在身份验证筛选器中添加自定义声明。在筛选器中获取用户id。Spring靴

Question

我想添加用户的ID作为自定义声明到我的令牌。

但我无法在过滤器中获取用户id，因为依赖注入在过滤器中不起作用。我尝试使用UserService的构造函数，但在这个服务中，我有一个存储库，它是im@Autowiring，所以在调试模式下，我看到userRepository字段为空。

我的问题是我将如何添加这个自定义声明？也许这是添加这个的另一种方式。

我正在学习本教程（没有“旁白”章节）https://auth0.com/blog/implementing-jwt-authentication-on-spring-boot/#User-Spring Boot上的身份验证和授权

这是我的过滤器，我试图添加这个声明

package com.kamczi.auth;

import com.auth0.jwt.JWT;
import static com.auth0.jwt.algorithms.Algorithm.HMAC512;
import com.fasterxml.jackson.databind.ObjectMapper;
import static com.kamczi.auth.SecurityConstants.EXPIRATION_TIME;
import static com.kamczi.auth.SecurityConstants.HEADER_STRING;
import static com.kamczi.auth.SecurityConstants.SECRET;
import static com.kamczi.auth.SecurityConstants.TOKEN_PREFIX;
import com.kamczi.entities.User;
import com.kamczi.repository.UserRepository;
import com.kamczi.services.UserService;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Date;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

/**
 *
 * @author Kamil
 */
public class JWTAuthenticationFilter extends UsernamePasswordAuthenticationFilter   {
    private AuthenticationManager authenticationManager;

    public JWTAuthenticationFilter(AuthenticationManager authenticationManager) {
        this.authenticationManager = authenticationManager;
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        try{
            User user = new ObjectMapper()
                    .readValue(request.getInputStream(), User.class);

            return authenticationManager.authenticate(
                    new UsernamePasswordAuthenticationToken(
                            user.getUsername(),
                            user.getPassword(),
                            new ArrayList<>())
                    );
        } catch(IOException e){
            throw new RuntimeException(e);
        }
    }

    @Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
        String username = ((org.springframework.security.core.userdetails.User) authResult.getPrincipal()).getUsername();
        String token = JWT.create()
                //.withClaim("id", userService.findByUsername(username).getUser_id()) need implementation
                .withSubject(username)
                .withExpiresAt(new Date(System.currentTimeMillis()+EXPIRATION_TIME))
                .sign(HMAC512(SECRET.getBytes()));
        response.addHeader(HEADER_STRING, TOKEN_PREFIX + token);
    }


}

Answer 1

尝试用@Component标记过滤器。@Autowired仅适用于Spring管理的bean（组件）。

或者，您可以使用构造函数手动添加过滤器，并将存储库传递给它。

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    UsersRepository usersRepo;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.addFilterAt(new JWTAuthenticationFilter(usersRepo), UsernamePasswordAuthenticationFilter.class);
    }

}