带有permitAll（）和过期Auth令牌的URL的Spring Security性

Question

@Configuration
@ComponentScan(basePackages={"com.api.security"})
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private ApiAuthenticationProvider apiAuthenticationProvider;

@Autowired
private AuthTokenHeaderAuthenticationFilter authTokenHeaderAuthenticationFilter;

@Autowired
private AuthenticationEntryPoint apiAuthenticationEntryPoint;

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) {
    auth.authenticationProvider(apiAuthenticationProvider);
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .addFilterBefore(authTokenHeaderAuthenticationFilter, BasicAuthenticationFilter.class) // Main auth filter
        .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS);

    http.authorizeRequests()
        .antMatchers(HttpMethod.POST, "/v2/session").permitAll()
        .anyRequest().authenticated();

    http.exceptionHandling()
        .authenticationEntryPoint(apiAuthenticationEntryPoint);
}
}

/**
 * Main Auth Filter. Always sets Security Context if the Auth token Header is not empty
 */
@Component
public class AuthTokenHeaderAuthenticationFilter extends GenericFilterBean {

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    final String token = ((HttpServletRequest) request).getHeader(RequestHeaders.AUTH_TOKEN_HEADER);
    if (StringUtils.isEmpty(token)) {
        chain.doFilter(request, response);
        return;
    }

    try {
            AuthenticationToken authRequest = new AuthenticationToken(token);

              SecurityContextHolder.getContext().setAuthentication(authRequest);
        }
    } catch (AuthenticationException failed) {
        SecurityContextHolder.clearContext();

        return;
    }

    chain.doFilter(request, response); // continue down the chain
}

}

自定义apiAuthenticationProvider将尝试基于标头中提供的令牌对所有请求进行身份验证，如果身份验证不成功，则抛出AccessException，客户端将收到HTTP 401响应：

@Component
public class ApiAuthenticationProvider implements AuthenticationProvider {

@Autowired
private remoteAuthService remoteAuthService;

@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {

    AuthenticationToken authRequest = (AuthenticationToken) authentication;
    String identity = null;

    try {
        identity = remoteAuthService.getUserIdentityFromToken(authRequest.getToken());
    } catch (AccessException e) {
        throw new InvalidAuthTokenException("Cannot get user identity from the token", e);
    }

    return new AuthenticationToken(identity, authRequest.getToken(), getGrantedAuthorites());
    }
    }

这对于需要身份验证的请求非常有效。对于没有身份验证标头的/v2/session请求，这很好。但是，对于/v2/session请求，如果在头部（或在cookie中--代码示例中没有显示；如果客户机没有清除头部或继续发送带有请求的cookie，有时可能会发生这种情况）中有一个过期的Auth令牌，则安全上下文将被初始化，apiAuthenticationProvider将抛出一个异常，并用HTTP 401响应客户机。

http.authorizeRequests()
        .antMatchers(HttpMethod.POST, "/v2/session").permitAll()

我希望Spring Security性在调用apiauthenticationProvider.authenticate（）之前确定这一点。对于配置为permitAll（）的URL，过滤器或auth提供者应该如何忽略/不抛出异常？

Answer 1

在执行请求授权检查之前触发Spring Security过滤器。为了使授权检查发挥作用，假定请求已经通过过滤器，并且已经设置了Spring Security上下文（是否设置，取决于是否传入了身份验证凭据）。

在您的筛选器中，如果令牌不在，您可以检查是否继续进行筛选器链处理。不幸的是，如果它是，那么它将被传递给您的提供者进行身份验证，这将引发异常，因为令牌已经过期，因此您将获得401。

最好的办法是对您认为是公共的URL跳过筛选器执行。您既可以在筛选器本身中执行此操作，也可以在配置类中执行此操作。将以下方法添加到SecurityConfig类中：

@Override
public void configure(WebSecurity webSecurity) {
  webSecurity.ignoring().antMatchers(HttpMethod.POST, "/v2/session");
}