能否将Spring Zuul用作‘伪’资源服务器校验OAuth2权限后代理内容？

Absolutely! This is a perfectly valid and common pattern to secure your internal, unprotected APIs by offloading all OAuth2 scope validation to Spring Zuul as your API gateway. Let’s walk through how to implement this step-by-step for your Spring-based stack:

1. Configure Zuul as an OAuth2 Resource Server #

First, you’ll need to set up Zuul to act as both a proxy and a resource server:

• Add the necessary dependencies to your Zuul project: spring-cloud-starter-netflix-zuul for proxy functionality, and spring-boot-starter-oauth2-resource-server to handle OAuth2 token validation.
• Configure your resource server properties (in application.yml or application.properties) to point to your OAuth2 issuer (for JWT tokens) or introspection endpoint (for opaque tokens). For example, for JWT:

  spring:
    security:
      oauth2:
        resourceserver:
          jwt:
            issuer-uri: https://your-auth-server.com/auth/realms/your-realm
  

• Set up a security filter chain to enforce authentication and scope checks for all incoming requests to Zuul’s routes.

2. Implement Scope Validation #

You have two main options to validate scopes:

Option A: Use Spring Security Annotations #

Leverage Spring Security’s built-in authorization to check scopes directly in your security config:

@Configuration
@EnableWebSecurity
public class ZuulSecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                // Require specific scope for your internal API routes
                .antMatchers("/api/internal/**").hasAuthority("SCOPE_internal-api-access")
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt
                    .jwtAuthenticationConverter(jwtAuthenticationConverter())
                )
            );
        return http.build();
    }

    // Ensure scopes are converted to Spring Security authorities with the SCOPE_ prefix
    private JwtAuthenticationConverter jwtAuthenticationConverter() {
        JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
        converter.setJwtGrantedAuthoritiesConverter(jwt -> {
            List<String> scopes = jwt.getClaimAsStringList("scope");
            if (scopes == null) {
                scopes = Collections.emptyList();
            }
            return scopes.stream()
                .map(scope -> new SimpleGrantedAuthority("SCOPE_" + scope))
                .collect(Collectors.toList());
        });
        return converter;
    }
}

Option B: Custom Zuul Filter for Fine-Grained Control #

If you need more flexibility (like dynamic scope checks per route), create a pre-filter that runs before routing:

@Component
public class ScopeValidationFilter extends ZuulFilter {

    @Autowired
    private JwtDecoder jwtDecoder;

    @Override
    public String filterType() {
        return "pre"; // Execute before routing
    }

    @Override
    public int filterOrder() {
        return 1; // Priority: run before Zuul's routing filter
    }

    @Override
    public boolean shouldFilter() {
        // Only apply to your internal API routes
        RequestContext ctx = RequestContext.getCurrentContext();
        String requestPath = ctx.getRequest().getRequestURI();
        return requestPath.startsWith("/api/internal/");
    }

    @Override
    public Object run() throws ZuulException {
        RequestContext ctx = RequestContext.getCurrentContext();
        HttpServletRequest request = ctx.getRequest();
        
        String token = extractBearerToken(request);
        if (token == null) {
            rejectRequest(ctx, HttpStatus.UNAUTHORIZED, "Missing authentication token");
            return null;
        }

        try {
            Jwt jwt = jwtDecoder.decode(token);
            List<String> scopes = jwt.getClaimAsStringList("scope");
            
            // Check if the required scope is present
            if (scopes == null || !scopes.contains("internal-api-access")) {
                rejectRequest(ctx, HttpStatus.FORBIDDEN, "Insufficient scope: requires 'internal-api-access'");
            }
        } catch (JwtException e) {
            rejectRequest(ctx, HttpStatus.UNAUTHORIZED, "Invalid authentication token");
        }
        return null;
    }

    private String extractBearerToken(HttpServletRequest request) {
        String authHeader = request.getHeader("Authorization");
        if (StringUtils.hasText(authHeader) && authHeader.startsWith("Bearer ")) {
            return authHeader.substring(7);
        }
        return null;
    }

    private void rejectRequest(RequestContext ctx, HttpStatus status, String message) {
        ctx.setSendZuulResponse(false);
        ctx.setResponseStatusCode(status.value());
        ctx.setResponseBody(String.format("{\"error\": \"%s\"}", message));
        ctx.getResponse().setContentType(MediaType.APPLICATION_JSON_VALUE);
    }
}

3. Configure Zuul Routes #

Map your internal API endpoints in Zuul’s configuration so requests are routed after validation:

zuul:
  routes:
    internal-api:
      path: /api/internal/**
      url: http://your-internal-service:8080/api/

Key Notes #

• Version Compatibility: Ensure your Spring Cloud Zuul and Spring Boot OAuth2 dependencies are compatible. Zuul 1.x is in maintenance mode, but it works seamlessly with Spring Boot 2.x OAuth2 resource server support.
• Token Type: If using opaque tokens (instead of JWT), replace the JwtDecoder with an OpaqueTokenIntrospector and configure the introspection endpoint in your properties.
• Internal Services: Your backend APIs don’t need any OAuth2 or security configuration—they can focus purely on business logic since all authentication/authorization is handled by Zuul.

内容的提问来源于stack exchange，提问作者Murray