Customizing OAuth2 Authorization Code Flow Pages in Spring Cloud Alibaba

The author introduces a practical guide for customizing the OAuth2 authorization‑code flow pages—login, consent, and error—in a Spring Cloud Alibaba project, addressing the default unattractive pages and showing how to replace them with tailored HTML templates.

1. Customizing the login page

First, create a custom HTML file (e.g., oauth-login.html ) and place it in the templates directory. Then define a controller method to return this view:

@ApiOperation(value = "表单登录跳转页面")
@GetMapping("/oauth/login")
public String loginPage(Model model){
    //返回跳转页面
    return "oauth-login";
}

Finally, configure Spring Security to use this URL as the login page, setting loginProcessingUrl for the form submission and .loginPage for the custom page.

2. Customizing the authorization (consent) page

Create a custom HTML file (e.g., oauth-grant.html ) and define a controller that maps to the default consent endpoint /oauth/confirm_access :

@ApiOperation(value = "处理授权异常的跳转页面")
@GetMapping("/oauth/error")
public String error(Model model){
    return "oauth-error";
}

Make sure the controller is annotated with @SessionAttributes("authorizationRequest") so that the authorization request stored in the session is available to the view. If the custom endpoint differs from the default /oauth/confirm_access , update the AuthorizationServerConfigurerAdapter configuration accordingly.

3. Customizing the error page

Similarly, create oauth-error.html and expose a controller method for /oauth/error (the same URL used by Spring Security for error handling). The method simply returns the custom view name.

When an invalid client_id or other exception occurs, Spring Security will render the custom error page instead of the default one.

Example request URL

http://localhost:9001/blog-auth-server/oauth/authorize?client_id=mugu&response_type=code&scope=all&redirect_uri=http://www.baidu.com

By following these three steps—creating custom HTML pages, defining corresponding controller endpoints, and adjusting the security configuration—the default OAuth2 pages can be fully replaced with tailored designs that match the overall system UI.