Spring 403错误-尝试使用JWT令牌保护后端

Question

我所有的请求都有403个被禁止的回复。我发送的firebase令牌正在成功验证，所以我不确定设置时缺少了什么步骤？我只是想让一个简单的流工作，其中我的endpoint必须在头中有有效的firebase JWT令牌（在排除的健康endpoint之外）。

当前步骤：

1. 自定义OncePerRequest estFilter已创建并正在相应的endpoint上命中
2. 授权头令牌成功验证
3. 身份验证对象创建为UsernamePasswordAuthentiationToken，跟踪其中的Firebase令牌和用户UID。
4. 使用新的身份验证对象设置SecurityContext。
5. ？？？

响应：{"时间戳"："2022-01-09T16:44:08.342 00:00"，"状态"： 403，"错误"："禁止"，"消息"："拒绝访问"，"路径"："/v1/dev/超重/服务/用户/注册"}

从身份验证中排除的我的健康endpoint也能够成功地进行调用。

@EnableWebSecurity
@Configuration
@Slf4j
public class SecurityConfig extends WebSecurityConfigurerAdapter implements WebMvcConfigurer {

    @Value("${server.servlet.context-path:''}")
    private String contextPath;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .cors().and()
                .csrf().disable()
                .addFilterBefore(new FireBaseFilter(), UsernamePasswordAuthenticationFilter.class)
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
                .authorizeRequests()
                .antMatchers("/health/**").permitAll()
                .anyRequest().authenticated();

    }

    @Override //src: https://www.baeldung.com/spring-cors
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**").allowedOrigins(
                "http://localhost:8080",
                "http://localhost:3000"
        ).allowedMethods("*");
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

 @Slf4j
 public class FireBaseFilter extends OncePerRequestFilter {

    private List<String> skipUrls = Arrays.asList("/health/**");
    private static final String AUTH_HEADER = "Authorization";

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        String authToken = request.getHeader(AUTH_HEADER).substring(7);
        if (!StringUtils.isEmpty(authToken)) {
            Authentication auth = getAuthentication(authToken);
            SecurityContextHolder.getContext().setAuthentication(auth);
        }

        filterChain.doFilter(request, response);
    }

    private Authentication getAuthentication(String jwtToken) {
        FirebaseToken token = verifyFireBaseToken(jwtToken);
        return new UsernamePasswordAuthenticationToken(token.getUid(), token);
    }

  private FirebaseToken verifyFireBaseToken(String jwtToken) {
        if (StringUtils.isEmpty(jwtToken)) {
            throw new IllegalArgumentException("idToken is blank");
        }
        try {
            return FirebaseAuth.getInstance().verifyIdToken(jwtToken, true);
        } catch (FirebaseAuthException e) {
            this.logger.error("exception thrown verifying firebase token");
        }
    }

    @Override
    protected boolean shouldNotFilter(HttpServletRequest request) throws ServletException {
        return skipUrls.stream().anyMatch(p -> new AntPathMatcher().match(p, request.getServletPath()));
    }

}

Answer 1

@dur在评论中解决。我需要为UsernamePasswordAuthenticationToken（token.getUid（），token，）添加一些权限；

我将我的方法修改为：

private Authentication getAuthentication(String jwtToken) {
    FirebaseToken token = verifyFireBaseToken(jwtToken);
    this.logger.info("Token verified!");
    List<GrantedAuthority> authoritiesList = new ArrayList<GrantedAuthority>();
    authoritiesList.add(new SimpleGrantedAuthority("ADMIN"));
    return new UsernamePasswordAuthenticationToken(token.getUid(), token, authoritiesList);
}

我认为从这里开始，接下来的步骤将是创建一个适当的UserDetailsService来正确处理此问题。