如何修复Spring Security授权头未被传递？

Question

在我的一个REST服务中，我使用Spring Security性来验证在头中传递的令牌。然而，spring无法找到“authorization”标头，尽管它在那里。当在测试中测试时，甚至在本地测试时，这都不是一个问题，但当我们部署到PROD时，我们就会遇到这个问题。

作为替代/变通方法，我删除了Spring Security性，而是尝试在实际endpoint中验证我的令牌，然后继续处理请求的其余部分，如下所示：

@PostMapping(value="/create",consumes="application/json; charset=utf-8")
    @CrossOrigin
    public ResponseEntity createAccount(@RequestBody MerchantAccount merchantAccount,@RequestHeader(name="Authorization") String token) {
        log.info("Checking User Token");
        if(!jwtUtil.isAuthorizedToken(token))
            return ResponseEntity.status(401).build();
//some creating Account Logic
}

如果我再次做了上面的工作，它将在测试和本地工作，但不是在Prod。我会得到的错误将是“丢失授权头”。但它又一次出现了。（从邮递员到测试）。

Prod上的java版本:java版本“1.8.0_121”

本地java版本:java版本“1.8.0_221”

在测试中，我们使用HTTP和PROD它是HTTPS。POM文件中的Spring Security版本是5.2

 @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        final CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(ImmutableList.of("*"));//YOLO Allow all origins, we can change this once we go to prod
        configuration.setAllowedMethods(ImmutableList.of("HEAD",
                "GET", "POST", "PUT", "DELETE", "PATCH","OPTIONS"));//Allowed Methods
        configuration.setAllowCredentials(true);
        configuration.setAllowedHeaders(ImmutableList.of("Authorization", "Cache-Control", "Content-Type","Access-Control-Request-Headers","Access-Control-Request-Method",
               "Accept","Access-Control-Allow-Headers"));//Allowed Headers
        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }

@Component
@Service
public class JwtRequestFilter extends OncePerRequestFilter {


    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException {
        logger.info("Done Getting Headers");
        Collections.list(request.getHeaderNames()).forEach(item -> logger.info("header name is " + item));
        logger.info("Done Getting Headers");
        boolean isAccessToken = true;
        final String requestTokenHeader = request.getHeader("authorization");//This is null as the Authorization header is not found in request
}

Answer 1

在游荡的星系之后...

我用这个修复了它：

@Configuration
@EnableWebSecurity
public class Config extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors().and() /*.other stuff */;
    }
}

基本上，您需要使用http对象启用cors()。然后有多种方法来处理每个控制器/方法的CRO原点或全局的CRO原点。

@Bean
public WebMvcConfigurer corsConfigurer() {
    return new WebMvcConfigurer() {
        @Override
        public void addCorsMappings(CorsRegistry registry) {
            registry
                  .addMapping("/greeting-javaconfig")
                  .allowedOrigins("http://localhost:8080");
        }
    };
}

@CrossOrigin(origins = "http://localhost:8080")
@GetMapping("/greeting")
public String greeting() {
    return "works!";
}

参考：

所以回答，Spring官方指南