Spring Security 5 api密钥过滤器

Question

我正试图用spring security 5和boot 2创建一个过滤器，用一个API键保护一些但不是所有的endpoint，并且没有会话。然而，在过滤器对其进行身份验证之后，由于SavedRequestAwareAuthenticationSuccessHandler有一个空的请求缓存，因此它倾向于重定向到“/”,而不是原始url。

我如何才能让它继续使用目标资源而不是“/”，以及为什么它像这样工作？

如果有人能向我解释为什么抽象身份验证处理过滤器被设计为在成功身份验证后继续使用过滤器链，而抽象身份验证处理过滤器不是，我将不胜感激。

这是安全配置类：

@Configuration
@Order(SecurityProperties.BASIC_AUTH_ORDER - 10)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Value("${secret.admin.api.key}")
    String validApiKey;

    @Override
    protected void configure(AuthenticationManagerBuilder builder) throws Exception {
        builder.authenticationProvider(new ApiKeyAuthenticationProvider(validApiKey));
    }

    @Override
    protected void configure(HttpSecurity security) throws Exception {
        security
            .csrf().disable()
            .sessionManagement()
                .sessionCreationPolicy(STATELESS)
                .and()
            .addFilterBefore(new ApiKeyAuthenticationFilter(authenticationManager()), AnonymousAuthenticationFilter.class)
            .requestMatchers()
                .antMatchers("/v1/admin/**")
                .antMatchers("/actuator/**")
                .and()
            .authorizeRequests().anyRequest().authenticated();
    }

}

我的筛选器匹配具有自定义值的Authorization头的请求。从标头提取api密钥，并将带有主体和凭据（api密钥）的令牌传递给身份验证管理器。

public class ApiKeyAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

//...

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
        throws AuthenticationException, IOException, ServletException {
        var apiKey = extractApiKey(request.getHeader(AUTHORIZATION));
        var token = new ApiKeyAuthenticationToken(apiKey);
        var authentication = getAuthenticationManager().authenticate(token);
        return authentication;
    }

//...
}

以下类验证凭据并使用主体创建和验证令牌，但不包含凭据：

public class ApiKeyAuthenticationProvider implements AuthenticationProvider {

// ...

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        var apiKey = (String) authentication.getCredentials();
        if (validApiKey.equals(apiKey)) {
            var auth = new ApiKeyAuthenticationToken();
            auth.setAuthenticated(true);
            return auth;
        } else {
            throw new BadCredentialsException("Bad ApiKey credentials");
        }
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return ApiKeyAuthenticationToken.class.isAssignableFrom(authentication);
    }

}

还有日志：

OrRequestMatcher: Trying to match using Ant [pattern='/v1/admin/**']
AntPathRequestMatcher: Checking match of request : '/v1/admin/namespace'; against '/v1/admin/**'
OrRequestMatcher: matched
FilterChainProxy$VirtualFilterChain: /v1/admin/namespace at position 1 of 11 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
FilterChainProxy$VirtualFilterChain: /v1/admin/namespace at position 2 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
FilterChainProxy$VirtualFilterChain: /v1/admin/namespace at position 3 of 11 in additional filter chain; firing Filter: 'HeaderWriterFilter'
FilterChainProxy$VirtualFilterChain: /v1/admin/namespace at position 4 of 11 in additional filter chain; firing Filter: 'LogoutFilter'
[...]
FilterChainProxy$VirtualFilterChain: /v1/admin/namespace at position 5 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
FilterChainProxy$VirtualFilterChain: /v1/admin/namespace at position 6 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
FilterChainProxy$VirtualFilterChain: /v1/admin/namespace at position 7 of 11 in additional filter chain; firing Filter: 'ApiKeyAuthenticationFilter'
ProviderManager: Authentication attempt using ....security.ApiKeyAuthenticationProvider
AbstractAuthenticationTargetUrlRequestHandler: Using default Url: /
DefaultRedirectStrategy: Redirecting to '/'

我试图在这个基础上让这个工作。

Answer 1

我不得不覆盖过滤器中的successfulAuthentication方法，并继续这个链以使它工作。

@Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response,
        FilterChain chain, Authentication authResult) throws IOException, ServletException {

        log.info("Successful authentication");
        SecurityContextHolder.getContext().setAuthentication(authResult);
        chain.doFilter(request,response);
    }