如何将当前添加到响应的auth头的承载令牌添加到响应体？

Question

我通过使用承载令牌实现了对SpringBoot API的授权，当登录成功时，该令牌被添加到响应的“授权”头中，然后需要通过React项目的登录获取方法读取该令牌，并添加到后续请求的“授权”头中。

不幸的是，虽然我被告知这是不可能使用Fetch，所以我现在试图重构我的登录功能，以便它返回响应正文中的令牌，而不是标题。

我不知道如何做到这一点，目前没有返回JSON正文对象，只有标头，我将不得不更改我的许多AuthorizationFilter和身份验证过滤器类。如果有人能给我指明正确的方向，或者建议我改变什么，我将不胜感激。

谢谢

授权筛选器：

public class AuthorizationFilter extends BasicAuthenticationFilter {

public AuthorizationFilter(AuthenticationManager authenticationManager) { super(authenticationManager);}

protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)

        throws IOException, ServletException {

        String header = request.getHeader("Authorization");

        if(header == null || !header.startsWith("Bearer")) {

        filterChain.doFilter(request,response);

        return;
        }

        UsernamePasswordAuthenticationToken authenticationToken = getAuthentication(request);

        SecurityContextHolder.getContext().setAuthentication(authenticationToken);

        filterChain.doFilter(request,response);

        }


private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request) {
        String token = request.getHeader("Authorization");
        if(token != null) {

        String user = Jwts.parser().setSigningKey("SecretKeyToGenJWTs".getBytes())
        .parseClaimsJws(token.replace("Bearer",""))
        .getBody()
        .getSubject();

        if(user != null) {

        return new UsernamePasswordAuthenticationToken(user, null, new ArrayList<>());

        }
        return null;
        }
        return null;
        }
}

AuthenticationFilter：

   public class AuthenticationFilter extends UsernamePasswordAuthenticationFilter {

        private AuthenticationManager authenticationManager;

        public AuthenticationFilter(AuthenticationManager authenticationManager) {
            this.authenticationManager = authenticationManager;
            setFilterProcessesUrl("/login");
        }
        @Override

        public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
            try {

                com.example.gambit2.domain.User creds = new ObjectMapper().readValue(request.getInputStream(), com.example.gambit2.domain.User.class);
                return authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(creds.getUsername(), creds.getPassword(),new ArrayList<>()));
            }

        catch(IOException e) {

                throw new RuntimeException("Could not read request" + e);
            }

        }
        protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain, Authentication authentication)
        {
            String token = Jwts.builder()
                    .setSubject(((User) authentication.getPrincipal()).getUsername())
                    .setExpiration(new Date(System.currentTimeMillis() + 864_000_000))
                    .signWith(SignatureAlgorithm.HS512, "SecretKeyToGenJWTs".getBytes())
                    .compact();
            response.addHeader("Authorization","Bearer " + token);


        }
    }

UserController的注册方法：

@PostMapping("/signup")
        public void signUp(@RequestBody User user) {
                user.setPassword(bCryptPasswordEncoder.encode(user.getPassword()));
                userRepository.save(user);
                System.out.println(user.getUsername() + " SAVED SUCCESSFULLY");
        }

反应Home.js：

const SIGNUP_URL = 'http://localhost:8080/users/signup';
const LOGIN_URL = 'http://localhost:8080/login';
class Home extends Component {

    constructor(props) {
        super(props);
        this.state = {
            isAuthenticated:false,
            resData: ''
        };
    }

    componentDidMount() {
        const payload = {
            "username": "hikaru",
            "password": "JohnSmith72-"
        };
        fetch(SIGNUP_URL, {
            method: 'POST',
            headers: {
                "Accept": "application/json",
                "Content-Type": "application/json"
            },
            body: JSON.stringify(payload)
        })
            .then(response => response.json())
            .then((data) => {
                console.log(data);
            });
        fetch(LOGIN_URL, {
            method: 'POST',
            headers: {
                "Accept": "application/json",
                "Content-Type": "application/json"
            },
            body: JSON.stringify(payload)
        })
            .then(response =>

                console.log(response.headers.get("Authorization")
            );

    }

在上面的获取调用中，/signup成功，并且服务器输出“Tim成功保存”，登录也成功，但是令牌作为响应发送，并且“控制台”。日志（response.headers.get（“Authorization”）返回“null”。

我知道CORS读取将不适用于auth头，因为它只能用于喜欢4头，对吗？

我尝试添加一个方法，该方法循环遍历每个条目并打印它们，然后在中调用它。那么（）就其本身而言：

.then(response => this.iterateThroughEntries(response)
        );

但这只打印默认标题，而不是auth标题。

谢啦

Answer 1

我通过将“localhost:8080”“localhost:3000”添加为源并将授权标头添加为公开标头来更新WebSecurity配置类中的CorsSource，从而成功地从服务器获取授权标头，以便CORS请求可以使用它。

configuration.addExposedHeader("Authorization");