spring-boot - What is the difference between DefaultOAuth2AuthorizedClientManager and AuthorizedClientServiceOAuth2AuthorizedClientManager

Question

Looking at the documentation, the only recommendation I found is

The DefaultOAuth2AuthorizedClientManager is designed to be used within the context of a HttpServletRequest. When operating outside of a HttpServletRequest context, use AuthorizedClientServiceOAuth2AuthorizedClientManager instead.

I could test that WebClient calls hang using the DefaultOAuth2AuthorizedClientManager outside the scope of a servlet request, however, nothing weird happens if I use AuthorizedClientServiceOAuth2AuthorizedClientManager inside the context of a servlet request. Then, what's the difference between the two of them?

标签： spring-bootspring-securityspring-security-oauth2

Answer 1

您从文档中指出的主要区别在于它们的使用位置。从外部看，这可能不太明显，但在框架内部会更明显。但也许解释它们为何不同的更简单方法是查看它们封装的内容。

• DefaultOAuth2AuthorizedClientManager使用一个OAuth2AuthorizedClientRepository
  • 它的方法签名为loadAuthorizedClient(String clientRegistrationId, Authentication principal, HttpServletRequest request)
• AuthorizedClientServiceOAuth2AuthorizedClientManager使用一个OAuth2AuthorizedClientService
  • 它的方法签名为loadAuthorizedClient(String clientRegistrationId, String principalName)

所以DefaultOAuth2AuthorizedClientManager我猜你会称之为“基于请求”并且AuthorizedClientServiceOAuth2AuthorizedClientManager是“基于服务”，这实际上只是意味着其他一切。

API 文档在这里会有所帮助：

• DefaultOAuth2AuthorizedClientManager
• AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager

更新：

将请求作为参数有什么附加价值？

作为一个接口，声明该loadAuthorizedClient方法接受请求作为参数意味着任何未来的实现都可以使用请求来影响其决定。默认实现 ( DefaultOAuth2AuthorizedClientManager) 执行此操作，因为它HttpSessionOAuth2AuthorizedClientRepository利用请求来访问会话。