NimbusReactiveJwtDecoder使用lb://负载均衡URL无法解析主机如何解决

数据老陈

2026-10-6

问题根因

默认实例化的NimbusReactiveJwtDecoder使用的是未集成Spring Cloud LoadBalancer的普通WebClient，无法识别lb://前缀的服务发现地址，只会尝试通过DNS解析主机名app-auth，自然会抛出UnknownHostException异常。

实现方案

完全支持负载均衡格式的URL获取JWK，只需做如下调整：

首先确保项目已正确引入Spring Cloud LoadBalancer依赖，且服务发现功能正常，app-auth服务已在注册中心正常注册
声明带负载均衡能力的WebClient Builder Bean
实例化NimbusReactiveJwtDecoder时传入上述WebClient实例

修改后完整配置代码

@EnableWebFluxSecurity
class SecurityConfig {

    private val jwkUrl = "lb://app-auth/auth/realms/app/protocol/openid-connect/certs"

    // 声明带负载均衡能力的WebClient构造器
    @Bean
    @LoadBalanced
    fun webClientBuilder(): WebClient.Builder {
        return WebClient.builder()
    }

    @Bean
    fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain? {
        http.csrf().disable()
            .cors().and()
            .authorizeExchange()
            .pathMatchers(HttpMethod.OPTIONS, "/**").permitAll()
            .pathMatchers("/**").hasAuthority("SCOPE_trust")
            .anyExchange().authenticated()
            .and()
            .oauth2ResourceServer()
            .jwt()
            .jwtAuthenticationConverter(AuthenticationConverter())
        return http.build()
    }

    @Bean
    fun reactiveJwtDecoder(webClientBuilder: WebClient.Builder): ReactiveJwtDecoder? {
        // 传入带负载均衡能力的WebClient
        return NimbusReactiveJwtDecoder.withJwkSetUri(jwkUrl)
            .webClient(webClientBuilder.build())
            .build()
    }
}