spring-boot - Spring Cloud Zuul API 网关不会为无状态 session 转发 JWT token

Question

我正在尝试使用 实现微服务架构后端Spring Boot 1.5.6.RELEASE 和 Spring Cloud Dalston.SR3 这将被移动/网络端点消耗。

API 网关应用程序

@SpringBootApplicatio
@EnableEurekaClient
@EnableZuulProxy
public class GatewayApplication {

    public static void main(String[] args) {
         SpringApplication.run(GatewayApplication.class, args);
    }
}

API 安全性

@Configuration
@EnableWebSecurity
@Order(ManagementServerProperties.ACCESS_OVERRIDE_ORDER)
@EnableOAuth2Sso
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {

        // @formatter:off
        http
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
                .authorizeRequests()
                    .antMatchers("/sign-up", "/login")
                        .permitAll()
                .anyRequest()
                    .authenticated()
            .and()
                .csrf()
                    .ignoringAntMatchers("/sign-up", "/login")
                    .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
        // @formatter:on
    }
}

Gradle 安全相关依赖项

   // Spring OAuth2 security
    compile("org.springframework.boot:spring-boot-starter-security")
    compile("org.springframework.security.oauth:spring-security-oauth2")
    compile("org.springframework.cloud:spring-cloud-starter-oauth2")
    compile("org.springframework.security:spring-security-jwt")

祖尔路线

zuul:
  ignoredServices: '*'
  routes:
    user-service:
      path: /user-service/**
      stripPrefix: false
      serviceId: user-webservice
      sensitiveHeaders:
    task-service:
      path: /task-service/**
      stripPrefix: false
      serviceId: task-webservice
      sensitiveHeaders:
    user:
      path: /userauth/**
      stripPrefix: false
      serviceId: auth-server
      sensitiveHeaders:

我能够从授权服务器获取访问 token (无状态 session - 没有 JSESSIONID cookie)

curl -D - --request POST -u acme:acmesecret "http://localhost:8899/userauth/oauth/token?grant_type=password&username=<...>&password=<...>"

{"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1MDQ3ODg4NzgsInVzZXJfbmFtZSI6IjcyMTk2MTk2NDEiLCJhdXRob3JpdGllcyI6WyJST0xFX1BBVElFTlQiXSwianRpIjoiZThhMzBjNmQtZjA2MS00MWEzLWEyZGItYTZiN2ZjYTI5ODk1IiwiY2xpZW50X2lkIjoiYWNtZSIsInNjb3BlIjpbIm9wZW5pZCJdfQ.AhF_kqfsRYM1t1HVT........

我可以使用访问 token 从授权服务器或其他资源请求数据

curl -D - --request GET -H "Authorization: Bearer eyJhbGciOiJSUzI1...." http://localhost:8899/userauth/me

{"authorities":[{"authority":"ROLE_P.........}

curl -D - --request GET -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5......." http://localhost:8081/user-service/

[{"firstName":"Anil".....}]

但是，对于通过 API 网关路由的相同请求，它在网关本身失败并被过滤为 AnonymousAuthenticationToken。

curl -D - --request GET -H "Authorization: Bearer eyJhbGciOiJSUzI1...." http://localhost:8765/user-service/

HTTP/1.1 302 Set-Cookie: XSRF-TOKEN=b5a1c34e-e83c-47ea-86a6-13a237c027d4; Path=/ Location: http://localhost:8765/login

我假设 @EnableZuulProxy和 @EnableOAuth2Sso ，Zuul 会小心地将不记名 token 转发给下游服务，但这并没有发生。我已经有一个使用 HTTP session 和浏览器重定向来让 API 网关传递 token 的工作示例 - https://github.com/anilallewar/microservices-basics-spring-boot

但是我正在努力让它与无状态 session 一起工作，Zuul API 网关端可能缺少什么指针？

Answer 1

Zuul 默认将 Authorization header 视为敏感 header ，不会将其传递给下游请求。要覆盖它，您可以修改 sensitiveHeaders在 Zuul 配置中全局(对于所有路由):

zuul:
  # exclude Authorization from sensitive headers
  sensitiveHeaders: Cookie,Set-Cookie
  ignoredServices: '*'

或者对于特定路线:

zuul:
  ignoredServices: '*'
  routes:
    user-service:
      path: /user-service/**
      stripPrefix: false
      serviceId: user-webservice
      # exclude Authorization from sensitive headers
      sensitiveHeaders: Cookie,Set-Cookie

要了解有关该问题的更多信息，请查看以下问题:

Authorization header not passed by ZuulProxy starting with Brixton.RC1