Spring Boot对每个请求进行基本身份验证，对以后的请求验证用户名

Question

我已经在Spring启动中启用了超文本传输协议基本身份验证。从邮递员打来电话时，我看到了奇怪的结果

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

  @Autowired
  private ApiUserDetailsService userDetails;

  @Bean
  public ShaPasswordEncoder passwordEncoder() {
    return new ShaPasswordEncoder();
  }

  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    ReflectionSaltSource salt = new ReflectionSaltSource();
    salt.setUserPropertyToUse("username");
    DaoAuthenticationProvider dao = new DaoAuthenticationProvider();
    dao.setUserDetailsService(userDetails);
    dao.setPasswordEncoder(passwordEncoder());
    dao.setSaltSource(salt);
    auth.authenticationProvider(dao);
  }

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests().anyRequest().authenticated().and().csrf().disable().httpBasic();
  }

自定义用户详情

@Service
public class ApiUserDetailsService implements UserDetailsService {

  @Autowired
  private JdbcTemplate jdbcTemplate;

  @Value("${spring.queries.users.query}")
  private String usersQuery;

  @Override
  public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    List<UserDetails> usersBasedOnUserName = getUsersBasedOnUserName(username);

    if (usersBasedOnUserName.size() == 0) {
      throw new UsernameNotFoundException("Username " + username + " not found");
    }
    return usersBasedOnUserName.get(0);
  }

  private List<UserDetails> getUsersBasedOnUserName(String username) {
    return jdbcTemplate.query(this.usersQuery, new String[] {username}, new RowMapper<UserDetails>() {
      @Override
      public UserDetails mapRow(ResultSet rs, int rowNum) throws SQLException {
        String username = rs.getString(1);
        String password = rs.getString(2);
        return new User(username, password, AuthorityUtils.NO_AUTHORITIES);
      }
    });
  }

}

对于我第一次执行请求，它期望正确的凭据。在我输入正确的凭据后，我得到了结果。但是当我在没有凭据或不同密码的情况下尝试相同的请求时，我不会得到401错误。

只有当我更改用户名时，才会出现401错误。

我的API需要针对每个请求进行验证。

我是不是做错了什么。

Answer 1

将无状态添加到config有助于解决问题。

@Override
  protected void configure(HttpSecurity http) throws Exception {
    http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
   http.authorizeRequests().anyRequest().authenticated().and().csrf().disable().httpBasic(); 
  }