Spring Boot/Spring Security AuthenticationEntryPoint未执行

Question

@Override
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
    Authentication authentication = null;

    if(hasJsonToken(request)) {
        JwtAuthenticationToken jwtAuthenticationToken = new JwtAuthenticationToken(getJsonToken(request)); 
        authentication = getAuthenticationManager().authenticate(jwtAuthenticationToken);           
    } else {
        throw new AuthenticationCredentialsNotFoundException(AUTHENTICATION_CREDENTIALS_NOT_FOUND_MSG);
    }

    return authentication;
}

@Override
public void commence(HttpServletRequest request, HttpServletResponse response,
        AuthenticationException authException) throws IOException, ServletException {   
response.sendError(HttpStatus.UNAUTHORIZED.value(),HttpStatus.UNAUTHORIZED.getReasonPhrase());
}

@Bean
public RestAuthenticationEntryPoint restAuthenticationEntryPoint() {
    return new RestAuthenticationEntryPoint();              
}

protected void configure(HttpSecurity http) throws Exception {
    http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)
        .exceptionHandling().authenticationEntryPoint(restAuthenticationEntryPoint()).and()
        .csrf().disable()
        .authorizeRequests().antMatchers(AUTHORISED_SERVICE_REQUESTS_ANT_MATCHER).authenticated()
        .anyRequest().permitAll();      
}

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    ...
}

jwtAuthenticationFilter.setAuthenticationFailureHandler(new JwtAuthenticationFailureHandler());

我现在的问题是，这样做正确吗？AuthenticationEntryPoint和AuthenticationFailureHandler之间有什么区别？

Answer 1

AuthenticationEntryPoint和AuthenticationFailureHandler之间的区别在于前者用于“告诉”未经身份验证的用户在哪里进行身份验证，例如，通过将他们重定向到登录表单。后者用于处理错误的登录尝试。

您的AuthenticationEntryPoint可能没有被调用，因为您引发了异常。如果用户试图访问一个需要身份验证的endpoint，而您没有抛出任何东西，则会调用它。在没有凭据的情况下，不对用户进行身份验证就足够了，您不需要抛出异常。

如果使用JWT身份验证创建应用程序，您可能不想将用户重定向到任何地方，这样您就可以使用org.springframework.security.web.authentication.httpstatusentrypoint或类似于您的入口点来返回状态代码。