Spring boot：允许特定服务避免安全性

Question

我有多种服务。他们都使用jwt进行授权。但是，当我的服务相互通信时，我不希望它们进行身份验证。当客户端向serviceA发送请求，serviceA需要serviceB提供数据时，serviceA验证令牌就足够了（当客户端向serviceB发送请求时也是如此）。我使用eureka作为注册表，使用openfeign在服务之间进行通信。现在我总是收到这样的401回复：

feign.FeignException$Unauthorized: [401] during [GET] to [http://userservice/eschuler]

更具体地说，我的authservice希望向userservice发送请求。

@FeignClient(name = "userservice")
public interface UserClient {
    @GetMapping(value = "/{id}")
    ResponseEntity<UserAccount> getUserById(@PathVariable String id);
}

这是包含getUserById方法的UserController：

@RestController
@RequestMapping(value = "/kimoji/rest/users")
public class UserController {

    private final UserRepository userRepository;
    private final PasswordEncoder encoder;
    private final JwtTokenService jwtTokenService;

    public UserController(UserRepository userRepository, PasswordEncoder encoder, JwtTokenService jwtTokenService) {
        this.userRepository = userRepository;
        this.encoder = encoder;
        this.jwtTokenService = jwtTokenService;
    }

    @GetMapping(value = "/{id}")
    public ResponseEntity<UserAccount> getUserById(@PathVariable String id) {
        Optional<UserAccount> userAccount = userRepository.findById(id);
        return userAccount.map(ResponseEntity::ok).orElseGet(() -> ResponseEntity.notFound().build());
    }


 ...
    
}

这是来自我的用户服务的WebSecurityConfig：

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private JwtAuthenticationEntryPoint unauthorizedHandler;

    @Autowired
    private JwtAuthenticationProvider jwtAuthenticationProvider;

    @Autowired
    public void configureAuthentication(AuthenticationManagerBuilder authenticationManagerBuilder) {
        authenticationManagerBuilder.authenticationProvider(jwtAuthenticationProvider);
    }

    @Bean
    public JwtAuthenticationTokenFilter authenticationTokenFilterBean() {
        return new JwtAuthenticationTokenFilter();
    }

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
                .csrf().disable()
                .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
                .authorizeRequests()
                .antMatchers(HttpMethod.POST, "/kimoji/rest/users/register").permitAll()
                .anyRequest().authenticated();

        httpSecurity.addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
        httpSecurity.headers().cacheControl();
    }

}

Answer 1

你要做的不是逃避安全，而是传递一个令牌。

如果服务A正在调用服务B，并且请求来自外部客户端。只需将源于客户端的相同令牌传递给服务B，再传递给服务A。

如果服务A正在发起呼叫（某种维护作业），则使用客户端凭据流转到您的身份提供商，并为服务A创建令牌以传递给服务B。