记住MeAuthenticationFilter和Java配置：重写onSuccessfulAuthentication的自定义实现--如何以干净的方式实现？

Question

为RemembermeAuthenticationFilter提供AuthenticationAuthenticationFilter的AuthenticationAuthentication会破坏筛选器链，因此我希望通过提供RemembermeAuthenticationFilter的自定义实现来重写其OnSuccessfulAuthentication但是当使用简单的Java配置时，这似乎相当复杂或复杂。

如果需要访问HttpServletRequest或HttpServletResponse，则提供ApplicationEventPublisher不是解决方案。

我设法做到了，但这看起来像一个黑客--有更好的方法吗？

我是这样做的：

http.rememberMe().addObjectPostProcessor(new ObjectPostProcessor<RememberMeAuthenticationFilter>() {

    @Override
    public <O extends RememberMeAuthenticationFilter> O postProcess(O object) {

        RememberMeAuthenticationFilter newFilter = new RememberMeAuthenticationFilter(
                (AuthenticationManager) getByReflection(object, "authenticationManager"),
                (RememberMeServices) getByReflection(object, "rememberMeServices")
        ) {
            @Override
            protected void onSuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, Authentication authResult) {
                // business logic
            }
        };
        return (O) newFilter;
    }

    private <O extends RememberMeAuthenticationFilter> Object getByReflection(O object, String name) {
        Field field = ReflectionUtils.findField(object.getClass(), name);
        ReflectionUtils.makeAccessible(field);
        return ReflectionUtils.getField(field, object);
    }
});

Answer 1

如果您希望在身份验证过程（使用remember me特性）成功时实现自定义行为，可以尝试：

定义新筛选器，例如：

public class CustomRememberMeAuthenticationFilter extends RememberMeAuthenticationFilter {
  @Override
  protected void onSuccessfulAuthentication(final HttpServletRequest request, final HttpServletResponse response, final Authentication authResult) {
    super.onSuccessfulAuthentication(request, response, authResult);
    if (authResult != null) {
        // process post authentication logic here..
    }
  }
}

在安全链中设置客户filer：

@Override
protected void configure(HttpSecurity http) throws Exception {
  http
    .csrf().disable()
    .authorizeRequests()
    .antMatchers("/","/login*").permitAll()
    //...
  http
    .addFilter(rememberMeAuthenticationFilter())
    //...
}

@Bean
protected RememberMeAuthenticationFilter rememberMeAuthenticationFilter(){
    return new CustomRememberMeAuthenticationFilter(authenticationManager(),rememberMeServices());
}

null