Spring Security 6 & JWT Authentication · レッスン

カスタムOAuth2成功ハンドラー

OAuth2認証の成功後にユーザー情報を処理するカスタム成功ハンドラーを開発します。

「カスタムOAuth2成功ハンドラー」はCoddyKit上の無料Spring Security 6 & JWT Authenticationレッスンです。これはレッスン3/4です。下記で完全なレッスンを無料で読むことができます。その後、ブラウザ内の組み込みコードエディタと24時間対応のAIチューターでハンズオン演習できます。これはSpring Security 6 & JWT Authentication学習パスの一部であり、ウェブとCoddyKitアプリ全体で進捗が同期されます。 Spring Security 6 & JWT Authenticationコースには全4レッスンが含まれています。

このレッスンの一部はまだ翻訳されておらず、英語で表示されています。

Intro to OAuth2 Success Handlers

Welcome to our lesson on custom OAuth2 success handlers! After a user successfully logs in via an OAuth2 provider (like Google or GitHub), Spring Security needs to know what to do next.

By default, it handles basic redirection. But what if you need to perform custom actions, like saving user details or updating their profile? That's where custom success handlers come in!

Default OAuth2 Success Flow

When a user successfully authenticates with an OAuth2 provider, Spring Security's default behavior is quite straightforward:

It extracts user details (like name, email) from the provider's response.
It creates an OAuth2AuthenticationToken.
It redirects the user to the application's root URL (or a previously requested URL).

This is often enough for simple integrations, but real-world apps usually need more.

Why Customize Success Handling?

Customizing the success handler allows you to:

Store User Data: Save new users or update existing ones in your application's database.
Generate Tokens: Create custom session tokens or JWTs after OAuth2 login.
Redirect Dynamically: Send users to different pages based on their role or status.
Logging & Auditing: Log successful logins for security monitoring.

It gives you fine-grained control over the post-authentication process.

The AuthenticationSuccessHandler

Spring Security provides the AuthenticationSuccessHandler interface. You implement this interface to define custom logic for successful authentication events.

Its core method is onAuthenticationSuccess, which gets called after authentication passes.

public interface AuthenticationSuccessHandler {
  void onAuthenticationSuccess(
    HttpServletRequest request,
    HttpServletResponse response,
    Authentication authentication
  ) throws IOException, ServletException;
}

Building a Simple Custom Handler

Let's create a basic custom handler that just logs the successful authentication and then redirects. We'll implement the AuthenticationSuccessHandler interface.

import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.core.Authentication;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;
import org.springframework.stereotype.Component;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

@Component
public class CustomOAuth2SuccessHandler implements AuthenticationSuccessHandler {

    private static final Logger logger = LoggerFactory.getLogger(CustomOAuth2SuccessHandler.class);

    @Override
    public void onAuthenticationSuccess(
        HttpServletRequest request,
        HttpServletResponse response,
        Authentication authentication) throws IOException, ServletException {

        logger.info("OAuth2 login successful for user: " + authentication.getName());
        // Default redirect to home page
        response.sendRedirect("/");
    }
}

Configuring the Custom Handler

To make Spring Security use our custom handler, we need to configure it in our SecurityFilterChain bean. We'll use the oauth2Login() method.

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    private final AuthenticationSuccessHandler customOAuth2SuccessHandler;

    public SecurityConfig(AuthenticationSuccessHandler customOAuth2SuccessHandler) {
        this.customOAuth2SuccessHandler = customOAuth2SuccessHandler;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            )
            .oauth2Login(oauth2 -> oauth2
                .successHandler(customOAuth2SuccessHandler) // <--- Register our handler
            );
        return http.build();
    }
}

Accessing User Details

Inside onAuthenticationSuccess, the Authentication object holds the authenticated principal. For OAuth2, this principal will be an OAuth2User.

You can cast it to OAuth2User to access provider-specific attributes like email, name, or unique IDs (e.g., Google ID).

import org.springframework.security.oauth2.core.user.OAuth2User;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;

// Inside onAuthenticationSuccess method:

public void onAuthenticationSuccess(
    HttpServletRequest request,
    HttpServletResponse response,
    Authentication authentication) throws IOException, ServletException {

    if (authentication instanceof OAuth2AuthenticationToken) {
        OAuth2AuthenticationToken oauthToken = (OAuth2AuthenticationToken) authentication;
        OAuth2User oauth2User = oauthToken.getPrincipal();

        String email = oauth2User.getAttribute("email");
        String name = oauth2User.getAttribute("name");
        String provider = oauthToken.getAuthorizedClientRegistrationId();

        logger.info("User logged in: " + name + " from " + provider + " with email: " + email);
        // ... further processing
    }
    response.sendRedirect("/");
}

