Spring Security Oauth2 如何鉴别Token是否有效

转载：https://blog.csdn.net/zimou5581/article/details/101051416

重点

当oauth2请求（Authorization请求头中Bearer协议的 access_token）进行访问时，会进入OAuth2AuthenticationProcessingFilter之中

public class OAuth2AuthenticationProcessingFilter implements Filter, InitializingBean { // ... 其他变量 和 方法
    
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain){ final HttpServletRequest request = (HttpServletRequest) req; final HttpServletResponse response = (HttpServletResponse) res; try { //从请求中取出身份信息，将access_token 放入principal变量
            Authentication authentication = tokenExtractor.extract(request); if (authentication == null) { // token信息为null，SecurityContextHolder 清空上下文
 } else { // request请求对象 放入authentication对象中
 request.setAttribute(OAuth2AuthenticationDetails.ACCESS_TOKEN_VALUE, authentication.getPrincipal()); if (authentication instanceof AbstractAuthenticationToken) { AbstractAuthenticationToken needsDetails = (AbstractAuthenticationToken) authentication; needsDetails.setDetails(authenticationDetailsSource.buildDetails(request)); } // 验证token身份信息
                Authentication authResult = authenticationManager.authenticate(authentication); eventPublisher.publishAuthenticationSuccess(authResult); //将身份信息绑定到SecurityContextHolder中
 SecurityContextHolder.getContext().setAuthentication(authResult); } } catch (OAuth2Exception failed) { // SecurityContextHolder 清空上下文, 然后直接返回
            return; } chain.doFilter(request, response); } }