会话验证-使用微服务的Spring Security性

Question

我的web应用程序的当前架构有一个网关服务器，它组织了一系列微服务，授权发生在网关，如果给定的原则被认证，它们可以与一些下游服务对话。

下游服务获取所需的数据，以标识给定的经过身份验证的客户端。然而，Spring证券违约行为开始出现，并引发了预期的：

org.springframework.security.access.AccessDeniedException: Access is denied

假定我可以在任何给定的微服务中使用会话id和+XSRF令牌来验证用户是否经过身份验证，并知道哪个用户登录了（我目前使用的是Http Basic）。

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    public SessionRepository<ExpiringSession> sessionRepository() {
        return new MapSessionRepository();
    }


    @Bean
    HeaderHttpSessionStrategy sessionStrategy() {
        return new HeaderHttpSessionStrategy();
    }


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors()
              .and().authorizeRequests().anyRequest().authenticated();


        final SessionRepositoryFilter<ExpiringSession> sessionRepositoryFilter = new SessionRepositoryFilter<ExpiringSession>(
                sessionRepository());
        sessionRepositoryFilter
                .setHttpSessionStrategy(new HeaderHttpSessionStrategy());

        http.addFilterBefore(sessionRepositoryFilter,
                ChannelProcessingFilter.class).csrf().disable();
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER);

    }

    public SessionRepository<ExpiringSession> getSessionRepository(){
        return sessionRepository();
    }

}

资源微服务中的标头值：

KEY: cookie VALUE: XSRF-TOKEN=[token_value]; SESSION=[session_value]
KEY: x-requested-with VALUE: XMLHttpRequest
KEY: x-auth-token VALUE: a32302fd-589b-42e1-8b9d-1991a080e904
...

计划的方法（伪代码）将一个新的过滤器附加到spring securities过滤器链，如果给定的标志为真，则允许访问安全的endpoint。

**
 * A custom filter that can grant access to the current resource
 * if there is a valid XSRF-TOKEN and SESSION present in the shared
 * session cache.
 */
public class CustomAuthenticationFilter extends AnAppropriateFilterChainFilter {

    @Autowired
    SessionRepository sessionRepository;


    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {



        boolean csrfTokenExists = sessionRepository.findByCsrfTokenId(request);

        boolean sessionExists = sessionRepository.findBySessionId(request);

        if (csrfTokenExists && sessionExists) {
            // everything is okay
        } else {
            // invalidate the request as being authenticated
            throw new InsufficientAuthenticationException("Invalid csrf + session pair");

        }

    }


}

Answer 1

在将spring boot父版本更新为2.0.1版本并将spring cloud版本更改为Finchley之后，spring boot解决了这个问题。

注意会话存储库和HttpSessionStrategy不是必需的，

HttpSessionStrategy自从spring会话成为spring会话核心后，现在已经贬值了。

注意如果您使用网关模式和ZUUL代理确保代理路由在应用程序YML/properties中包含sensition-headers:属性，请参见下面的示例：

使用Springboot配置共享会话缓存的auth+网关示例。

Auth网关

spring:
  profiles: dev
  redis:
    host: localhost
    port: 6379
  session:
    store-type: redis

server:
  port:   8080

zuul:
  routes:
    # local routes
    api:
      url: forward:/api
      path: /api/**
      sensitive-headers:
    # cloud-resource
    resource:
      url: http://localhost:9002
      path: /resource/**
      strip-prefix: false
      sensitive-headers:

proxy:
  auth:
    routes:
      resource: passthru
      ui: none
      api: passthru

security:
  sessions: ALWAYS

spring:
  profiles: dev
  redis:
    host: localhost
    port: 6379
  session:
    store-type: redis
  security:
    enabled: false

server:
  port:  9002

security:
  # Never create a session, but if one exists use it
  sessions: NEVER
  # don't display the auth box
  basic:
    enabled: false

management:
  security:
    enabled: false