验证 Auth0 令牌 - Spring Security

Question

我在 this official doc 的帮助下在 Spring Boot 应用程序中验证 auth0 令牌

在运行应用程序时，它抛出异常

2021-11-03 19:12:09.669  WARN 18128 --- [           main] ConfigServletWebServerApplicationContext : Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'springSecurityFilterChain' defined in class path resource [org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtDecoder' defined in class path resource [com/talenlio/common/security/SecurityConfig.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.jwt.JwtDecoder]: Factory method 'jwtDecoder' threw exception; nested exception is java.lang.IllegalArgumentException: Unable to resolve the Configuration with the provided Issuer of "https://dummy/api"

我的最终目标是验证我从前端收到的 auth0 令牌。

应用程序.yaml

spring:
 security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://my-domain-at.auth0.com/

auth0:
  grantType: client_credentials
  audience: https://dummy/api
  clientId: XXXXXXXXX
  clientSecret: YYYYY
  applicationDomain: https://my-domain-at.auth0.com/

Answer 1

确保您遵循spring.security.oauth2.resourceserver.jwt.issuer-uri 的规范：

该值将是您的 Auth0 域，带有 https:// 前缀和 / 后缀（尾部斜杠很重要）。

它是“https://dummy/api/”而不是“https://dummy/api”