POST /oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=password&
username=user&
password=pass&
client_id=client_app_id&
client_secret=client_app_secret

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "bearer",
  "expires_in": 43199,
  "scope": "read write"
}

GET /orders/123
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

<!-- OAuth2 授权服务器 -->
<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-oauth2</artifactId>
</dependency>
<!-- JWT -->
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-jose</artifactId> <!-- 处理JOSE协议，包含JWT -->
</dependency>
<!-- Spring Data JPA -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<!-- MySQL 驱动 -->
<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
    <scope>runtime</scope>
</dependency>

<!-- Spring Cloud Gateway -->
<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-gateway</artifactId>
</dependency>
<!-- OAuth2 资源服务器 -->
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-resource-server</artifactId>
</dependency>
<!-- Spring Security JWT (用于资源服务器解析JWT) -->
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-jose</artifactId>
</dependency>
<!-- 响应式Redis依赖 (用于限流) -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-redis-reactive</artifactId>
</dependency>

<!-- Spring Web -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>
<!-- 若业务服务需要自行解析JWT进行细粒度鉴权，则添加资源服务器依赖 -->
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-resource-server</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-jose</artifactId>
</dependency>

spring:
  datasource:
    url: jdbc:mysql://localhost:3306/oauth2?useUnicode=true&characterEncoding=utf-8&useSSL=false
    username: root
    password: your_password
    driver-class-name: com.mysql.cj.jdbc.Driver
  jpa:
    hibernate:
      ddl-auto: update
    show-sql: true

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService; // 需要实现自己的UserDetailsService

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService)
            .passwordEncoder(passwordEncoder());
    }

    // 其他安全配置，如放行oauth/token端点等
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
            .authorizeRequests()
            .antMatchers("/oauth/**").permitAll() // 放行认证端点
            .anyRequest().authenticated();
    }
}

@Service
public class CustomUserDetailsService implements UserDetailsService {

    @Autowired
    private UserRepository userRepository; // 假设你的UserRepository

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException("User not found: " + username);
        }
        // 假设你的User实体实现了UserDetails，或者你需要在这里构建一个UserDetails对象
        // 这里需要返回包括用户名、密码、权限等信息的UserDetails对象
        return org.springframework.security.core.userdetails.User
                .withUsername(user.getUsername())
                .password(user.getPassword()) // 数据库中的密码应该是加密后的
                .authorities(getAuthorities(user)) // 从用户对象中获取权限/角色
                .build();
    }

    private Collection<? extends GrantedAuthority> getAuthorities(User user) {
        // 根据你的用户权限/角色结构返回GrantedAuthority集合
        // 例如：return user.getRoles().stream().map(role -> new SimpleGrantedAuthority(role.getName())).collect(Collectors.toList());
        return Collections.emptyList(); // 示例
    }
}

spring:
  cloud:
    gateway:
      routes:
        - id: user-service-route
          uri: lb://user-service # 假设已集成服务发现（如Nacos）
          predicates:
            - Path=/api/users/**
          filters:
            - name: RequestRateLimiter # 限流过滤器
              args:
                redis-rate-limiter.replenishRate: 10 # 每秒产生的令牌数
                redis-rate-limiter.burstCapacity: 20 # 令牌桶总容量
                key-resolver: "#{@userKeyResolver}" # 限流键解析器Bean（按用户限流）
            - StripPrefix=1 # 去掉路径的第一部分（例如 /api）
        - id: auth-service-route # 认证服务路由，通常获取token的端点需要暴露，也可直接不经过网关
          uri: lb://auth-service
          predicates:
            - Path=/oauth/token
          # 注意：获取token的端点通常不需要JWT验证，网关安全配置需要放行
  security:
    oauth2:
      resourceserver:
        jwt:
          secret-key: your-secret-key # HS256的密钥，与认证服务一致
          # 如果使用RSA:
          # public-key-location: classpath:public.key
          # 或者通过issuer-uri从认证服务发现jwks端点（推荐）
          # issuer-uri: http://auth-service
  redis:
    host: localhost
    port: 6379
    database: 0

@Configuration
@EnableWebFluxSecurity // 注意是WebFlux
public class GatewaySecurityConfig {

    @Bean
    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        http
            .authorizeExchange(exchanges -> exchanges
                .pathMatchers("/oauth/token").permitAll() // 放行获取token的端点
                .anyExchange().authenticated() // 其他所有请求都需要认证
            )
            .oauth2ResourceServer(ServerHttpSecurity.OAuth2ResourceServerSpec::jwt) // 启用JWT资源服务器
            .csrf().disable();
        return http.build();
    }
}

