Spring Security绕过如果有不同的授权头

Question

我已经用jwt实现了Spring Security性，并且运行良好。

@Configuration
@Component
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomJWTProvider jwtTokenProvider;

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .httpBasic().disable()
                .csrf().disable()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .authorizeRequests()
                .antMatchers("/health").permitAll()
                .anyRequest().authenticated()
                .and()
                .apply(new CustomJwtConfigurer(jwtTokenProvider));

    }

    @Override
    public void configure(WebSecurity web) {
        web.ignoring().antMatchers(HttpMethod.OPTIONS, "/**");
    }
}

@Component
public class CustomFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterchain) throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        String authToken = httpRequest.getHeader("Authorization");
        if(myCustomValidator(authToken)){
            //if this is true it should skip spring security jwt token verification
            //which is in configure phase
        }else{
            HttpServletResponse httpResponse = (HttpServletResponse) response;
            httpResponse.sendError(403, "Access denied");
        }
        System.out.println("authToken="+authToken);
        filterchain.doFilter(request, response);
    }
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {}

    @Override
    public void destroy() {}
}

Answer 1

可以使用OncePerRequestFilter。您需要创建一个类，并在重写它的方法（doFilterInternal）的地方扩展这个类，并将逻辑放在那里。

您可以如下所示配置该筛选器。

    @Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    public class YourClass extends WebSecurityConfigurerAdapter {
        @Autowired
        private YourFilter authFilter;
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.addFilterAt(authFilter, UsernamePasswordAuthenticationFilter.class);
        }
    }