Secure Your REST API (Resource Server) #

Create another configuration class to protect your API endpoints:

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class ResourceServerConfig {

    @Bean
    public SecurityFilterChain resourceServerSecurityFilterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests(authorize -> authorize
                        .requestMatchers("/public/**").permitAll() // Public, unprotected endpoints
                        .anyRequest().authenticated()
                )
                .oauth2ResourceServer(oauth2 -> oauth2
                        .jwt(jwt -> jwt
                                .jwtAuthenticationConverter(jwtAuthenticationConverter())
                        )
                );

        return http.build();
    }

    private JwtAuthenticationConverter jwtAuthenticationConverter() {
        JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
        grantedAuthoritiesConverter.setAuthorityPrefix("ROLE_"); // Adjust based on your token claim setup
        grantedAuthoritiesConverter.setAuthoritiesClaimName("roles");

        JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
        jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(grantedAuthoritiesConverter);
        return jwtAuthenticationConverter;
    }
}

2.4 Test the Flow #

Get an Access Token (Client Credentials Grant) #

Use curl to request a token for server-to-server communication:

curl --location --request POST 'http://localhost:8080/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic YXBpLWNsaWVudDphcGktY2xpZW50LXNlY3JldA==' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'scope=api:read'

You'll get a response like:

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3599,
  "scope": "api:read"
}

Access a Protected API #

Use the access token to call your secured endpoint:

curl --location --request GET 'http://localhost:8080/api/protected' \
--header 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...'

• Enforce HTTPS: Never use HTTP in production—all token exchanges and API calls must be encrypted to prevent interception.
• Secure Secrets: Store client secrets and user passwords in a vault (e.g., HashiCorp Vault) or encrypted database, never in code or plaintext config files.
• Token Expiry: Set short-lived access tokens (e.g., 15 minutes) and longer refresh tokens (e.g., 7 days) to minimize risk if tokens are compromised.
• Granular Scope Control: Use scopes like api:read, api:write, user:manage to restrict access to specific API endpoints based on client needs.
• Refresh Token Rotation: Configure the authorization server to issue new refresh tokens each time a token is refreshed, invalidating the old one to limit misuse.
• Monitor & Log: Track token issuance, validation failures, and unauthorized access attempts to detect suspicious activity early.

Pick the grant type that fits your use case:

• Client Credentials: Perfect for server-to-server communication (no user involved).
• Authorization Code with PKCE: Best for front-end (React/Vue) or mobile apps—PKCE prevents authorization code interception.
• Refresh Token: Use to get new access tokens without requiring users to re-authenticate.
• Password Grant: Avoid this unless it's an internal, highly trusted app—Authorization Code is far more secure.

Hope this gives you a solid, production-ready foundation! If you need help with specific edge cases (like integrating a database for clients, adding custom token claims, or configuring PKCE), feel free to ask follow-up questions.

内容的提问来源于stack exchange，提问作者Mushtaq hussain