Spring OAuth2客户端未发送授权标头

Question

I have 2 microservices. 1 is a Spring boot 2 project setup as a oauth2 server running on port 8000 and the other is a Spring boot 2 project oauth2 client running on port 8001.

I have the oauth server setup and I can confirm it's working because I get a token when I login using the client id and secret. I use Postman to do a post to /oauth/token and I can see the content. I see the access token and refresh token.

I then use Postman to do a call to the other microservice which is a Spring boot project setup as a oauth2 client. I set the Access Token using Postman as a oauth2 Authorization and I can see that the Authorization: Bearer TOKEN is added to the header. I then do a call to the oauth2 client where I call the following endpoint:

@GetMapping("/api/user/test")
@PreAuthorize("isAuthenticated()")
public MyObject doTest() {
    return new String("Test");
}

When I invoke that url I can determine that spring sends a request to the oauth server to get the current user. In my application.yml I have the following so that spring knows where the oauth server is:

security:
  oauth2:
    resource:
      user-info-uri: http://localhost:8000/oauth/user

So far so good. Now here is the thing. I debug the http://localhost:8000/oauth/user url and according to spring the principal is null. I have found where it is going wrong. Either my configuration is wrong or there is a huge bug in Spring because when I add a filter to the oauth2 server and print all the headers this is what I see:

Header: application/json Header: Java/1.8.0_181 Header: localhost:8000 Header: http Header: 8000 Header: 172.20.0.1 Header: gzip Header: 0 Header: 192.168.178.153:9001 Header: Keep-Alive

As you can see there is no Authorization header. Apparently spring oauth2 client isn't sending the Authorization header when invoking user-info-uri. Can anybody help?

I need to know how to configure my spring boot oauth2 client so that each url that needs authentication will call a certain url to get the current user.

Thanks in advance, Martijn

Answer 1

I found the solution. It was connecting through a zull proxy and by default the zuul proxy filters out the Authorization header. Add this to the zuul configuration and it will work: zuul.sensitiveHeaders: Cookie,Set-Cookie