在Spring Security过滤器链之前设置Cookie

Question

我想设置一个推荐人cookie，因为我需要排除一些页面（例如错误、登录、注销等）要在登录后重定向到上次调用但未被排除的页面，请执行以下操作：

public class CookieReferrerFilter extends OncePerRequestFilter {
    public static final String REFERRER_COOKIE_NAME = "REFERRER";

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        if (!isReferrerExcluded(request)) {
            Cookie sessionCookie = new Cookie(REFERRER_COOKIE_NAME, request.getRequestURI());
            sessionCookie.setPath(!"".equals(request.getContextPath()) ? request.getContextPath() : "/");
            sessionCookie.setSecure(false);
            sessionCookie.setMaxAge(-1);

            response.addCookie(sessionCookie);
        }

        filterChain.doFilter(request, response);
    }

    private boolean isReferrerExcluded(HttpServletRequest request) {
        for (String pattern : EXCLUDED_REFERRER) {
            if (new AntPathRequestMatcher(pattern).matches(request)) {
                return true;
            }
        }

        return false;
    }
}

但是Spring Security过滤链在CookiierReferrerFilter之前就被触发了。因此，调用安全页面将立即将我重定向到登录页面，而无需调用CookiierReferrFilter。doFilterInternal之前，没有设置cookie。

有一个类配置WebApp（设置配置类、映射、过滤器），它扩展了AbstractAnnotationConfigDispatcherServletializer：

public class WebAppInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {
    @Override
    protected Class<?>[] getRootConfigClasses() {
        return new Class[] { ApplicationContextConfig.class };
    }

    @Override
    protected Class<?>[] getServletConfigClasses() {
        return null;
    }

    @Override
    protected String[] getServletMappings() {
        return new String[] { "/" };
    }

    @Override
    protected Filter[] getServletFilters() {
        CookieReferrerFilter cookieReferrerFilter = new CookieReferrerFilter();

        CharacterEncodingFilter characterEncodingFilter = new CharacterEncodingFilter();
        characterEncodingFilter.setEncoding("UTF-8");
        characterEncodingFilter.setForceEncoding(true);

        return new Filter[] { cookieReferrerFilter, characterEncodingFilter };
    }
}

还有一个扩展了AbstractSecurityWebApplicationInitializer：

public class SecurityInitializer extends AbstractSecurityWebApplicationInitializer {
}

Answer 1

假设您使用的是基于Java的Spring Security配置，您只需让您的过滤器由Spring管理，并将其添加到Spring Security过滤器链的开头（从HttpSecurity javadoc中的示例中得到了很大启发（请参见下面的链接）：

 @Configuration
 @EnableWebSecurity
 public class HttpSecurityConfig extends WebSecurityConfigurerAdapter {

     @Autowired  CookieReferrerFilter cookieFilter;

     @Autowired CharacterEncodingFilter encodingFilter;

     @Override
     protected void configure(HttpSecurity http) throws Exception {
         http
             .addFilterBefore(cookieFilter, ChannelProcessingFilter.class)
             .addFilterBefore(encodingFilter, ChannelProcessingFilter.class)
               //your configuration follows here
                ; 
      }
   }

有关详细信息，请参阅http://docs.spring.io/autorepo/docs/spring-security/current/apidocs/org/springframework/security/config/annotation/web/builders/HttpSecurity.html#addFilter（javax.servlet.过滤器）。