Spring Boot自定义JWT过滤器不允许任何没有令牌的请求

Question

我正在使用具有Spring启动安全配置的自定义JWT过滤器，以允许没有JWT令牌的某些API请求。但是WebSecurity配置中的permissionAll（）方法不起作用（不允许在没有JWT的情况下发出任何请求）。它抛出自定义 InvalidJwtException。我在这里错过了什么？我尝试了很多谷歌搜索，但没有成功。

Web安全配置类

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
class WebSecurityConfig(
    private val jwtTokenProvider: JwtTokenProvider,
    private val filterChainExceptionHandler: FilterChainExceptionHandler,
) : WebSecurityConfigurerAdapter() {

    override fun configure(http: HttpSecurity?) {

        http?.csrf()?.disable()
        http?.sessionManagement()?.sessionCreationPolicy(SessionCreationPolicy.STATELESS)

        http
            ?.authorizeRequests()
            ?.antMatchers("/api/v1/auth/signin")?.permitAll()
            ?.antMatchers("/api/v1/auth/checkEmailExist")?.permitAll()
            ?.anyRequest()?.authenticated()

        http
            ?.addFilterBefore(JwtTokenFilter(jwtTokenProvider), UsernamePasswordAuthenticationFilter::class.java)
            ?.addFilterBefore(filterChainExceptionHandler, JwtTokenFilter::class.java)

    }

    @Bean
    fun passwordEncoder(): PasswordEncoder {
        return BCryptPasswordEncoder(10)
    }

    @Bean
    override fun authenticationManagerBean(): AuthenticationManager {
        return super.authenticationManagerBean()
    }
}

JwtTokenFilter类

@Component
class JwtTokenFilter(
    private val jwtTokenProvider: JwtTokenProvider
) : OncePerRequestFilter() {

    override fun doFilterInternal(
        request: HttpServletRequest,
        response: HttpServletResponse,
        filterChain: FilterChain
    ) {
        try {
            val token = jwtTokenProvider.resolveToken(request)
            if (token != null && jwtTokenProvider.validateToken(token)) {
                val auth = jwtTokenProvider.getAuthentication(token)
                SecurityContextHolder.getContext().authentication = auth
            }
        } catch (e: InvalidJwtException) {
            SecurityContextHolder.clearContext()
            throw InvalidJwtException(e.message, e.httpStatus)
        }
        filterChain.doFilter(request, response)
    }
}

ResolveToken函数

 fun resolveToken(req: HttpServletRequest): String? {
        val bearerToken = req.getHeader(AUTHORIZATION_HEADER)
        return if (bearerToken != null && bearerToken.startsWith(BEARER)) {
            bearerToken.substring(7)
        } else {
            throw InvalidJwtException("Authorization token must be Bearer [token]", HttpStatus.FORBIDDEN)
        }
 }

Answer 1

您的令牌验证应排除身份验证URL：

if (!request.getRequestURL().toString().contains("auth") || (token != null && jwtTokenProvider.validateToken(token))) 

您可以选择比我使用的“身份验证”更好的字符串来标识排除的路径