OAuth2 - 检索TOKEN时OPTIONS请求的状态401(OAuth2 - Status 401 on OPTIONS request while retrieving TOKEN)

 我们的堆栈使用Backbone作为客户端应用程序，Spring Boot作为RESTful API。 
 
 我们正在尝试使用OAuth2进行基本身份验证，用户提供用户名和密码。 
 
 我们使用Spring Security进行身份验证，使用jQuery $ .ajax方法进行请求。 然而，我们得到的响应是在预检OPTIONS请求上的401（未授权）状态，然后我们甚至可以使用我们的秘密进行POST授权。 但是我们可以毫无问题地发布或获取任何其他资源。 OPTIONS请求的服务器响应是200（ok），然后它跟进POST请求。 
 
 那么为什么来自/ oauth / token响应的OPTIONS请求具有401状态，即使它不应该？ 它不会让我们自己授权，因为它会停留在我们无法添加授权标头的OPTIONS请求中。 
 
 这就是我们处理前端请求的方式： 
 
                $.ajax({
                url: "http://localhost:8080/oauth/token",
                type: "POST",
                beforeSend: function(xhr) { 
                    xhr.setRequestHeader("Authorization", "Basic Y2xpZW50YXBwOjEyMzQ1Ng==");
                },
                data: {
                    password: "qwerty",
                    username: "jkowalski",
                    grant_type: "password"
                }
            });
 
 这是我们的OAuth2配置： 
 
@Configuration
public class OAuth2ServerConfiguration {

private static final String RESOURCE_ID = "restservice";

@Configuration
@EnableResourceServer
protected static class ResourceServerConfiguration extends
        ResourceServerConfigurerAdapter {

    [...]

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();

        http
        .authorizeRequests()
            .anyRequest().permitAll();
    }

}

[...]

@Configuration
@EnableAuthorizationServer
protected static class OAuth2AuthorizationConfig extends
        AuthorizationServerConfigurerAdapter {

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        // @formatter:off
        clients
            .inMemory()
                .withClient("clientapp")
                    .authorizedGrantTypes("password", "refresh_token")
                    .authorities("USER","ADMIN")
                    .scopes("read", "write")
                    .resourceIds(RESOURCE_ID)
                    .secret("123456");
        // @formatter:on
    }

[...]
}

Our stack uses Backbone as our client-side app and Spring Boot as a RESTful API.
 
We're trying to make basic authentication using OAuth2 with user providing username and password.
 
We use Spring Security for authentication and jQuery $.ajax method for making requests. However the response we get is 401(unauthorized) status on preflight OPTIONS request before we can even POST header with our secret to authorize. However we can POST or GET any other resource without any problems. Server response for OPTIONS request is 200(ok) and then it follows up with POST request.
 
So why is that an OPTIONS request from /oauth/token responses with 401 status even when it shouldn't? It won't let us authorize ourselves because it get's stuck at OPTIONS request in which we can't add authorization header.
 
This is how we handle requests on front-end:
 
                $.ajax({
                url: "http://localhost:8080/oauth/token",
                type: "POST",
                beforeSend: function(xhr) { 
                    xhr.setRequestHeader("Authorization", "Basic Y2xpZW50YXBwOjEyMzQ1Ng==");
                },
                data: {
                    password: "qwerty",
                    username: "jkowalski",
                    grant_type: "password"
                }
            });
 
This is our OAuth2 config:
 
@Configuration
public class OAuth2ServerConfiguration {

private static final String RESOURCE_ID = "restservice";

@Configuration
@EnableResourceServer
protected static class ResourceServerConfiguration extends
        ResourceServerConfigurerAdapter {

    [...]

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();

        http
        .authorizeRequests()
            .anyRequest().permitAll();
    }

}

[...]

@Configuration
@EnableAuthorizationServer
protected static class OAuth2AuthorizationConfig extends
        AuthorizationServerConfigurerAdapter {

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        // @formatter:off
        clients
            .inMemory()
                .withClient("clientapp")
                    .authorizedGrantTypes("password", "refresh_token")
                    .authorities("USER","ADMIN")
                    .scopes("read", "write")
                    .resourceIds(RESOURCE_ID)
                    .secret("123456");
        // @formatter:on
    }

[...]
}

原文：https://stackoverflow.com/questions/30622624