尝试通过iframe使用Google进行身份验证时，“检测到可能的CSRF-需要状态参数，但找不到状态”

如何解决尝试通过iframe使用Google进行身份验证时，“检测到可能的CSRF-需要状态参数，但找不到状态”

我正在尝试在我的Spring Boot应用程序中实现基于Google的身份验证。一切在 normal 版本（我自己的应用程序）中都可以正常运行，但有时必须通过iframe在第三方网站（具有不同的域）中提供服务。

我无法完成它，因为每次都抛出Possible CSRF detected - state parameter was required but no state Could be found异常。奇怪的是-它仅在Google Chrome浏览器中发生，而在Firefox中没有问题。

我认为cookie /域/会话内容存在一些问题，但是我找不到解决方法。

我正在使用

Spring Boot 1.4.7.RELEASE

spring-security-oauth2

org.springframework.security.oauth:spring-security-oauth2:2.0.14.RELEASE

我的Oauth2过滤器创建如下：

 @Override
    protected void configure(HttpSecurity http) throws Exception {
             http
                .authorizeRequests()
                .anyRequest().authenticated()
                .and().csrf().disable()
                .cors().and()
                .addFilterBefore(oauthFilter(...client),BasicAuthenticationFilter.class)
                .headers().cacheControl().disable();
    }



private Filter oauthFilter(AuthorizationCodeResourceDetails client) {
        oauth2clientAuthenticationProcessingFilter filter = new oauth2clientAuthenticationProcessingFilter("/login/google");
        oauth2resttemplate template = new oauth2resttemplate(client,oauth2clientContext);
        filter.setRestTemplate(template);

        UserInfoTokenServices userInfoTokenServices = new UserInfoTokenServices(...);
        userInfoTokenServices.setPrincipalExtractor(...);
        filter.setTokenServices(userInfoTokenServices);
        filter.setAuthenticationFailureHandler(...);
        filter.setAuthenticationSuccessHandler(...);
        return filter;
    }

完全例外：

org.springframework.security.oauth2.common.exceptions.InvalidRequestException: Possible CSRF detected - state parameter was required but no state Could be found
    at org.springframework.security.oauth2.client.token.grant.code.AuthorizationCodeAccesstokenProvider.getParametersForTokenRequest(AuthorizationCodeAccesstokenProvider.java:255)
    at org.springframework.security.oauth2.client.token.grant.code.AuthorizationCodeAccesstokenProvider.obtainAccesstoken(AuthorizationCodeAccesstokenProvider.java:209)
    at org.springframework.security.oauth2.client.token.AccesstokenProviderChain.obtainNewAccesstokenInternal(AccesstokenProviderChain.java:148)
    at org.springframework.security.oauth2.client.token.AccesstokenProviderChain.obtainAccesstoken(AccesstokenProviderChain.java:121)
    at org.springframework.security.oauth2.client.oauth2resttemplate.acquireAccesstoken(oauth2resttemplate.java:221)
    at org.springframework.security.oauth2.client.oauth2resttemplate.getAccesstoken(oauth2resttemplate.java:173)
    at org.springframework.security.oauth2.client.filter.oauth2clientAuthenticationProcessingFilter.attemptAuthentication(oauth2clientAuthenticationProcessingFilter.java:105)