springboot2集成oauth2坑一（Possible CSRF detected

码云地址：https://gitee.com/lpxs/lp-springcloud.git 有问题可以多沟通：136358344@qq.com。

刚开始用springboot1.5集成oauth2没问题，现在升级成springboot2.1踩了不少坑，下面列举下：

问题一

Possible CSRF detected - state parameter was required but no state could be found

客户端代码

1@EnableOAuth2Sso
2@Configuration
3public class UiSecurityConfig extends WebSecurityConfigurerAdapter {
4
5    @Override
6    public void configure(HttpSecurity http) throws Exception {
7        http.antMatcher("/**")
8                .authorizeRequests()
9                .antMatchers("/", "/login**")
10                .permitAll()
11                .anyRequest()
12                .authenticated();
13    }
14
15}

在获取到code后一直停留在登陆页面上 在网上找了下有以下方案： 1、配置server.servlet.session.cookie.name=UPSESSIONID 但是这个试了没效果 2、设置code策略authCodeProvider.setStateMandatory(false); 这里改动了很多代码

1@Configuration
2@EnableOAuth2Client
3@EnableGlobalMethodSecurity(prePostEnabled=true)//开启@PreAuthorize注解
4public class SecurityConfig extends WebSecurityConfigurerAdapter {
5    @Autowired
6    private OAuth2ClientContext oauth2ClientContext;
7    @Override
8    protected void configure(HttpSecurity http) throws Exception {
9//        // @formatter:off
10        http.authorizeRequests()
11                .anyRequest().authenticated().and()
12                .formLogin().loginPage("/login").permitAll().and()
13                .exceptionHandling().and()
14                .logout().logoutSuccessUrl("/login").permitAll()
15                .and().headers().frameOptions().sameOrigin()
16                .and().csrf()
17                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()).and()
18                .addFilterBefore(ssoFilter(), BasicAuthenticationFilter.class);//这里需要配置在basic前
19    }
20    @Bean
21    public FilterRegistrationBean oauth2ClientFilterRegistration(OAuth2ClientContextFilter filter) {
22        FilterRegistrationBean registration = new FilterRegistrationBean();
23        registration.setFilter(filter);
24        registration.setOrder(-100);
25        return registration;
26    }
27
28    @Bean
29    @ConfigurationProperties("security.oauth2")
30    public ClientResources trina() {
31        return new ClientResources();
32    }
33
34    private Filter ssoFilter() {
35        CompositeFilter filter = new CompositeFilter();
36        List<filter> filters = new ArrayList<filter>();
37        filters.add(ssoFilter(trina(), "/login"));
38        filter.setFilters(filters);
39        return filter;
40    }
41    private Filter ssoFilter(ClientResources client, String path) {
42        OAuth2ClientAuthenticationProcessingFilter oAuth2ClientAuthenticationFilter = new OAuth2ClientAuthenticationProcessingFilter(
43                path);
44        OAuth2RestTemplate oAuth2RestTemplate = new OAuth2RestTemplate(client.getClient(), this.oauth2ClientContext);
45        oAuth2ClientAuthenticationFilter.setRestTemplate(oAuth2RestTemplate);
46        AuthorizationCodeAccessTokenProvider authCodeProvider = new AuthorizationCodeAccessTokenProvider();
47        authCodeProvider.setStateMandatory(false);
48        AccessTokenProviderChain provider = new AccessTokenProviderChain(
49                Arrays.asList(authCodeProvider));
50        oAuth2RestTemplate.setAccessTokenProvider(provider);
51        UserInfoTokenServices tokenServices = new UserInfoTokenServices(client.getResource().getUserInfoUri(),
52                client.getClient().getClientId());
53        tokenServices.setRestTemplate(oAuth2RestTemplate);
54        oAuth2ClientAuthenticationFilter.setTokenServices(tokenServices);
55        return oAuth2ClientAuthenticationFilter;
56    }
57
58}
59
60class ClientResources {
61
62    @NestedConfigurationProperty
63    private AuthorizationCodeResourceDetails client = new AuthorizationCodeResourceDetails();
64
65    @NestedConfigurationProperty
66    private ResourceServerProperties resource = new ResourceServerProperties();
67
68    public AuthorizationCodeResourceDetails getClient() {
69        return client;
70    }
71
72    public ResourceServerProperties getResource() {
73        return resource;
74    }
75}

修改后访问呢连接，登陆后成功跳转到指定页面。</filter></filter>