我使用spring Boot 3.0.2和spring cloud gateway。此外，我使用spring- Boot -starter-oauth2-resource-server在Keycloak服务器上获取和检查jwt token以确保安全。我的build.gradle文件如下：

plugins {
  id 'java'
  id 'org.springframework.boot' version '3.0.2'
  id 'io.spring.dependency-management' version '1.1.3'
}
dependencies {
  implementation 'org.springframework.cloud:spring-cloud-starter'
  implementation 'org.springframework.boot:spring-boot-starter-webflux'      
  implementation 'org.springframework.cloud:spring-cloud-starter-gateway'
  implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
  implementation 'org.springframework.boot:spring-boot-starter-data-mongodb'
  implementation 'org.springframework.boot:spring-boot-starter-oauth2-resource-server'
  implementation 'org.springframework.boot:spring-boot-starter-actuator'
  implementation 'com.shahrtech.service.libs:service-common-libs:0.0.61'
  implementation 'org.springframework.cloud:spring-cloud-starter-circuitbreaker-reactor-resilience4j'
  implementation 'org.springframework.cloud:spring-cloud-starter-loadbalancer'
}

字符串
而application.yml上的配置文件是：

spring :
 cloud:
   gateway:
    default-filters:
     - DedupeResponseHeader=Access-Control-Allow-Credentials Access-Control-Allow-  Origin
   globalcors:
     corsConfigurations:
      '[/**]':
        allowedOrigins: "*"
        allowedMethods: "*"
        allowedHeaders: "*"
       
   routes:        
    - id: auth-service
      uri: http://x.x.x.x:8085/
      predicates:
        - Path=/auth-service/v1.0/**
      filters:
        - RewritePath=/auth-service/v1.0/(?<path>.*),/auth-service/v1.0/$\{path}
        - RequestHashing=SHA-256
    
    - id: customer-service
      uri: http://x.x.x.x:8090/
      predicates:
        - Path=/customer-service/v1.0/**
      filters:
        - RewritePath=/customer-service/v1.0/(?<path>.*),/customer-service/v1.0/$\{path}
        - RequestHashing=SHA-256
        - TokenRelay= 
  security:
oauth2:
  client:
    registration:
      keycloak:
        client-id: login-app
        authorization-grant-type: authorization_code
        scope: openid
    provider:
      keycloak:
        issuer-uri: http://x.x.x.x:9002/auth/realms/app
        user-name-attribute: preferred_username
  resourceserver:
    jwt:
      issuer-uri: http://x.x.x.x:9002/auth/realms/app

型
ApiGatewayServiceApplication.java是：

@SpringBootApplication
@EnableDiscoveryClient
@EnableWebFluxSecurity
@EnableReactiveMethodSecurity
public class ApiGatewayServiceApplication {
@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
    http.cors().and().csrf()
            .csrfTokenRepository(CookieServerCsrfTokenRepository.withHttpOnlyFalse())
            .and()
            .authorizeExchange()
            .anyExchange().authenticated()
            .and()
            .oauth2ResourceServer()
            .jwt();
    return http.build();
}
@Bean
CorsConfigurationSource corsConfiguration() {
    CorsConfiguration corsConfig = new CorsConfiguration();
    corsConfig.applyPermitDefaultValues();
    corsConfig.addAllowedMethod(HttpMethod.PUT);
    corsConfig.addAllowedMethod(HttpMethod.DELETE);
    corsConfig.setAllowedOrigins(Arrays.asList("*", "**"));
    corsConfig.setAllowCredentials(true);
    UrlBasedCorsConfigurationSource source =
            new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", corsConfig);
    return source;
}
public static void main(String[] args) {
    SpringApplication.run(ApiGatewayServiceApplication.class, args);
}

型
}
我也使用这个Bean来更改安全配置：

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
            .authorizeRequests()
            .requestMatchers(new AntPathRequestMatcher("/auth-service/**")).permitAll()
            .anyRequest().permitAll()
            .and()
            .httpBasic()
            .and()
            .csrf().disable()
            .cors().disable();
    return http.build();
}

型
一切都很好。当在Postman中使用头部中的token调用API时，一切都很好。但是我们试图开发一个示例JS和ReactJs代码来获得API，我们收到错误401和控制台日志，并跟踪它显示请求头部授权未被接受。我们研究并找到这篇文章：Spring Gateway and Auth0: IllegalArgumentException: Unable to find GatewayFilterFactory with name TokenRelay，它说在配置中添加TokenRelay。我在配置中添加了TokenRelay，并重试，但错误存在。
一切都很好。当在Postman中使用头部中的token调用API时，一切都很好。但是我们试图开发一个示例JS和ReactJs代码来获得API，我们收到错误401和控制台日志，并跟踪它显示请求头部授权未被接受。我们研究并找到这篇文章：Spring Gateway and Auth0: IllegalArgumentException: Unable to find GatewayFilterFactory with name TokenRelay，它说在配置中添加TokenRelay。我在配置中添加了TokenRelay，并重试，但错误存在。