OAUTH2 Spring Security问题：访问UI端点直接进安全URI返回anonymousUser

Hey there, let's dig into why your OAuth2 authentication flow isn't behaving as expected—specifically why accessing http://localhost:8082/ui isn't redirecting to your auth server and why /secure is returning anonymousUser. Here are the key areas to check first:

1. Verify Client-Side Security Rules #

The most likely culprit is that your /ui endpoint isn't configured to require authentication. If Spring Security allows anonymous access to /ui, it won't trigger the OAuth2 redirect flow at all.

Check your SecurityFilterChain configuration—make sure it explicitly enforces authentication for /ui and /secure:

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/ui").authenticated() // This line triggers the redirect
            .requestMatchers("/secure").authenticated() // Ensures /secure blocks anonymous users
            .anyRequest().permitAll()
        )
        .oauth2Login(oauth2 -> oauth2
            .loginPage("/oauth2/authorization/your-client-id") // Ties to your auth server flow
        );
    return http.build();
}

2. Double-Check OAuth2 Client Configuration #

Ensure your application's properties (application.yml/application.properties) have the correct OAuth2 client settings linked to your auth server:

spring:
  security:
    oauth2:
      client:
        registration:
          your-client-id:
            client-id: your-client-id
            client-secret: your-client-secret
            authorization-grant-type: authorization_code
            redirect-uri: "http://localhost:8082/login/oauth2/code/your-client-id"
            scope: openid, profile # Match scopes allowed by your auth server
        provider:
          your-client-id:
            authorization-uri: http://localhost:8081/auth/login # Confirm this is your auth server's valid authorization endpoint
            token-uri: http://localhost:8081/oauth2/token
            user-info-uri: http://localhost:8081/oauth2/userinfo
            user-name-attribute: name

• Confirm authorization-grant-type is set to authorization_code (required for the redirect-based login flow).
• The redirect-uri must exactly match what's configured in your auth server for this client—mismatches can break the flow silently.

3. Validate /secure Endpoint Protection #

If /secure is returning anonymousUser, it means the endpoint isn't enforcing authentication. Double-check your SecurityFilterChain to ensure /secure is marked as .authenticated() (as shown in the first code snippet). If it's set to .permitAll(), anonymous users will be allowed unrestricted access.

4. Test Auth Server Reachability & Session State #

• Try directly accessing http://localhost:8081/auth/login to confirm your auth server's login page is functional. If it's unreachable, your client can't redirect to it.
• Clear your browser's cookies/cache or test in incognito mode—stale anonymous sessions can sometimes bypass the redirect flow unexpectedly.

If you share your specific client-side Security configuration, full application properties, and any relevant auth server settings, we can narrow this down even further!

内容的提问来源于stack exchange，提问作者Mohit Darmwal