Spring Boot resource server使用HTTP POST而不是HTTP GET验证令牌

Question

null

属性包含：

spring:
  security:
    oauth2:
      resource:
        token-info-uri: https://token-validation-url/example

当我执行requestcurl-h“authorization：xyz”HTTP://localhost:8080/my-endpoint时，我会得到401，但我看不到对令牌验证的HTTP调用会被执行。

如果我从属性中删除spring前缀，我仍然得到401，但它尝试HTTP POST到https://token-validation-url/example:

security:
  oauth2:
    resource:
      token-info-uri: https://token-validation-url/example

Answer 1

注意到HTTP POST https://token-validation-url/example？otoken=xyz验证与GET相同：

security:
  oauth2:
    resource:
      token-info-uri: https://token-validation-url/example

只需设置令牌名称：

@SpringBootApplication
public class ExampleApplication {

    public static void main(String[] args) {
        ConfigurableApplicationContext context = SpringApplication.run(ExampleApplication.class, args);
        RemoteTokenServices remoteTokenServices = context.getBean(RemoteTokenServices.class);
        remoteTokenServices.setTokenName("otoken");
    }
}

配置RemoteTokenServices的其他方法：在Spring Security Oauth2中使用RemoteTokenServices配置资源服务器