Spring Boot 3.x + Security + OpenFeign: 如何避免内部服务调用被重复拦截？

Question

环境：Spring Boot 3.x + Spring Security + OpenFeign
需求：

用户请求必须带 user_token
服务之间用 OpenFeign 调用时必须带 client_token
现发现：

用户携带 access_token 访问服务 A 的接口，请求首先经过 Security 过滤器。过滤器需要通过 OpenFeign 远程调用服务 B 来验证 access_token 的有效性。然而，在 OpenFeign 发起远程调用时，该请求又被 Security 过滤器拦截，导致认证失败。这种情况该如何处理？

如何既让外部用户请求走 user_token 校验，又让服务 A 到服务 B 的内部 OpenFeign 请求只校验 client_token 而不再触发 user_token 拦截？

Answer 1

解决方案结构

一、Feign 请求添加标识头 + client_token

@Configuration
public class FeignClientInterceptorConfig {

    @Bean
    public RequestInterceptor internalRequestInterceptor() {
        return requestTemplate -> {
            requestTemplate.header("X-Internal-Call", "true");
            requestTemplate.header("Authorization", "Bearer " + getClientToken());
        };
    }

    private String getClientToken() {
        // 从配置、缓存或远程获取 client_token
        return "your-client-token";
    }
}

二、自定义过滤器：跳过内部调用的用户认证

@Component
public class InternalCallBypassFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain) throws ServletException, IOException {
        String internalCall = request.getHeader("X-Internal-Call");

        if ("true".equalsIgnoreCase(internalCall)) {
            // 设置一个标志位，供后续 Security 判断
            request.setAttribute("INTERNAL_CALL", true);
        }

        filterChain.doFilter(request, response);
    }
}

三、Spring Security 配置中区分处理逻辑

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(AbstractHttpConfigurer::disable)
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .addFilterBefore(new InternalCallAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }
}

四、自定义认证过滤器：区分 user_token 和 client_token

public class InternalCallAuthenticationFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain) throws ServletException, IOException {

        Boolean isInternal = (Boolean) request.getAttribute("INTERNAL_CALL");

        if (Boolean.TRUE.equals(isInternal)) {
            // 校验 client_token
            String token = resolveToken(request);
            if (isValidClientToken(token)) {
                // 设置一个简单的认证对象，跳过 user_token 验证
                SecurityContextHolder.getContext().setAuthentication(
                    new UsernamePasswordAuthenticationToken("internal-client", null, List.of())
                );
                filterChain.doFilter(request, response);
                return;
            } else {
                response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Invalid client token");
                return;
            }
        }

        // 否则继续走 user_token 验证逻辑（可集成 OAuth2 或 JWT）
        filterChain.doFilter(request, response);
    }

    private String resolveToken(HttpServletRequest request) {
        String bearer = request.getHeader("Authorization");
        return (bearer != null && bearer.startsWith("Bearer ")) ? bearer.substring(7) : null;
    }

    private boolean isValidClientToken(String token) {
        // 实现 client_token 校验逻辑
        return "your-client-token".equals(token);
    }
}