为什么 OAuth2AccessTokenSupport 总是发送 POST 请求？？

Question

我正在使用 Spring Boot + Spring Security OAuth2 来使用 Restful Oauth2 服务。

Our Oauth2 service is always expects HTTP GET But OAuth2AccessTokenSupport always sending HTTP POST.

结果：

resulted in 405 (Method Not Allowed); invoking error handler

protected OAuth2AccessToken retrieveToken(AccessTokenRequest request, OAuth2ProtectedResourceDetails resource,
        MultiValueMap<String, String> form, HttpHeaders headers) throws OAuth2AccessDeniedException {
    try {
        this.authenticationHandler.authenticateTokenRequest(resource, form, headers);

        this.tokenRequestEnhancer.enhance(request, resource, form, headers);
        AccessTokenRequest copy = request;

        ResponseExtractor delegate = getResponseExtractor();
        ResponseExtractor extractor = new ResponseExtractor(copy, delegate) {
            public OAuth2AccessToken extractData(ClientHttpResponse response) throws IOException {
                if (response.getHeaders().containsKey("Set-Cookie")) {
                    this.val$copy.setCookie(response.getHeaders().getFirst("Set-Cookie"));
                }
                return ((OAuth2AccessToken) this.val$delegate.extractData(response));
            }
        };
        return ((OAuth2AccessToken) getRestTemplate().execute(getAccessTokenUri(resource, form), getHttpMethod(),
                getRequestCallback(resource, form, headers), extractor, form.toSingleValueMap()));
    } catch (OAuth2Exception oe) {
        throw new OAuth2AccessDeniedException("Access token denied.", resource, oe);
    } catch (RestClientException rce) {
        throw new OAuth2AccessDeniedException("Error requesting access token.", resource, rce);
    }
}

<b>protected HttpMethod getHttpMethod() {
    return HttpMethod.POST;
}</b>

protected String getAccessTokenUri(OAuth2ProtectedResourceDetails resource, MultiValueMap<String, String> form) {
    String accessTokenUri = resource.getAccessTokenUri();

    if (this.logger.isDebugEnabled()) {
        this.logger.debug(new StringBuilder().append("Retrieving token from ").append(accessTokenUri).toString());
    }

    StringBuilder builder = new StringBuilder(accessTokenUri);
    String separator;
    if (getHttpMethod() == HttpMethod.GET) {
        separator = "?";
        if (accessTokenUri.contains("?")) {
            separator = "&";
        }

        for (String key : form.keySet()) {
            builder.append(separator);
            builder.append(new StringBuilder().append(key).append("={").append(key).append("}").toString());
            separator = "&";
        }
    }

    return builder.toString();
}

Can Anyone explain me why OAuth2AccessTokenSupport always returns POST and How to send HTTP GET request

Answer 1

要为令牌端点启用 GET 请求，您需要在 AuthorizationServerConfigurerAdapter 中添加以下内容：

@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
    endpoints.allowedTokenEndpointRequestMethods(HttpMethod.GET, HttpMethod.POST);
}

至于为什么默认只有 POST：我认为这是由于 GET 请求可能会将用户名和密码信息作为请求参数发送（密码授予肯定是这种情况）。这些在 Web 服务器日志中很可能是可见的，而 POST 正文数据则不是。

事实上 OAuth2 的 RFC 声明客户端在请求访问令牌时必须使用 HTTP POST (https://www.rfc-editor.org/rfc/rfc6749#section-3.2)

为什么 OAuth2AccessTokenSupport 总是发送 POST 请求？？

Why OAuth2AccessTokenSupport always send POST request ??

spring-boot

spring-security-oauth2