Spring security 5.0：spring security savedrequest 为空

Question

我有一个 Spring Boot 客户端应用程序，我在其中使用 spring-boot-starter-oauth2-client 和 spring-boot-starter-security。同一个应用程序在一个环境中运行良好，但是在另一个环境中部署后，我可以看到 spring security 保存的请求为空，这就是它不断重定向到登录页面的原因。

启用 spring security debug log 后，我可以看到认证成功并检索到用户详细信息。但是，它一直重定向到“/”，因为 spring security 保存的请求为空。

我不知道问题出在哪里，为什么它能够在一个环境中而不是在另一个环境中保存请求。我应该从哪里开始寻找？任何帮助将不胜感激。

应用程序未重定向的调试日志

{"timestamp":"2021-05-12T17:24:40.918+10:00","app":"my-protected-application","logLevel":"INFO","thread":"http-nio-8080-exec-1","eventSource":"org.apache.catalina.core.ContainerBase.[Tomcat].[localhost].[/]","message":"Initializing Spring DispatcherServlet 'dispatcherServlet'"}
{"timestamp":"2021-05-12T17:24:41.104+10:00","app":"my-protected-application","traceId":"2efe5d4e6d04f787","spanId":"2efe5d4e6d04f787","logLevel":"DEBUG","thread":"http-nio-8080-exec-1","eventSource":"org.springframework.security.web.util.matcher.AntPathRequestMatcher","message":"Checking match of request : '/actuator/health/readiness'; against '/actuator/info'"}
{"timestamp":"2021-05-12T17:24:41.112+10:00","app":"my-protected-application","traceId":"2efe5d4e6d04f787","spanId":"2efe5d4e6d04f787","logLevel":"DEBUG","thread":"http-nio-8080-exec-1","eventSource":"org.springframework.security.web.util.matcher.AntPathRequestMatcher","message":"Checking match of request : '/actuator/health/readiness'; against '/actuator/health/readiness'"}
{"timestamp":"2021-05-12T17:24:41.112+10:00","app":"my-protected-application","traceId":"2efe5d4e6d04f787","spanId":"2efe5d4e6d04f787","logLevel":"DEBUG","thread":"http-nio-8080-exec-1","eventSource":"org.springframework.security.web.FilterChainProxy","message":"/actuator/health/readiness has an empty filter list"}
{"timestamp":"2021-05-12T17:24:55.666+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.util.matcher.AntPathRequestMatcher","message":"Checking match of request : '/oauth2/authorization/my-protected-application'; against '/actuator/info'"}
{"timestamp":"2021-05-12T17:24:55.666+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.util.matcher.AntPathRequestMatcher","message":"Checking match of request : '/oauth2/authorization/my-protected-application'; against '/actuator/health/readiness'"}
{"timestamp":"2021-05-12T17:24:55.666+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.util.matcher.AntPathRequestMatcher","message":"Checking match of request : '/oauth2/authorization/my-protected-application'; against '/actuator/health/liveness'"}
{"timestamp":"2021-05-12T17:24:55.668+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.FilterChainProxy","message":"/oauth2/authorization/my-protected-application at position 1 of 14 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'"}
{"timestamp":"2021-05-12T17:24:55.670+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.FilterChainProxy","message":"/oauth2/authorization/my-protected-application at position 2 of 14 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'"}
{"timestamp":"2021-05-12T17:24:55.670+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.context.HttpSessionSecurityContextRepository","message":"No HttpSession currently exists"}
{"timestamp":"2021-05-12T17:24:55.670+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.context.HttpSessionSecurityContextRepository","message":"No SecurityContext was available from the HttpSession: null. A new one will be created."}
{"timestamp":"2021-05-12T17:24:55.673+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.FilterChainProxy","message":"/oauth2/authorization/my-protected-application at position 3 of 14 in additional filter chain; firing Filter: 'HeaderWriterFilter'"}
{"timestamp":"2021-05-12T17:24:55.674+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.FilterChainProxy","message":"/oauth2/authorization/my-protected-application at position 4 of 14 in additional filter chain; firing Filter: 'LogoutFilter'"}
{"timestamp":"2021-05-12T17:24:55.674+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.util.matcher.OrRequestMatcher","message":"Trying to match using Ant [pattern='/logout', GET]"}
{"timestamp":"2021-05-12T17:24:55.675+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.util.matcher.AntPathRequestMatcher","message":"Checking match of request : '/oauth2/authorization/my-protected-application'; against '/logout'"}
{"timestamp":"2021-05-12T17:24:55.675+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.util.matcher.OrRequestMatcher","message":"Trying to match using Ant [pattern='/logout', POST]"}
{"timestamp":"2021-05-12T17:24:55.675+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.util.matcher.AntPathRequestMatcher","message":"Request 'GET /oauth2/authorization/my-protected-application' doesn't match 'POST /logout'"}
{"timestamp":"2021-05-12T17:24:55.675+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.util.matcher.OrRequestMatcher","message":"Trying to match using Ant [pattern='/logout', PUT]"}
{"timestamp":"2021-05-12T17:24:55.675+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.util.matcher.AntPathRequestMatcher","message":"Request 'GET /oauth2/authorization/my-protected-application' doesn't match 'PUT /logout'"}
{"timestamp":"2021-05-12T17:24:55.675+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.util.matcher.OrRequestMatcher","message":"Trying to match using Ant [pattern='/logout', DELETE]"}
{"timestamp":"2021-05-12T17:24:55.675+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.util.matcher.AntPathRequestMatcher","message":"Request 'GET /oauth2/authorization/my-protected-application' doesn't match 'DELETE /logout'"}
{"timestamp":"2021-05-12T17:24:55.675+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.util.matcher.OrRequestMatcher","message":"No matches found"}
{"timestamp":"2021-05-12T17:24:55.676+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.FilterChainProxy","message":"/oauth2/authorization/my-protected-application at position 5 of 14 in additional filter chain; firing Filter: 'OAuth2AuthorizationRequestRedirectFilter'"}
{"timestamp":"2021-05-12T17:24:55.676+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.util.matcher.AntPathRequestMatcher","message":"Checking match of request : '/oauth2/authorization/my-protected-application'; against '/oauth2/authorization/{registrationId}'"}
{"timestamp":"2021-05-12T17:24:55.676+10:00","app":"my-protected-application","traceId":"9681ad4d267d4beb","spanId":"9681ad4d267d4beb","logLevel":"DEBUG","thread":"http-nio-8080-exec-2","eventSource":"org.springframework.security.web.util.matcher.AntPathRequestMatcher","message":"Checking match of request : '/oauth2/authorization/my-protected-application'; against '/oauth2/authorization/{registrationId}'"}

Answer 1

您是否直接调用了登录 URL，而不是尝试通过登录页面登录？

用户请求的请求数据存储在requestCache中。 这里存储的请求数据是savedRequest。 Spring security 在用户认证后重定向 requestCache 和 savedRequest 对象。

SavedRequest必须为null，因为如果不使用登录页面直接使用URL，则上一个请求中没有请求数据。

您可以尝试从登录页面登录或使用Referrer 标头获取页面URL。