springdoc/Swagger UI未将OAuth2令牌传递给API

Question

我正在使用springdoc（v1.5.9）为API生成虚张声势定义。在Swagger UI内部进行身份验证并执行安全方法后，Spring Boot应用程序接收到的http请求没有身份验证头。我已经通过JS调试器确认Swagger UI接收并存储了有效的身份验证令牌。

下面是HTTP请求、显示定义/应用于该方法的安全方案的Swagger api-docs、springdoc配置和控制器。

我需要如何更改/添加我的Spring配置，才能从Swagger UI将授权传递给API？

收到HTTP请求

Request received for GET '/foo/1234':
org.apache.catalina.connector.RequestFacade@71c70030

servletPath:/foo/1234
pathInfo:null
headers: 
host: localhost:8070
connection: keep-alive
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Google Chrome";v="92"
accept: application/json
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: http://localhost:8070/swagger-ui/index.html?configUrl=/v3/api-docs/swagger-config
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: JSESSIONID=A0F9846102153C06D77D6ED5506CC227
Security filter chain: [
  WebAsyncManagerIntegrationFilter
  SecurityContextPersistenceFilter
  HeaderWriterFilter
  CsrfFilter
  LogoutFilter
  BearerTokenAuthenticationFilter
  RequestCacheAwareFilter
  SecurityContextHolderAwareRequestFilter
  AnonymousAuthenticationFilter
  SessionManagementFilter
  ExceptionTranslationFilter
  FilterSecurityInterceptor
]

api文档

{
    "openapi": "3.0.1",
    "info": {
        "title": "My App",
        "version": "v1"
    },
    "servers": [
        {
            "url": "http://localhost:8070",
            "description": "Generated server url"
        }
    ],
    "paths": {
        "/foo/{id}": {
            "get": {
                "tags": [
                    "foo"
                ],
                "parameters": [
                    {
                        "name": "id",
                        "in": "path",
                        "required": true,
                        "schema": {
                            "type": "string"
                        }
                    }
                ],
                "responses": {
                },
                "security": [
                    {
                        "custom": [
                        ]
                    }
                ]
            }
        },
        "securitySchemes": {
            "access_token": {
                "type": "oauth2",
                "in": "header",
                "scheme": "custom",
                "flows": {
                    "authorizationCode": {
                        "authorizationUrl": "https://login.myauthsever.com/v2/oauth/authorize",
                        "tokenUrl": "https://login.myauthsever.com/v2/oauth/token",
                        "scopes": {
                        }
                    }
                }
            }
        }
    }
}

OpenAPI配置

@OpenAPIDefinition(info = @Info(title = "My App", version = "v1"))
@SecurityScheme(scheme = "custom", type = SecuritySchemeType.OAUTH2, in = SecuritySchemeIn.HEADER, name = "access_token",
        flows = @OAuthFlows(authorizationCode = @OAuthFlow(
                authorizationUrl = "https://login.myauthsever.com/v2/oauth/authorize",
                tokenUrl = "https://login.myauthsever.com/v2/oauth/token", scopes = {})))

public class OpenApiConfig {
}

控制器

@RestController
@Tag(name = "foo")
@SecurityRequirement(name = "custom")
public class SystemSigController {
        @GetMapping(path = "/foo/{id}")
        String getFoo(@PathVariable String id) {
            ...
        }
}

Answer 1

@SecurityRequirement.name值必须与@SecurityScheme.name相同。

因为您有@SecurityScheme（…，name=“access\u token”…） ，控制器必须使用：

@SecurityRequirement(name = "access_token")