Spring Boot jjwt安全性在错误请求时不返回任何内容

Question

我的问题是，在发送带有错误登录凭据的请求后，或者在没有身份验证的情况下访问endpoint时，我没有得到任何响应。这是当我发送一个好的请求：好的响应屏幕时的样子

这就是请求主体无效时的情况：无效凭证请求

MyUserDetails类：

public class MyUserDetailService implements UserDetailsService {
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        return new User("foo", "foo", List.of());
    }
}

安全配置类：

public class SecurityConfigurer extends WebSecurityConfigurerAdapter {
    @Autowired
    private MyUserDetailService myUserDetailService;
    @Autowired
    private JwtFilter jwtFilter;

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(myUserDetailService);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return NoOpPasswordEncoder.getInstance();
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/auth").permitAll()
                .anyRequest().authenticated()
                .and().sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and().csrf().disable();
        http.addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
    }
}

Jwt过滤器类别：

@Component
public class JwtFilter extends OncePerRequestFilter {

    @Autowired
    private JwtUtil jwtUtil;
    @Autowired
    private MyUserDetailService myUserDetailService;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        final String authHeader = request.getHeader("Authorization");
        String username = null;
        String requestToken = null;

        if(authHeader != null && authHeader.startsWith("Bearer ")) {
            requestToken = authHeader.substring(7);
            username = jwtUtil.getUsernameFromToken(requestToken);
        }
        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
            UserDetails userDetails = myUserDetailService.loadUserByUsername(username);
            if(jwtUtil.validateToken(requestToken, userDetails)) {
                UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken =
                        new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
                usernamePasswordAuthenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
            }
        }
        filterChain.doFilter(request, response);
    }

最后是我的控制器：

@PostMapping("/auth")
    public AuthResponse auth(@RequestBody AuthRequest authRequest) throws Exception {
        try {
            authenticationManager.authenticate(
                    new UsernamePasswordAuthenticationToken(authRequest.getUsername(), authRequest.getPassword())
            );
        } catch (BadCredentialsException e) {
            throw new Exception("Invalid Credentials", e);
        }
        final UserDetails userDetails = myUserDetailService.loadUserByUsername(authRequest.getUsername());
        final String token = jwtUtil.generateToken(userDetails);
        return new AuthResponse(token);
    }

编辑：我忘了粘贴依赖项。

dependencies {
    implementation 'org.springframework.boot:spring-boot-starter-web'
    implementation 'org.springframework.boot:spring-boot-starter-security'
    implementation 'io.jsonwebtoken:jjwt:0.9.1'
    implementation 'javax.xml.bind:jaxb-api:2.2.4'
    testImplementation 'org.springframework.boot:spring-boot-starter-test'
}

我还有一个AuthRequest和AuthResponse类，其中包含用户名、密码、jwt令牌和所有构造函数、getter和setter（在这里不值得忽略）

Answer 1

在验证时必须抛出一个异常（以下是我使用的，请理解这个概念，您的类和库可能会有所不同）：

Jwts.parser().setSigningKey(your_jwt_secret).parseClaimsJws(token);

因此，如果您的令牌无法被解析，请抛出此代码并发送错误响应：

  httpServletResponse.setContentType("application/json");
  httpServletResponse.getWriter().write("your_custom_error");
  httpServletResponse.getWriter().flush();