Spring AI MCP 安全机制详解
Spring AI MCP的安全模块为模型上下文协议提供了OAuth 2.0和API密钥认证的支持，确保了MCP服务端与客户端之间的安全交互。此开源项目帮助开发者通过标准的认证和授权机制保护MCP环境。
核心组件
- 服务端安全：支持OAuth 2.0资源服务器和API密钥认证。
- 客户端安全：提供OAuth 2.0客户端支持。
- 授权服务器：增强型Spring授权服务器，特别针对MCP功能进行了优化。
依赖配置
在项目的pom.xml中添加以下依赖：
<dependencies>
<dependency>
<groupId>org.springaicommunity</groupId>
<artifactId>mcp-server-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>
</dependencies>
OAuth 2.0 配置示例
配置OAuth 2.0资源服务器：
@Configuration
@EnableWebSecurity
public class SecurityConfig {
@Value("${security.oauth2.resource.jwt.issuer-uri}")
private String issuerUri;
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
return http
.authorizeRequests(authorize -> authorize.anyRequest().authenticated())
.oauth2ResourceServer(oauth2 -> oauth2.jwt(jwt -> jwt.decoder(JwtDecoders.fromIssuerLocation(issuerUri))))
.build();
}
}
API Key 认证
使用API密钥进行认证时，可以自定义ApiKeyEntityRepository接口的实现。例如：
@Configuration
public class ApiKeySecurityConfig {
@Bean
public SecurityFilterChain apiKeySecurityFilterChain(HttpSecurity http) throws Exception {
return http
.authorizeRequests(authz -> authz.anyRequest().authenticated())
.addFilterBefore(new ApiKeyAuthFilter(apiKeyRepo()), UsernamePasswordAuthenticationFilter.class)
.build();
}
private ApiKeyEntityRepository apiKeyRepo() {
return new InMemoryApiKeyEntityRepository(List.of(
new ApiKeyEntity("test-key", "api-key-1", "test-api")
));
}
}
客户端安全
客户端安全模块支持OAuth 2.0，适用于HttpClient和WebClient类型的客户端。以下是基于HttpClient的配置示例：
@Configuration
public class ClientSecurityConfig {
@Bean
public McpSyncClientCustomizer clientCustomizer() {
return (name, spec) -> spec.transportContextProvider(new AuthTransportContextProvider());
}
@Bean
public McpSyncHttpClientRequestCustomizer requestCustomizer(OAuth2AuthorizedClientManager manager) {
return new OAuth2AuthorizationCodeHttpRequestCustomizer(manager, "authserver");
}
}
对于WebClient，可以这样配置：
@Bean
public WebClient.Builder webClientBuilder(OAuth2AuthorizedClientManager manager) {
return WebClient.builder().filter(new OAuth2AuthorizationCodeExchangeFilterFunction(manager, "authserver"));
}