@Configuration
public class RateLimiterConfig {

    @Bean
    KeyResolver userKeyResolver() {
        return exchange -> {
            // 从SecurityContext中获取认证信息，其中包含JWT解析后的内容
            return exchange.getPrincipal()
                    .map(Principal::getName) // 获取用户名（JWT的subject）
                    .defaultIfEmpty("anonymous"); // 如果没有认证用户，使用"anonymous"
        };
    }
}

@Component
public class JwtBlacklistFilter implements GlobalFilter, Ordered {

    @Autowired
    private RedisTemplate<String, String> redisTemplate;

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        String authHeader = exchange.getRequest().getHeaders().getFirst(HttpHeaders.AUTHORIZATION);
        if (authHeader != null && authHeader.startsWith("Bearer ")) {
            String jwtToken = authHeader.substring(7);
            // 从JWT中解析出jti (JWT ID) 或其他唯一标识
            // 这里需要解析JWT，可以使用JwtHelper（注意：资源服务器已经解析过，避免重复解析，可以考虑在之前的过滤器中设置属性）
            // 简单示例：检查jti是否在黑名单Set中
            String jti = parseJtiFromToken(jwtToken); // 需要实现parseJtiFromToken方法
            if (jti != null && redisTemplate.hasKey("jwt_blacklist:" + jti)) {
                exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
                return exchange.getResponse().setComplete();
            }
        }
        return chain.filter(exchange);
    }

    private String parseJtiFromToken(String jwtToken) {
        // 使用JwtHelper解析JWT，获取claims，然后取出jti声明
        // 注意：这只是示例，Gateway的OAuth2资源服务器已经验证并解析了JWT，可以考虑在其后添加此过滤器，并从SecurityContext获取信息避免重复解析。
        try {
            String[] splitToken = jwtToken.split("\\.");
            String claimsStr = new String(Base64.getUrlDecoder().decode(splitToken[1]));
            Map<String, Object> claims = new ObjectMapper().readValue(claimsStr, Map.class);
            return (String) claims.get("jti");
        } catch (Exception e) {
            return null;
        }
    }

    @Override
    public int getOrder() {
        return Ordered.HIGHEST_PRECEDENCE + 1; // 在认证过滤器之后执行
    }
}

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          secret-key: your-secret-key # 与认证服务、网关一致
          # issuer-uri: http://auth-service # 或者使用issuer-uri

@Configuration
@EnableWebSecurity
public class ResourceServerConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests(authorize -> authorize
                .antMatchers("/users/me").hasAuthority("SCOPE_profile") // 示例：需要scope
                .antMatchers(HttpMethod.GET, "/users/**").hasRole("USER") // 示例：需要角色
                .antMatchers(HttpMethod.POST, "/users").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt);
    }
}

@RestController
@RequestMapping("/users")
public class UserController {

    @GetMapping("/me")
    public String getCurrentUser(@AuthenticationPrincipal Jwt jwt) {
        // 从JWT claims中获取信息
        String username = jwt.getSubject();
        String customClaim = (String) jwt.getClaims().get("custom_claim");
        return "Hello, " + username + ". Your custom claim: " + customClaim;
    }

    // 或者如果主体是用户名字符串
    // public String getCurrentUser(@AuthenticationPrincipal(expression = "subject") String username) { ... }
}

@RestControllerAdvice
public class GlobalExceptionHandler {

    // 处理业务异常
    @ExceptionHandler(BusinessException.class)
    public ResponseEntity<ResultData<?>> handleBusinessException(BusinessException e) {
        // ResultData 是你定义的统一返回体
        ResultData<?> resultData = ResultData.fail(e.getErrorCode(), e.getMessage());
        return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(resultData); // 或其他合适的状态码
    }

    // 处理访问拒绝（权限不足）
    @ExceptionHandler(AccessDeniedException.class)
    public ResponseEntity<ResultData<?>> handleAccessDeniedException(AccessDeniedException e) {
        ResultData<?> resultData = ResultData.fail("403", "没有权限执行此操作");
        return ResponseEntity.status(HttpStatus.FORBIDDEN).body(resultData);
    }

    // 处理其他异常...
    @ExceptionHandler(Exception.class)
    public ResponseEntity<ResultData<?>> handleOtherException(Exception e) {
        ResultData<?> resultData = ResultData.fail("500", "系统内部错误: " + e.getMessage());
        return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body(resultData);
    }
}

// 统一的返回结果类
@Data
@AllArgsConstructor
@NoArgsConstructor
public class ResultData<T> {
    private String code;
    private String message;
    private T data;
    private long timestamp = System.currentTimeMillis();

    public static <T> ResultData<T> success(T data) {
        return new ResultData<>("200", "成功", data, System.currentTimeMillis());
    }

    public static <T> ResultData<T> fail(String code, String message) {
        return new ResultData<>(code, message, null, System.currentTimeMillis());
    }
}

@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
    endpoints.pathMapping("/oauth/token", "/api/auth/login");
}