我仍然无法让ChannelInterceptor正确工作来验证websocket。我最终做的是重用BearerTokenAuthenticationFilter，但将其配置为将令牌作为查询参数处理。在我的WebsecurityConfigurerAdapter中，我创建了以下bean，然后将它们插入安全过滤器链中，如下所示。

@EnableWebSecurity
@Configuration
public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {

  @Bean
  public JwtDecoder jwtDecoder() {
    NimbusJwtDecoderJwkSupport jwtDecoder =
        (NimbusJwtDecoderJwkSupport) JwtDecoders.fromOidcIssuerLocation(issuerUri);

    return jwtDecoder;
  }

  @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
  public AuthenticationManager myAuthenticationManager() {
    //copied from OAuth2ResourceServerSecurityConfiguration
    JwtAuthenticationProvider authenticationProvider = new JwtAuthenticationProvider(jwtDecoder());
    authenticationProvider.setJwtAuthenticationConverter(new JwtAuthenticationConverter());
    return authenticationProvider::authenticate;
  }

  @Bean("DefaultBearerTokenResolver")
  public DefaultBearerTokenResolver getDefaultBearerTokenResolver() {
    DefaultBearerTokenResolver defaultBearerTokenResolver = new DefaultBearerTokenResolver();
    defaultBearerTokenResolver.setAllowUriQueryParameter(true);
    return defaultBearerTokenResolver;
  }

  @Bean("BearerTokenAuthenticationFilter")
  public BearerTokenAuthenticationFilter getBearerTokenAuthFilter() {
    AuthenticationManager authenticationManager = myAuthenticationManager();
    BearerTokenAuthenticationFilter filter = new BearerTokenAuthenticationFilter(authenticationManager);
    filter.setBearerTokenResolver(getDefaultBearerTokenResolver());

    AuthenticationEntryPoint authenticationEntryPoint = new BearerTokenAuthenticationEntryPoint();
    filter.setAuthenticationEntryPoint(authenticationEntryPoint);

    return filter;
  }

  @Override
  protected void configure(HttpSecurity http) throws Exception {

    http
            .anonymous().disable()
            .logout().disable()
            .csrf().disable()
            .formLogin().disable()
            .addFilterAfter(getBearerTokenAuthFilter()
                    , SecurityContextHolderAwareRequestFilter.class )
            .authorizeRequests()
        .anyRequest()
        .authenticated();
  }

}

我的问题是我从

import org.apache.logging.log4j.core.config.Order;

代替

import org.springframework.core.annotation.Order;

哈哈