Unable to make the oauth2Login as stateless

Question

I have provided the cookie based authorization request repository to oauth2Login() dsl to make it as stateless. but when I add the session creation policy as STATELESS , the oauth2 login is not working and returning "too many callbacks" error in UI page.

I have used the following oauth2Login config. for login with google oauth2 provider.

    @Autowired
    private HttpCookieOAuth2AuthorizationRequestRepository httpCookieOAuth2AuthorizationRequestRepository;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().csrfTokenRepository(new CookieCsrfTokenRepository())
                .ignoringAntMatchers("/oauth2/authorization/google")
                .and()
                .sessionManagement(sessionMgmtConfig -> sessionMgmtConfig.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .authorizeHttpRequests(authorize -> authorize
                        .anyRequest().authenticated())
                .oauth2Login(oauth2Config -> oauth2Config
                        .authorizationEndpoint(config -> config.authorizationRequestRepository(httpCookieOAuth2AuthorizationRequestRepository))
                        .userInfoEndpoint(config -> config.oidcUserService(oidcUserOAuth2UserService()))
                        .successHandler(authenticationSuccessHandler())
                )
                ;//.logout(logoutConfig -> logoutConfig.addLogoutHandler(logoutHandler()))
    }

    public AuthenticationSuccessHandler authenticationSuccessHandler() {
        SavedRequestAwareAuthenticationSuccessHandler successHandler = new SavedRequestAwareAuthenticationSuccessHandler();
        successHandler.setRequestCache(new CookieRequestCache());

        return successHandler;
    }

If I comment out the session management line, it is working as expected and creating the JSESSION but when not working if I uncomment this part. Am I missing something?

Answer 1

拥有oauth2Login和无状态 sessionManagement并不是那么容易。问题是Spring需要存储有关OAuth 2.0state参数的信息。通常它存储在会话中，但是当你禁用它时，Spring 会变得疯狂（“回调太多”），因为它找不到它。

为了解决这个问题，你可以使用自己的cookie来存储state参数。这可以通过提供 的自定义实现来完成AuthorizationRequestRepository<OAuth2AuthorizationRequest>。

有一篇很好的博客文章更详细地描述了所有内容。

https://www.jessym.com/articles/stateless-oauth2-social-logins-with-spring-boot

OAuth 授权请求中“state”参数的用途是什么