Spring Cloud Zuul API网关不转发无状态会话的JWT令牌

Question

@SpringBootApplicatio
@EnableEurekaClient
@EnableZuulProxy
public class GatewayApplication {

    public static void main(String[] args) {
         SpringApplication.run(GatewayApplication.class, args);
    }
}

@Configuration
@EnableWebSecurity
@Order(ManagementServerProperties.ACCESS_OVERRIDE_ORDER)
@EnableOAuth2Sso
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {

        // @formatter:off
        http
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
                .authorizeRequests()
                    .antMatchers("/sign-up", "/login")
                        .permitAll()
                .anyRequest()
                    .authenticated()
            .and()
                .csrf()
                    .ignoringAntMatchers("/sign-up", "/login")
                    .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
        // @formatter:on
    }
}

   // Spring OAuth2 security
    compile("org.springframework.boot:spring-boot-starter-security")
    compile("org.springframework.security.oauth:spring-security-oauth2")
    compile("org.springframework.cloud:spring-cloud-starter-oauth2")
    compile("org.springframework.security:spring-security-jwt")

Zuul路线

zuul:
  ignoredServices: '*'
  routes:
    user-service:
      path: /user-service/**
      stripPrefix: false
      serviceId: user-webservice
      sensitiveHeaders:
    task-service:
      path: /task-service/**
      stripPrefix: false
      serviceId: task-webservice
      sensitiveHeaders:
    user:
      path: /userauth/**
      stripPrefix: false
      serviceId: auth-server
      sensitiveHeaders:

我能够从授权服务器获得访问令牌（无状态会话-没有JSESSIONID cookie）

curl-d---请求后-u acme：acmesecret“http://localhost:8899/userauth/oauth/token？grant_type=password&username=<...>&password=<...>”

[{“firstname”：“anil”.....}]

然而，对于通过API网关路由的相同请求，它在网关本身失败，并被过滤为AnonymousAuthenticationToken。

curl-d---request get-h“授权：承载EYJHBGCIOIJSUZI1....”http://localhost:8765/user-service/

但是我正在努力使它与无状态会话一起工作，有没有任何指针在Zuul API网关端可能缺少什么？

Answer 1

Zuul默认情况下将授权头视为敏感头，不将其传递给下游请求。要重写此功能，您可以全局修改Zuul配置中的sensitiveheaders:

zuul:
  # exclude Authorization from sensitive headers
  sensitiveHeaders: Cookie,Set-Cookie
  ignoredServices: '*'

或特定路由：

zuul:
  ignoredServices: '*'
  routes:
    user-service:
      path: /user-service/**
      stripPrefix: false
      serviceId: user-webservice
      # exclude Authorization from sensitive headers
      sensitiveHeaders: Cookie,Set-Cookie

要查找有关该问题的详细信息,请检查以下问题：