从Spring Boot为angular应用程序生成jwt令牌

Question

@Override
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
            throws AuthenticationException {

try {

~~// 1. Get credentials from request
~~UserCredentials creds = new ~~ObjectMapper().readValue(request.getInputStream(), ~~UserCredentials.class);

// 2. Create auth object (contains credentials) which will be used by auth manager
~~UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(creds.getUsername(),creds.getPassword(), Collections.emptyList());

// 3. Authentication manager authenticate the user, and use ~~UserDetialsServiceImpl::loadUserByUsername() method to load the user.
    return authManager.authenticate(authToken);

~~} catch (IOException e) {
~~~~~~throw new RuntimeException(e);
 }
}

@PostMapping("/login")
public void method(@RequestBody MyUser myUser){
// perform authentication and issue token for my front app
}

Answer 1

如果你遵循下面的建议会更好。

1）发出令牌--它应该在过滤器级别之后完成，我的意思是，在为该用户发出令牌之前，您应该验证您的HTTP请求和数据（密码和用户ID）的所有内容，在过滤器级别进行验证是违反适当的设计模式的。

2）验证--您可以在过滤器级别本身进行验证。它还可以帮助您避免在每个控制器方法或额外注释中单独编写验证逻辑。