Practical: Saving User to DB

A common use case is to save or update user information in your database after a successful OAuth2 login. Here's a simplified example:

import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.core.Authentication;
import org.springframework.security.oauth2.core.user.OAuth2User;
import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;
import org.springframework.stereotype.Component;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

// Assume you have a UserService and User entity
// public interface UserService { User saveOrUpdateUser(OAuth2User oauth2User, String provider); }
// public class User { private String email; private String name; /*...*/ }

@Component
public class DatabaseOAuth2SuccessHandler implements AuthenticationSuccessHandler {

    private static final Logger logger = LoggerFactory.getLogger(DatabaseOAuth2SuccessHandler.class);
    // private final UserService userService; // Inject your user service

    // public DatabaseOAuth2SuccessHandler(UserService userService) {
    //     this.userService = userService;
    // }

    @Override
    public void onAuthenticationSuccess(
        HttpServletRequest request,
        HttpServletResponse response,
        Authentication authentication) throws IOException, ServletException {

        if (authentication instanceof OAuth2AuthenticationToken) {
            OAuth2AuthenticationToken oauthToken = (OAuth2AuthenticationToken) authentication;
            OAuth2User oauth2User = oauthToken.getPrincipal();
            String provider = oauthToken.getAuthorizedClientRegistrationId();

            logger.info("Processing OAuth2 user from " + provider);
            // User savedUser = userService.saveOrUpdateUser(oauth2User, provider);
            // logger.info("User saved/updated: " + savedUser.getEmail());
        }
        response.sendRedirect("/");
    }
}

Custom Redirection Logic

The onAuthenticationSuccess method also allows you to control the redirection after login. You can redirect users to a specific dashboard, a profile setup page, or back to the page they were trying to access.

You can use response.sendRedirect("/some-path") or integrate with Spring's RedirectStrategy.

request.getRequestURI(): Get the original request URI.
response.sendRedirect("/"): Redirect to the root.
new DefaultRedirectStrategy().sendRedirect(request, response, "/dashboard"): More robust redirection.

Quick Check: Success Handlers

Which of the following are valid reasons to implement a custom AuthenticationSuccessHandler for OAuth2 in Spring Security?

Recap: Custom Success Handlers

In this lesson, we explored how to customize the post-authentication process for OAuth2 logins using Spring Security's AuthenticationSuccessHandler.

We learned its purpose: extending default behavior for user management, redirection, and auditing.
We saw how to implement the onAuthenticationSuccess method.
We configured our custom handler in the SecurityFilterChain.
We understood how to access OAuth2User details and perform actions like saving users to a database.

Custom success handlers provide powerful control over your application's user experience and data integration after an OAuth2 login.

よくある質問

「カスタムOAuth2成功ハンドラー」レッスンは無料ですか？

はい。「カスタムOAuth2成功ハンドラー」の完全なテキストはこのウェブで無料で読めます。インタラクティブに演習し（組み込みコードエディタと24時間対応のAIチューター）、Spring Security 6 & JWT Authenticationコースの残りをアンロックするには、CoddyKit PROにアップグレードしてください。 Spring Security 6 & JWT Authenticationコースには全4レッスンが含まれています。

「カスタムOAuth2成功ハンドラー」で何を学びますか？

OAuth2認証の成功後にユーザー情報を処理するカスタム成功ハンドラーを開発します。ブラウザで直接実行するハンズオンコードでSpring Security 6 & JWT Authenticationを演習し、24時間対応のAIチューターがレッスンを進める中での質問に答えます。

Spring Security 6 & JWT Authenticationを始めるのに経験は必要ですか？

事前経験は必要ありません。CoddyKitのSpring Security 6 & JWT Authenticationは初級者から上級者向けに構成されているため、ここから始めるか最初から始めて、自分のペースで進むことができます。これはレッスン3/4です。

「カスタムOAuth2成功ハンドラー」レッスンにはどのくらい時間がかかりますか？

ほとんどのCoddyKitレッスンは約5～10分かかります。各レッスンはコンパクトでインタラクティブなので、着実に進歩し、ウェブとアプリ全体で正確に前回の場所から再開できます。

このSpring Security 6 & JWT Authenticationレッスンでコードを書いて実行できますか？

はい。すべてのSpring Security 6 & JWT Authenticationレッスンに組み込みコードエディタが含まれているため、ブラウザでリアルコードを書いて実行し、即座のAIフィードバックを取得できます。ローカル設定は不要です。

このコースのすべてのレッスン

← Spring Security 6 & JWT Authenticationに戻る