Spring Boot3整合OAuth2实现第三方登录功能详细示例

<dependencies>
    <!-- Spring Security -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    
    <!-- OAuth2 Client -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-oauth2-client</artifactId>
    </dependency>
    
    <!-- Web支持 -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    
    <!-- Thymeleaf (可选，用于前端展示) -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-thymeleaf</artifactId>
    </dependency>
    
    <!-- Lombok (简化代码) -->
    <dependency>
        <groupId>org.projectlombok</groupId>
        <artifactId>lombok</artifactId>
        <optional>true</optional>
    </dependency>
</dependencies>

spring:
  security:
    oauth2:
      client:
        registration:
          github:
            client-id: your-github-client-id
            client-secret: your-github-client-secret
            scope: user:email,read:user
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
        provider:
          github:
            authorization-uri: https://github.com/login/oauth/authorize
            token-uri: https://github.com/login/oauth/access_token
            user-info-uri: https://api.github.com/user
            user-name-attribute: login

server:
  port: 8080
  servlet:
    context-path: /demo

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable()) // 开发阶段可禁用CSRF
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/", "/login**", "/oauth2/**", "/error**").permitAll()
                .anyRequest().authenticated()
            )
            .oauth2Login(oauth2 -> oauth2
                .loginPage("/login")
                .defaultSuccessUrl("/home", true)
                .userInfoEndpoint(userInfo -> userInfo
                    .userService(customOAuth2UserService())
                )
                .successHandler(authenticationSuccessHandler())
            )
            .logout(logout -> logout
                .logoutSuccessUrl("/").permitAll()
                .deleteCookies("JSESSIONID")
                .invalidateHttpSession(true)
            );
        
        return http.build();
    }

    @Bean
    public OAuth2UserService<OAuth2UserRequest, OAuth2User> customOAuth2UserService() {
        return new CustomOAuth2UserService();
    }

    @Bean
    public AuthenticationSuccessHandler authenticationSuccessHandler() {
        return new CustomAuthenticationSuccessHandler();
    }
}

@Slf4j
public class CustomOAuth2UserService extends DefaultOAuth2UserService {

    @Override
    public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
        OAuth2User oAuth2User = super.loadUser(userRequest);
        
        String registrationId = userRequest.getClientRegistration().getRegistrationId();
        String accessToken = userRequest.getAccessToken().getTokenValue();
        
        log.info("Registration ID: {}", registrationId);
        log.info("Access Token: {}", accessToken);
        log.info("User Attributes: {}", oAuth2User.getAttributes());
        
        // 根据不同平台处理用户信息
        Map<String, Object> attributes = new HashMap<>(oAuth2User.getAttributes());
        
        // 添加平台标识
        attributes.put("provider", registrationId);
        
        // 标准化用户信息
        if ("github".equals(registrationId)) {
            attributes.put("email", attributes.get("email") != null ? 
                attributes.get("email") : attributes.get("login") + "@users.noreply.github.com");
        }
        
        return new DefaultOAuth2User(
            Collections.singleton(new SimpleGrantedAuthority("ROLE_USER")),
            attributes,
            userRequest.getClientRegistration()
                .getProviderDetails()
                .getUserInfoEndpoint()
                .getUserNameAttributeName()
        );
    }
}

@Slf4j
public class CustomAuthenticationSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, 
                                      HttpServletResponse response,
                                      Authentication authentication) throws IOException {
        
        OAuth2User oauthUser = (OAuth2User) authentication.getPrincipal();
        String provider = (String) oauthUser.getAttribute("provider");
        
        log.info("User logged in from {}: {}", provider, oauthUser.getName());
        
        // 根据不同的登录来源处理不同逻辑
        if ("github".equals(provider)) {
            // GitHub特定处理逻辑
            handleGitHubUser(oauthUser);
        }
        
        // 设置默认跳转路径
        setDefaultTargetUrl("/home");
        super.onAuthenticationSuccess(request, response, authentication);
    }

    private void handleGitHubUser(OAuth2User oauthUser) {
        // 实现GitHub用户的特定处理逻辑
        // 例如保存用户信息到数据库等
    }
}

@Controller
@RequiredArgsConstructor
public class MainController {

    @GetMapping("/")
    public String home() {
        return "index";
    }

    @GetMapping("/login")
    public String login(Model model) {
        model.addAttribute("providers", List.of("github")); // 可以扩展更多提供商
        return "login";
    }

    @GetMapping("/home")
    public String userHome(Principal principal, Model model) {
        if (principal instanceof OAuth2User oauthUser) {
            model.addAttribute("username", oauthUser.getAttribute("name"));
            model.addAttribute("avatar", oauthUser.getAttribute("avatar_url"));
            model.addAttribute("provider", oauthUser.getAttribute("provider"));
        } else {
            model.addAttribute("username", principal.getName());
        }
        return "home";
    }
}

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<head>
    <title>Login</title>
    <style>
        .oauth-provider {
            display: inline-block;
            margin: 10px;
            padding: 10px 20px;
            background: #f5f5f5;
            border-radius: 5px;
            text-decoration: none;
            color: #333;
        }
        .oauth-provider:hover {
            background: #e5e5e5;
        }
    </style>
</head>
<body>
    <h1>Login with OAuth2</h1>
    <div th:each="provider : ${providers}">
        <a class="oauth-provider" th:href="@{/oauth2/authorization/{provider}(provider=${provider})}" rel="external nofollow" >
            Login with <span th:text="${provider}"></span>
        </a>
    </div>
</body>
</html>

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<head>
    <title>Home</title>
    <style>
        .user-info {
            display: flex;
            align-items: center;
            gap: 20px;
            margin-bottom: 20px;
        }
        .avatar {
            width: 80px;
            height: 80px;
            border-radius: 50%;
        }
    </style>
</head>
<body>
    <div class="user-info" th:if="${avatar}">
        <img class="avatar" th:src="${avatar}" alt="User Avatar"/>
        <div>
            <h1>Welcome, <span th:text="${username}"></span>!</h1>
            <p>Logged in via <span th:text="${provider}"></span></p>
        </div>
    </div>
    
    <div th:unless="${avatar}">
        <h1>Welcome, <span th:text="${username}"></span>!</h1>
    </div>
    
    <form th:action="@{/logout}" method="post">
        <button type="submit">Logout</button>
    </form>
</body>
</html>