在Spring云网关的Spring Security过滤链中插入自定义过滤器

Question

 @Bean
 @Order(1)
 SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity serverHttpSecurity)
  throws Exception {
        ServerRequestCache requestCache = NoOpServerRequestCache.getInstance();
        WebFilter webFilter = new CustomWebFilter();
        serverHttpSecurity
          //.addFilterAt(webFilter, SecurityWebFiltersOrder.FIRST)
          .cors().and().headers()
          .frameOptions().disable()
          .and().requestCache().requestCache(requestCache)
          .and().csrf().disable()
          .authorizeExchange().pathMatchers("/**").authenticated()
          .and().oauth2Login()
          .and().oauth2Client()
          .and().oauth2ResourceServer().jwt();
     return serverHttpSecurity.build();
   }

.addFilterAt(webFilter, SecurityWebFiltersOrder.FIRST)

public class CustomWebFilter implements WebFilter {

    @Autowired
    URIconfig uRIconfig;
    final Logger logger = LoggerFactory.getLogger(CustomWebFilter.class);

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
      URI location = exchange.getRequest().getURI();
      uRIconfig.setLocation(location);
      logger.info("Custom Pre Filter executed");
       return chain.filter(exchange);
    }
 }

Answer 1

通过将spring security filter chain的顺序更改为5，我解决了这个问题，并在我的自定义过滤器中添加了@order(ordered.highest_preasence)。现在，我的过滤器在我的keycloak登录页面之前调用，我可以添加我的自定义实现。以下是我所做的更改：

application.yml

spring:
  security:
    filter:
      order: 5

CustomWebFilter.java

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
@Slf4j
public class CustomWebFilter implements WebFilter {

  @Override
  public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
    log.info("My Custom Web Filter.");
    return chain.filter(exchange);
  }
}