oauth/token端点受保护无法登录，BCrypt密码编码器异常求助

Hey Stefan, let's work through this OAuth2 token endpoint issue you're facing. That "Full authentication is required" error usually boils down to a mismatch between how your client credentials are stored, encoded, and validated. Here's how to troubleshoot and fix it:

1. Double-Check Client Secret Storage & Encoding #

First, make sure your client's secret is stored as a BCrypt-hashed value, not plaintext. When you register your client (whether in-memory or via a database), you need to pass the encoded version of the secret to the client details service. For example, in an in-memory setup:

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    clients.inMemory()
           .withClient("your-client-id")
           // Encode the secret BEFORE storing it
           .secret(passwordEncoder().encode("your-plaintext-secret"))
           .authorizedGrantTypes("password", "refresh_token")
           .scopes("read", "write");
}

If you're using a database, ensure the client_secret column holds the BCrypt hash, not the raw secret. The server will take the plaintext secret from your request's Basic Auth header, hash it with BCrypt, and compare it to the stored value—so mismatched storage will fail validation.

2. Link Your Password Encoder to OAuth2's Security Config #

Even if you've defined a PasswordEncoder bean, you need to explicitly tell the OAuth2 authorization server to use it for client credential validation. Add this to your AuthorizationServerConfigurerAdapter implementation:

@Override
public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
    // Use your BCrypt encoder for client secret validation
    security.passwordEncoder(passwordEncoder());
    // Allow public access to the token key endpoint (optional but common)
    security.tokenKeyAccess("permitAll()");
    // Restrict check token access to authenticated users
    security.checkTokenAccess("isAuthenticated()");
}

This ensures the OAuth2 layer uses the correct encoder instead of falling back to a default that might not match your setup.

3. Prevent WebSecurity from Intercepting the Token Endpoint #

It sounds like your BasicAuthenticationFilter is picking up the /oauth/token request before the OAuth2 filters can handle it. To fix this, exclude the token endpoint from your general WebSecurity rules:

@Override
public void configure(WebSecurity web) throws Exception {
    // Let OAuth2's own filters handle the token endpoint
    web.ignoring().antMatchers("/oauth/token");
}

This way, the OAuth2 framework's authentication logic (which is designed for client credentials) processes the request, not your regular user-facing Basic Auth filter.

4. Verify Your Request's Authorization Header #

Make sure your request to /oauth/token includes a valid Basic Auth header. The header should be formatted as:

Authorization: Basic [Base64-encoded string of "client-id:plaintext-client-secret"]

Remember: you send the plaintext secret here—the server will hash it with BCrypt and compare it to your stored hash. Sending the hashed secret directly will cause validation to fail.

If you work through these steps, you should resolve the authentication error and get the token endpoint working as expected.

内容的提问来源于stack exchange，提问作者Stefan Falk