spring boot 2 oauth2 access_token请求失败

[-火星人-]

利用oauth2 获取到token后去访问接口依然返回登陆页面，无法访问到接口内容
比如直接访问 http://localhost:8080/user?access_token=ae7a87d2-0686-4d21-8de6-098c1989d7e4 会直接返回到登陆页
配置如下

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.antMatcher("/**")
                .authorizeRequests()
                .antMatchers("/register**", "/oauth**")
                .permitAll()
                .anyRequest().authenticated()
                .and()
                .csrf().disable()
                .formLogin()
                .and()
                .httpBasic();
    }


    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.parentAuthenticationManager(authenticationManagerBean())
                .inMemoryAuthentication()
                .withUser("u")
                .password("{noop}p")
                .roles("USER");
    }
}

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

    @Autowired
    private AuthenticationManager authenticationManager;

    @Bean
    public TokenStore tokenStore() {
        return new InMemoryTokenStore();
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.authenticationManager(this.authenticationManager);
        endpoints.tokenStore(tokenStore());
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
        security.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()");
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory().
                withClient("android").scopes("test").secret("{noop}android").
                authorizedGrantTypes("password", "authorization_code", "refresh_token");
    }

}

@SpringBootApplication
public class AuthorizationApplication {
    public static void main(String[] args) {
        SpringApplication.run(AuthorizationApplication.class, args);
    }

}

没有其他的配置，但是就是验证不过，希望有人可以回答下为什么

[戴沐白。]

不知道说的对不对，仅供参考。 1.SecurityConfig中对http的配置不对，建议改成这样: http.csrf().disable(); http .requestMatchers().antMatchers("/oauth/**","/login/**","/register/**") .and() .authorizeRequests() .antMatchers("/oauth/**").authenticated() .and() .formLogin().permitAll(); 2.AuthorizationServerConfig 中第21行 改为 .tokenKeyAccess("isAuthenticated()").checkTokenAccess("permitAll()") 不然你的check_token应该也是无法访问的。

[-火星人-]

其实原因应该是同一域名下Cookie问题导致， 应该将2个服务在不同域名下访问才可以