springboot2集成oauth2坑一（Possible CSRF detected - state parameter was required but no state could ）

深藏阁楼爱情的钟 2022-03-21 12:44 247阅读 0赞

> 码云地址：[https://gitee.com/lpxs/lp-springcloud.git][https_gitee.com_lpxs_lp-springcloud.git]  
> 有问题可以多沟通：136358344@qq.com。

刚开始用springboot1.5集成oauth2没问题，现在升级成springboot2.1踩了不少坑，下面列举下：

#### 问题一 ####

Possible CSRF detected - state parameter was required but no state could be found

客户端代码

@EnableOAuth2Sso
    @Configuration
    public class UiSecurityConfig extends WebSecurityConfigurerAdapter {
    
        @Override
        public void configure(HttpSecurity http) throws Exception {
            http.antMatcher("/**")
                    .authorizeRequests()
                    .antMatchers("/", "/login**")
                    .permitAll()
                    .anyRequest()
                    .authenticated();
        }
    
    }

在获取到code后一直停留在登陆页面上  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xwMTk4NjExMjY_size_16_color_FFFFFF_t_70]  
在网上找了下有以下方案：  
1、配置server.servlet.session.cookie.name=UPSESSIONID  
但是这个试了没效果  
2、设置code策略authCodeProvider.setStateMandatory(false);  
这里改动了很多代码

@Configuration
    @EnableOAuth2Client
    @EnableGlobalMethodSecurity(prePostEnabled=true)//开启@PreAuthorize注解
    public class SecurityConfig extends WebSecurityConfigurerAdapter {
        @Autowired
        private OAuth2ClientContext oauth2ClientContext;
        @Override
        protected void configure(HttpSecurity http) throws Exception {
    //        // @formatter:off
            http.authorizeRequests()
                    .anyRequest().authenticated().and()
                    .formLogin().loginPage("/login").permitAll().and()
                    .exceptionHandling().and()
                    .logout().logoutSuccessUrl("/login").permitAll()
                    .and().headers().frameOptions().sameOrigin()
                    .and().csrf()
                    .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()).and()
                    .addFilterBefore(ssoFilter(), BasicAuthenticationFilter.class);//这里需要配置在basic前
        }
        @Bean
        public FilterRegistrationBean oauth2ClientFilterRegistration(OAuth2ClientContextFilter filter) {
            FilterRegistrationBean registration = new FilterRegistrationBean();
            registration.setFilter(filter);
            registration.setOrder(-100);
            return registration;
        }
    
        @Bean
        @ConfigurationProperties("security.oauth2")
        public ClientResources trina() {
            return new ClientResources();
        }
    
        private Filter ssoFilter() {
            CompositeFilter filter = new CompositeFilter();
            List<Filter> filters = new ArrayList<Filter>();
            filters.add(ssoFilter(trina(), "/login"));
            filter.setFilters(filters);
            return filter;
        }
        private Filter ssoFilter(ClientResources client, String path) {
            OAuth2ClientAuthenticationProcessingFilter oAuth2ClientAuthenticationFilter = new OAuth2ClientAuthenticationProcessingFilter(
                    path);
            OAuth2RestTemplate oAuth2RestTemplate = new OAuth2RestTemplate(client.getClient(), this.oauth2ClientContext);
            oAuth2ClientAuthenticationFilter.setRestTemplate(oAuth2RestTemplate);
            AuthorizationCodeAccessTokenProvider authCodeProvider = new AuthorizationCodeAccessTokenProvider();
            authCodeProvider.setStateMandatory(false);
            AccessTokenProviderChain provider = new AccessTokenProviderChain(
                    Arrays.asList(authCodeProvider));
            oAuth2RestTemplate.setAccessTokenProvider(provider);
            UserInfoTokenServices tokenServices = new UserInfoTokenServices(client.getResource().getUserInfoUri(),
                    client.getClient().getClientId());
            tokenServices.setRestTemplate(oAuth2RestTemplate);
            oAuth2ClientAuthenticationFilter.setTokenServices(tokenServices);
            return oAuth2ClientAuthenticationFilter;
        }
    
    }
    
    class ClientResources {
    
        @NestedConfigurationProperty
        private AuthorizationCodeResourceDetails client = new AuthorizationCodeResourceDetails();
    
        @NestedConfigurationProperty
        private ResourceServerProperties resource = new ResourceServerProperties();
    
        public AuthorizationCodeResourceDetails getClient() {
            return client;
        }
    
        public ResourceServerProperties getResource() {
            return resource;
        }
    }

修改后访问呢连接，登陆后成功跳转到指定页面。

[https_gitee.com_lpxs_lp-springcloud.git]: https://gitee.com/lpxs/lp-springcloud.git
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xwMTk4NjExMjY_size_16_color_FFFFFF_t_70]: /images/20220321/a247120f30e746dc9b4221d2e8e5f6f3.png