我们有类似的问题，我记得最终我们使用二级缓存来提高性能，你也可以缓存这个方法的结果findByUsername
看看这些样本：
https://www.baeldung.com/spring-cache-tutorial
https://medium.com/@himani.prasad016/caching-in-hibernate-3ad4f479fcc0的
Spring中的saveAll()只是在后台调用save()

public <S extends T> List<S> saveAll(Iterable<S> entities) {

    Assert.notNull(entities, "Entities must not be null");

    List<S> result = new ArrayList<>();

    for (S entity : entities) {
        result.add(save(entity));
    }

    return result;
}

字符串

您可以实现CustomAuthenticationConverter（扩展org.springframework.core.convert.converter.Converter）
将JWT token转换为
CustomAuthenticationToken（扩展org.springframework.security.authentication.AbstractAuthenticationToken）
在此转换器中，您可以将数据库中的User信息放入CustomAuthenticationToken.details字段中。
此CustomAuthenticationToken可通过以下方式访问：
(CustomAuthenticationToken) SecurityContextHolder.getContext().getAuthentication()个
您可以在SecurityFilterChain配置中注册自定义转换器。

@RequiredArgsConstructor
public class CustomAuthenticationConverter implements Converter<Jwt, CustomAuthenticationToken> {

    private final UserRepository userRepository;

    @Override
    public CustomAuthenticationToken convert(final Jwt jwt) {
        //TODO: Convert JWT to Authentication object.
        User user = userRepository.findByUsername(username);
        CustomAuthenticationToken authentication = new CustomAuthenticationToken();
        authentication.setDetails(user);
        return authentication;
    }
}

@Component
public class AuditorAwareImpl implements AuditorAware<User> {

    @Override
    public Optional<User> getCurrentAuditor() {
        CustomAuthenticationToken authentication = (CustomAuthenticationToken) SecurityContextHolder.getContext().getAuthentication();
        return Optional.of(authentication)
                .map(Authentication::getDetails)
                .map(User.class::cast);
    }
}

@EnableWebSecurity
@RequiredArgsConstructor
public class SecurityConfig {

    private final UserRepository userRepository;

    @Bean
    protected SecurityFilterChain configure(final HttpSecurity httpSecurity) throws Exception {
        ...

        httpSecurity
            .jwtAuthenticationConverter(new CustomAuthenticationConverter(userRepository));
        return httpSecurity.build();

    }
}

字符串
这样您就不需要一直调用数据库，因为SecurityContext中有User信息。

据我所知，您正在使用Spring Security资源服务器，因此您可以使用自定义声明转换器在我的项目中，我使用了以下配置

public SecurityFilterChain configure(HttpSecurity http) throws Exception {
    return http
            .authorizeHttpRequests(exchanges ->
                    exchanges
                            .requestMatchers("/v3/api-docs/**",
                                    "/v3/api-docs.yaml",
                                    "/swagger-ui/**",
                                    "/swagger-ui.html")
                                .permitAll()
                            .requestMatchers("/protected/**")
                                .authenticated())
            .csrf(httpSecurityCsrfConfigurer -> {
                httpSecurityCsrfConfigurer.disable();
            })
            .oauth2ResourceServer(oauth2ResourceServer -> oauth2ResourceServer.jwt(jwtConfigurer -> {
                jwtConfigurer.decoder(jwtDecoder());
            }))
            .headers(headerSpec -> {
                headerSpec.contentSecurityPolicy(contentSecurityPolicySpec -> {
                    contentSecurityPolicySpec.policyDirectives(
                                    "script-src 'strict-dynamic' 'nonce-rAnd0m123' 'unsafe-inline' http: https:;" +
                                    "default-src 'self'; "+
                                    "object-src 'none';" +
                                    "base-uri 'none';" +
                                    "require-trusted-types-for 'script';"
                    );
                }).xssProtection(xssProtectionSpec -> {
                    /*According to this https://docs.spring.io/spring-security/reference/features/exploits/headers.html#headers-xss-protection
                     and this https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-xss-protection
                     we need to disable X-XSS-Protection and give precedence to CSP https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#content-security-policy-csp
                     */
                    xssProtectionSpec.headerValue(XXssProtectionHeaderWriter.HeaderValue.DISABLED);
                });
            })
            .build();
}

@Bean

public BCryptPasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

// @Bean
public JwtDecoder jwtDecoder() {
    try {
        NimbusJwtDecoder decoder = JwtDecoders.fromOidcIssuerLocation(env.getProperty("issuer-uri"));
        decoder.setClaimSetConverter(new OauthSubClaimAdapter());
        return decoder;
    } catch (Exception e) {
        throw new IllegalStateException("Impossibile proseguire. Avvenuto errore nella creazione del jwtDecoder",
                e);
    }
}

字符串
我的OauthSubClaimAdapter是：

public class OauthSubClaimAdapter implements Converter<Map<String, Object>, Map<String, Object>> {

  public static final String LOGGED_USER_INFO = "loggedUserInfo";
  private final MappedJwtClaimSetConverter delegate = MappedJwtClaimSetConverter.withDefaults(
      Collections.emptyMap());

  @Override
  public Map<String, Object> convert(Map<String, Object> claims) {
    Map<String, Object> convertedClaims = this.delegate.convert(claims);
    if (null == convertedClaims) {
      throw new IllegalStateException(
          String.format("Impossible continue; no converted claim found in %s",
              getClass().getName()));
    }
    String username = (String) convertedClaims.get("sub");
    //Here you can put your logic in order to enrich the user recovered from the JWT token
    convertedClaims.put(LOGGED_USER_INFO, enrichedUser);
    return convertedClaims;
  }
}

型
在您的身份验证对象中，现在您可以检索所有包含LOGGED_USER_INFO对象的JWT声明