Spring Cloud Gateway Oauth2Login在成功登录时返回JWT令牌而不是会话Cookie

Question

如果之前有人问过这个问题，我很抱歉，但我一直无法找到答案。

我试图设置Spring Cloud Gateway作为OAuth2客户机，通过Keycloak身份验证服务器对用户进行身份验证/登录。我可以使用下面的代码片段来实现这一点：

安全配置：

@Configuration
@EnableWebFluxSecurity
@EnableReactiveMethodSecurity
public class SecurityConfig {
    
    private final GatewayAuthenticationSuccessHandler gatewayAuthenticationSuccessHandler;
    
    public SecurityConfig(GatewayAuthenticationSuccessHandler gatewayAuthenticationSuccessHandler) {
        this.gatewayAuthenticationSuccessHandler = gatewayAuthenticationSuccessHandler;
    }
    
    @Bean
    public SecurityWebFilterChain securityWebFilterChain(
            ServerHttpSecurity http, 
            ReactiveClientRegistrationRepository clientRegistrationRepository) {
        
        http
            .authorizeExchange()
            .pathMatchers("/ui/**").permitAll()
            .anyExchange().authenticated()
                .and()
            .oauth2Login().authenticationSuccessHandler(gatewayAuthenticationSuccessHandler)
                .and()
            .oauth2ResourceServer().jwt();
          
        http.logout(
                logout ->
                    logout.logoutSuccessHandler(
                        new OidcClientInitiatedServerLogoutSuccessHandler(clientRegistrationRepository)));
        http.logout().logoutUrl("/logout");
              
        http.csrf().disable();
        http.httpBasic().disable();
        http.formLogin().disable();

        return http.build();
    }
    
}

@Component
public class GatewayAuthenticationSuccessHandler implements ServerAuthenticationSuccessHandler {
    
    private ServerRedirectStrategy redirectStrategy = new DefaultServerRedirectStrategy();
    
    @Value("${my.frontend_url}")
    private String DEFAULT_LOGIN_SUCCESS_URL;
      
    @Override
    public Mono<Void> onAuthenticationSuccess(WebFilterExchange webFilterExchange, Authentication authentication) {
        URI url = URI.create(DEFAULT_LOGIN_SUCCESS_URL); 
        return this.redirectStrategy.sendRedirect(webFilterExchange.getExchange(), url);
    }

}

我使用的是spring boot版本2.2.8和spring cloud版本hoxton.sr6

Answer 1

不确定这是否有帮助，但尝试将SessionPolicy作为无状态添加到webfilter链中，如下所示，它应该会起作用。

http.SessionManagement（）.SessionCreationPolicy（SessionCreationPolicy.Stateless）

另外，如果将配置类扩展为WebSecurityConfigurerAdapter，可以尝试使用NullAuthenticatedSessionStrategy重写sessionAuthenticationStrategy。

override fun sessionAuthenticationStrategy(): SessionAuthenticationStrategy {
    return NullAuthenticatedSessionStrategy()
}