刚开始用springboot1.5集成oauth2没问题，现在升级成springboot2.1踩了不少坑，下面列举下：
问题一
Possible CSRF detected - state parameter was required but no state could be found
客户端代码
@EnableOAuth2Sso
@Configuration
public class Ui...
Possible CSRF detected - state parameter was required but no state could be found
这个错误只在使用AuthorizationCode方式时出现， 就是客户端反复刷新带有code和state的参数的url导致的,因为code已经被使用过一次了,相当于过期了,你反复使用,自然会被认为是非法操作,所以”可能是CSRF攻击...
@Bean public CorsFilter corsFilter() { final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); final CorsConfiguration config = new CorsConfiguratio...
首先介绍一下什么是JSON Web Token（JWT）？
官方文档是这样解释的：JSON Web Token（JWT）是一个开放标准（RFC 7519），它定义了一种紧凑且独立的方式，可以在各方之间作为JSON对象安全地传输信息。此信息可以通过数字签名进行验证和信任。JWT可以使用秘密（使用HMAC算法）或使用RSA或ECDSA的公钥/私钥对进行签名。
虽然JWT可以加密以在各方之间提供保密...
在使用Spring Security OAuth2测试时，授权之后报错：
Whitelabel Error Page
This application has no explicit mapping for /error, so you are seeing this as a fallback.
Wed Dec 20 16:14:18 CST 2017
There was an unexpected error (type=Unauthorized, status=401).
Authentication Failed: Could not obtain user details from token
客户端DEBUG信息：
2017-12-20 16:14:17.948 DEBUG 7932 --- [nio-8082-exec-4] o.s.s.oauth2.client.OAuth2RestTemplate : Created GET request for "http://localhost:8081/resource/user"
2017-12-20 16:14:17.967 DEBUG 7932 --- [nio-8082-exec-4] o.s.s.oauth2.client.OAuth2RestTemplate : Setting request Accept header to [application/json, application/*+json]
2017-12-20 16:14:18.204 DEBUG 7932 --- [nio-8082-exec-4] o.s.s.oauth2.client.OAuth2RestTemplate : GET request for "http://localhost:8081/resource/user" resulted in 401 (null); invoking error handler
2017-12-20 16:14:18.213 WARN 7932 --- [nio-8082-exec-4] o.s.b.a.s.o.r.UserInfoTokenServices : Could not fetch user details: class org.springframework.security.oauth2.common.exceptions.InvalidRequestException, Possible CSRF detected - state parameter was required but no state could be found
2017-12-20 16:14:18.280 DEBUG 7932 --- [nio-8082-exec-4] uth2ClientAuthenticationProcessingFilter : Authentication request failed: org.springframework.security.authentication.BadCredentialsException: Could not obtain user details from token
认证服务器DEBUG信息：
2017-12-20 16:14:08.230 DEBUG 8704 --- [nio-8080-exec-7] o.s.s.w.a.i.FilterSecurityInterceptor : Secure object: FilterInvocation: URL: /favicon.ico; Attributes: [authenticated]
2017-12-20 16:14:08.230 DEBUG 8704 --- [nio-8080-exec-7] o.s.s.w.a.i.FilterSecurityInterceptor : Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@6fa90ed4: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@fffc7f0c: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 41D379AFB367FD4316A06BAC18AB91DA; Granted Authorities: ROLE_ANONYMOUS
2017-12-20 16:14:08.230 DEBUG 8704 --- [nio-8080-exec-7] o.s.s.access.vote.AffirmativeBased : Voter: org.springframework.security.web.access.expression.WebExpressionVoter@72127537, returned: -1
2017-12-20 16:14:08.231 DEBUG 8704 --- [nio-8080-exec-7] o.s.s.w.a.ExceptionTranslationFilter : Access is denied (user is anonymous); redirecting to authentication entry point
资源服务器DEBUG信息：
2017-12-20 16:14:18.132 DEBUG 10100 --- [nio-8081-exec-1] o.s.security.web.FilterChainProxy : /user at position 5 of 11 in additional filter chain; firing Filter: 'OAuth2AuthenticationProcessingFilter'
2017-12-20 16:14:18.137 DEBUG 10100 --- [nio-8081-exec-1] p.a.OAuth2AuthenticationProcessingFilter : Authentication request failed: error="invalid_token", error_description="Invalid access token: fbde02a4-d6b9-41c8-a8aa-332390482c1e"
2017-12-20 16:14:18.192 DEBUG 10100 --- [nio-8081-exec-1] w.c.HttpSessionSecurityContextRepository : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
2017-12-20 16:14:18.199 DEBUG 10100 --- [nio-8081-exec-1] s.s.o.p.e.DefaultOAuth2ExceptionRenderer : Written [error="invalid_token", error_description="Invalid access token: fbde02a4-d6b9-41c8-a8aa-332390482c1e"] as "application/json;charset=UTF-8" using [org.springframework.http.converter.json.MappingJackson2HttpMessageConverter@74bcb39b]
2017-12-20 16:14:18.200 DEBUG 10100 --- [nio-8081-exec-1] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
网上找了很久都没有解决，有研究过的大神指教一下
基础理论
What is SSO?
<em>单点</em>登录（Single Sign On），简称为 SSO，是目前比较流行的企业业务整合的解决方案之一。SSO的定义是在多个应用<em>系统</em>中，用户只需要登录一次就可以访问所有相互信任的应用<em>系统</em>。
What is Spring Security?
Spring Security官方解释
What is OAuth2?
首先简单了解一下用于验证及授权的OAuth协议，
...
