在Spring Boot 2上实现基于过滤器的JWT身份验证与OAuth2 JWT身份验证的区别

Question

在Spring Boot 2上实现基于过滤器的JWT身份验证与OAuth2 JWT身份验证的区别

spring-bootjwtspring-security-oauth2java-ee-8

3

据我理解，OAuth2框架需要一个自定义的JWT身份验证服务器，并且我必须为基于过滤器的JWT实现创建一个带有JWT实用程序类的自定义安全过滤器。

然而我的问题是，在Spring Boot 2上实现JWT的最佳方法是什么？基于过滤器的身份验证还是OAuth2？

根据客户端和应用程序的性质，是否存在任何优缺点？

例如，如果应用程序管理不同类型的客户端，如移动、Web、Web服务等，那么OAuth2身份验证是否提供任何优势？

注意：我的问题与Spring-Boot REST API + Web应用程序的安全性有关。

- Unknown

1个回答

网页内容由stack overflow 提供, 点击上面的

可以查看英文原文，
原文链接

- Unknown · Accepted Answer

我找到了一篇关于同样问题的讨论，以下是我提取的重点。

从技术角度来看，我仍然没有清楚地了解哪种实现方式，在什么时候和何处使用，但这帮助我做出决定。

I personally hesitate to bring in OAuth when I only need JWT authentication. It feels confusing and honestly I do not want the additional complexity to use @EnableResourceServer etc. Maybe it's just a couple of lines of configuration but if feels like overkill.
Can someone show me why it's so difficult to set up an OAuth2 provider with JWT tokens? If you want JWT tokens all the code is already here. Why is it so hard to just use it?

Answer:

Maybe it's not difficult but 1) it feels unnatural to do so and 2) it can be easier. Instead of using @EnableResourceServer and other setup I would like something much more easier like:
```
@Override
        protected void configure(HttpSecurity http) throws Exception {
    http
        .jwt()
            .loginUrl(new AntPathRequestMatcher("/api/login", "POST"))
            .secret("my-super-duper-secret")
            .claimsProvider(new MyClaimsProvider)
```
What you typically want set to for JWT is the login url (can be defaulted to /login), the secret and optionally some claimsProvider implementation. A default implementation should be provided out of the box adding the username and roles to the claims. This way it would be very easy to setup JWT in Spring Security.
With OAuth2 there is a "refresh token", so you put the onus on the client to keep the access token live, and the authorization server can check the user account every time it is refreshed. If you start worrying about that kind of problem (which you should) then you will end up implementing something that is getting pretty close to OAuth2, at which point you might say "why didn't we just use OAuth2 in the first place?" Do you see my point?
Isn't the use case described in this issue conceptually different from the OAuth2 case? Here we have a password as an input and JWT token as an output, and JWT token is then used for accessing the resources. The JWT profile for OAuth 2 spec specifies a different case, where a JWT token is an input to the token service and the access token is an output, and access token is then used for accessing the resources.
It will be good to have just simple JWT token base authentication without OAuth which is sometimes complicated for small projects.

https://github.com/spring-projects/spring-security-oauth/issues/368