Spring Cloud Zuul API 网关不会为无状态会话转发 JWT 令牌

Question

我正在尝试使用Spring Boot 1.5.6.RELEASE和Spring Cloud Dalston.SR3来实现微服务架构后端，它们将由移动/Web 端点使用。

API网关应用

@SpringBootApplicatio
@EnableEurekaClient
@EnableZuulProxy
public class GatewayApplication {

    public static void main(String[] args) {
         SpringApplication.run(GatewayApplication.class, args);
    }
}

接口安全

@Configuration
@EnableWebSecurity
@Order(ManagementServerProperties.ACCESS_OVERRIDE_ORDER)
@EnableOAuth2Sso
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {

        // @formatter:off
        http
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
                .authorizeRequests()
                    .antMatchers("/sign-up", "/login")
                        .permitAll()
                .anyRequest()
                    .authenticated()
            .and()
                .csrf()
                    .ignoringAntMatchers("/sign-up", "/login")
                    .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
        // @formatter:on
    }
}

Gradle 安全相关的依赖项

   // Spring OAuth2 security
    compile("org.springframework.boot:spring-boot-starter-security")
    compile("org.springframework.security.oauth:spring-security-oauth2")
    compile("org.springframework.cloud:spring-cloud-starter-oauth2")
    compile("org.springframework.security:spring-security-jwt")

祖尔路线

zuul:
  ignoredServices: '*'
  routes:
    user-service:
      path: /user-service/**
      stripPrefix: false
      serviceId: user-webservice
      sensitiveHeaders:
    task-service:
      path: /task-service/**
      stripPrefix: false
      serviceId: task-webservice
      sensitiveHeaders:
    user:
      path: /userauth/**
      stripPrefix: false
      serviceId: auth-server
      sensitiveHeaders:

我能够从授权服务器获取访问令牌（无状态会话 - 没有 JSESSIONID cookie）

curl -D - --request POST -u acme:acmesecret " http://localhost:8899/userauth/oauth/token?grant_type=password&username= <...>&password=<...>"

{ “ACCESS_TOKEN”：“eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1MDQ3ODg4NzgsInVzZXJfbmFtZSI6IjcyMTk2MTk2NDEiLCJhdXRob3JpdGllcyI6WyJST0xFX1BBVElFTlQiXSwianRpIjoiZThhMzBjNmQtZjA2MS00MWEzLWEyZGItYTZiN2ZjYTI5ODk1IiwiY2xpZW50X2lkIjoiYWNtZSIsInNjb3BlIjpbIm9wZW5pZCJdfQ.AhF_kqfsRYM1t1HVT ........

我可以使用访问令牌从授权服务器或其他资源请求数据

curl -D - --request GET -H "Authorization: Bearer eyJhbGciOiJSUzI1 ...." http://localhost:8899/userauth/me

{"authorities":[{"authority":"ROLE_P........}

curl -D - --request GET -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5 ......." http://localhost:8081/user-service/

[{"firstName":"Anil".....}]

但是，对于通过 API 网关路由的相同请求，它在网关本身失败并被过滤为 AnonymousAuthenticationToken。

curl -D - --request GET -H "Authorization: Bearer eyJhbGciOiJSUzI1 ...." http://localhost:8765/user-service/

HTTP/1.1 302 Set-Cookie：XSRF-TOKEN=b5a1c34e-e83c-47ea-86a6-13a237c027d4；路径=/ 位置： http://localhost:8765/login

我假设使用@EnableZuulProxyand @EnableOAuth2Sso，Zuul 会小心地将不记名令牌转发到下游服务，但这并没有发生。我已经有一个工作示例，它使用 HTTP 会话和浏览器重定向来让 API 网关传递令牌 - https://github.com/anilallewar/microservices-basics-spring-boot

但是我正在努力让它与无状态会话一起工作，Zuul API 网关端可能缺少的任何指示？

Answer 1

Zuul 默认将 Authorization 标头视为敏感标头，不会将其传递给下游请求。要覆盖它，您可以sensitiveHeaders全局修改Zuul 配置（对于所有路由）：

zuul:
  # exclude Authorization from sensitive headers
  sensitiveHeaders: Cookie,Set-Cookie
  ignoredServices: '*'

或者对于特定路线：

zuul:
  ignoredServices: '*'
  routes:
    user-service:
      path: /user-service/**
      stripPrefix: false
      serviceId: user-webservice
      # exclude Authorization from sensitive headers
      sensitiveHeaders: Cookie,Set-Cookie

要了解有关该问题的更多信息，请查看以下问题：

从 Brixton.RC1 开始的 ZuulProxy 未通过授权标头