Spring boot+OAuth2安全和请求过滤器

Question

在内部，如果出现任何异常，/error将被重定向&这不需要通过OAuth2AuthenticationProcessingFilter，可以跳过此请求。

http.authorizeRequests().antMatchers("/error").permitAll().anyRequest().authenticated();
   // both configuration validates even "ERROR" request.
http.antMatcher("/**").authorizeRequests().antMatchers("/error").permitAll().anyRequest().authenticated();

// security config with filter 
    http.addFilterBefore(new APISignatureFilter(), OAuth2AuthenticationProcessingFilter.class).authorizeRequests().antMatchers("/error").permitAll().anyRequest().authenticated();

我已经实现了OncePerRequestFilter&任何请求都不会调用它。这必须在OAuth过滤器之前调用。

@Component
public class APISignatureFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
    }
 }

让我知道这个安全配置出了什么问题。

Answer 1

您需要从spring security实现AuthenticationEntryPoint接口

 @Component
 public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint {
 private static final Logger logger = 
 LoggerFactory.getLogger(JwtAuthenticationEntryPoint.class);
@Override
public void commence(HttpServletRequest httpServletRequest,
                     HttpServletResponse httpServletResponse,
                     AuthenticationException e) throws IOException, ServletException 
{
    logger.error("Responding with unauthorized error. Message - {}", e.getMessage());
    httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED,
            "Sorry, You're not authorized to access this resource.");
} 
}

您需要在Spring Security配置中定义这个入口点，例如

         http
            .cors()
                .and()
            .csrf()
                .disable()
            .exceptionHandling()
                .authenticationEntryPoint(//bean of 
           JwtAuthenticationEntryPoint)//

如果筛选器中出现任何异常，将调用