Spring启动安全-两个不同的过滤器

Question

我试图用两个不同的过滤器来配置spring security。我想要的是有一些将由一个过滤器处理的网址，和一些将由其他过滤器处理的网址。这是我想到的设置:

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true,prePostEnabled=true)
public class SecurityConfigurationContext {

    @Order(1)
    @Configuration
    public static class ConfigurerAdapter1 extends WebSecurityConfigurerAdapter{
        ...

        @Override
        protected void configure(final HttpSecurity http) throws Exception {
            // Handlers and entry points
            http.exceptionHandling()
                .authenticationEntryPoint(MyCustomAuthenticationEntryPoint);


            http.authorizeRequests()
                .antMatchers(HttpMethod.GET, "/filter1-urls/*").hasRole("USER");


            http.addFilterBefore(myCustomFilter1, ChannelProcessingFilter.class);

            http.csrf().disable();
            http.httpBasic()
                .and()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.userDetailsService(myCustomAuthenticationService)
                .passwordEncoder(new BCryptPasswordEncoder());
        }
    }

    @Order(2)
    @Configuration
    public static class ConfigurerAdapter2 extends WebSecurityConfigurerAdapter{
        ...

        @Override
        protected void configure(final HttpSecurity http) throws Exception {
            // Handlers and entry points
            http.exceptionHandling()
                .authenticationEntryPoint(MyCustomAuthenticationEntryPoint);


            http.authorizeRequests()
                .antMatchers(HttpMethod.GET, "/filter2-urls/*").hasRole("SUPER_USER");


            http.addFilterBefore(myCustomFilter2, ChannelProcessingFilter.class);

            http.csrf().disable();
            http.httpBasic()
                .and()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.userDetailsService(myCustomAuthenticationService)
                .passwordEncoder(new BCryptPasswordEncoder());
        }
    }
}

过滤器看起来像这样：

过滤器1 ：

@Component
@Order(1)
public final class MyCustomFilter1 implements Filter{

    public MyCustomFilter1() {
        super();
    }

    @Override
    public final void doFilter(final ServletRequest req, final ServletResponse res, final FilterChain chain) throws IOException, ServletException {
        // logic for processing filter1-urls
    }
}

过滤器2 ：

@Component
@Order(2)
public final class MyCustomFilter2 implements Filter{

    public MyCustomFilter2() {
        super();
    }

    @Override
    public final void doFilter(final ServletRequest req, final ServletResponse res, final FilterChain chain) throws IOException, ServletException {
        // logic for processing filter2-urls
    }
}

问题是这两个过滤器都是在一个链中为每个请求调用的。我提出的任何请求，它首先通过一个过滤器，然后通过另一个，而不是仅仅通过一个。

我该怎么解决这个问题？

提前感谢。

Answer 1

您应该只有一个< code>ConfigurerAdapter。您可以将它组合成一个配置:

http.exceptionHandling()
            .authenticationEntryPoint(MyCustomAuthenticationEntryPoint);
http
     .authorizeRequests()
     .antMatchers(HttpMethod.GET, "/filter1-urls/*").hasRole("USER")
     .antMatchers(HttpMethod.GET, "/filter2-urls/*").hasRole("SUPER_USER");
http.addFilterBefore(myCustomFilter, ChannelProcessingFilter.class);

这两个过滤器都将被调用，因为您设置了这样的行为。您应该留下唯一的一个过滤器来实现您想要的结果。

@Component
public final class MyCustomFilter implements Filter {

    public MyCustomFilter() {
        super();
    }

    @Override
    public final void doFilter(final ServletRequest req, final ServletResponse res, final FilterChain chain) throws IOException, ServletException {
    // logic for processing filter2-urls and filter1-urls
    }
 }

无论如何，您的过滤器将在链中调用。如果您想拆分过滤器，您应该在过滤器中添加if语句以过滤只需要的url（您可以从ServletRequest获取请求url

@Component
public final class MyCustomFilter2 implements Filter {

    public MyCustomFilter2() {
        super();
    }

    @Override
    public final void doFilter(final ServletRequest req, final ServletResponse res, final FilterChain chain) throws IOException, ServletException {
        if (/*is filter2 urls*/) {
        // logic for processing filter2-urls
        }
    }
 }