如何在Spring Security登录请求处理之前拦截它？

Question

我试图在spring security开始处理或到达spring security拦截器之前拦截登录请求。我想这样做是因为我必须对用户的输入进行一些验证。因此，我从HandlerInterceptorAdapter类创建了一个拦截器，但它不起作用。

所以我想做的是：

当任何用户尝试使用用户名和密码登录时，该请求必须首先到达LoginRequestInterceptor。对用户输入进行一些验证，如果成功，将此请求传递给spring security login processing url，或者其他一些url。

public class LoginRequestInterceptor extends HandlerInterceptorAdapter {

    private static final Logger logger = LogManager.getLogger(LoginRequestInterceptor.class);

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
            throws Exception {
        logger.debug("Interceptor working pre");
        return super.preHandle(request, response, handler);
    }

<http auto-config="true" use-expressions="true">
    <intercept-url  pattern="/Candidate/**" access="hasRole('ROLE_USER')" />
    <!-- access denied page -->
    <access-denied-handler error-page="/403" />
    <form-login 
        login-processing-url="/login"
        login-page="/" 
        default-target-url="/Candidate"
        authentication-failure-url="/error=1" 
        username-parameter="registerationid"
        password-parameter="password" 
        />
    <logout logout-success-url="/?logout" />
    <custom-filter ref="loginRequestInterceptors" position="FIRST"/>
    <!-- enable csrf protection -->
    <csrf />
</http>

<authentication-manager id="authenticationManager">
    <authentication-provider user-service-ref="candidateDetailServices" />
</authentication-manager>

Spring dispatcher xml

    <bean id="loginRequestInterceptor" class="org.ibps.clerk.inteceptors.login.LoginRequestInterceptor"></bean>
    <mvc:interceptors>
        <mvc:interceptor>
            <mvc:mapping path="/login"/>
            <ref bean="loginRequestInterceptor"/>
        </mvc:interceptor>
    </mvc:interceptors>
</beans>

所以最后我想知道这是否可能？如果是，那么请分享链接或解决方案。

Answer 1

您应该创建一个类（例如CustomFilter)，扩展UsernamePasswordAuthenticationFilter，然后在AttributeThentication中执行您的操作，然后调用Super.AttributeThencication；

然后，您应该在扩展WebSecurityConfigurerAdapter的安全配置类中进行解释。

@Configuration
@EnableWebSecurity
public class SecurityConfigs extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
        http.addFilterBefore(getCustomFilter()
        ,UsernamePasswordAuthenticationFilter.class)
            .formLogin()
            .and() // more configs ...
}


public CustomFilter getCustomFilter() throws Exception {
    CustomFilter filter= new CustomFilter ("/loginuser","POST");
    filter.setAuthenticationManager(authenticationManagerBean());
    filter.setAuthenticationFailureHandler((request, response, exception) -> {
        response.sendRedirect("/login?error");
    });
    return filter;
}

和CustomFilter类：

public class CustomFilter extends UsernamePasswordAuthenticationFilter {

    public CustomFilter (String urlLogin, String method) {
        setRequiresAuthenticationRequestMatcher(new AntPathRequestMatcher(urlLogin, method));
    }


    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        // do your stuff ...

        return super.attemptAuthentication(request, response);
    }
}