Spring Security认证总是返回401

Question

我在Spring遇到了身份验证问题。我有身份验证筛选器扩展UsernamePasswordAuthenticationFilter。

public class AuthenticationFilter extends UsernamePasswordAuthenticationFilter {

private final AuthenticationManager authenticationManager;
private final RefreshTokenProvider refreshTokenProvider;
private final AccessTokenProvider accessTokenProvider = new AccessTokenProvider();

public AuthenticationFilter(AuthenticationManager authenticationManager, RefreshTokenProvider refreshTokenProvider) {
    this.authenticationManager = authenticationManager;
    this.refreshTokenProvider = refreshTokenProvider;
    setFilterProcessesUrl(SecurityConstants.AUTH_SIGN_IN_PATH);
}


@Override
public Authentication attemptAuthentication(HttpServletRequest request,
                                            HttpServletResponse response) throws AuthenticationException {
    try {
        SingInRequest singInRequest = new ObjectMapper().readValue(request.getInputStream(), SingInRequest.class);

        UsernamePasswordAuthenticationToken authRequest =
                new UsernamePasswordAuthenticationToken(singInRequest.getUsername(), singInRequest.getPassword());

        return authenticationManager.authenticate(authRequest);
    } catch (IOException e) {
        throw new RuntimeException(e);
    }


}

@Override
protected void successfulAuthentication(HttpServletRequest req,
                                        HttpServletResponse res,
                                        FilterChain chain,
                                        Authentication auth) throws IOException, ServletException {
    //

}

实现UserDetailsService

@RequiredArgsConstructor
public class UserDetailsServiceImpl implements UserDetailsService {

    private final PasswordEncoder encoder;
    private final UserQueryRepository userQueryRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        return userQueryRepository.findUserByUsername(username)
                .map(this::getUserDetails)
                .orElseThrow(() -> new UsernameNotFoundException("User with username " + username + " not found"));
    }

    private UserDetails getUserDetails(UserDto user) {
        return org.springframework.security.core.userdetails.User.builder()
                .username(user.getUsername())
                .authorities(convertAuthorities(user))
                .password(encoder.encode(user.getPassword()))
                .disabled(!user.isActive())
                .build();
    }

    private List<GrantedAuthority> convertAuthorities(UserDto user) {
        return user.getRoles().stream().map(role ->
                new SimpleGrantedAuthority(role.toString())
        ).collect(Collectors.toList());
    }
}

和SecurityConfig类

@EnableWebSecurity
@Configuration
@RequiredArgsConstructor
class SecurityConfig extends WebSecurityConfigurerAdapter {

    private final UserQueryRepository userQueryRepository;
    private final RefreshTokenProvider refreshTokenProvider;

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf()
                .disable()
                .authorizeRequests()
                .antMatchers("/auth/**").permitAll()
                .antMatchers("/book/**").authenticated()
                .and()
                .addFilter(new AuthenticationFilter(authenticationManager(), refreshTokenProvider))
                .addFilter(new AuthorizationFilter(authenticationManager()))
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService())
                .passwordEncoder(passwordEncoder());
    }

    @Bean
    public UserDetailsService userDetailsService() {
        return new UserDetailsServiceImpl(passwordEncoder(), userQueryRepository);
    }

    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        final CorsConfiguration corsConfiguration = new CorsConfiguration();
        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        corsConfiguration.addAllowedOrigin("http://localhost:3000");
        source.registerCorsConfiguration("/**", corsConfiguration);
        return source;
    }

如果我尝试让邮递员发送具有良好凭据的身份验证请求，在调试器模式下一切正常（AuthFilter和UserDetailsService），但服务器返回401并且Authfilter中的成功身份验证方法不会调用。

收到的POST'/auth/sing-in'请求：

org.apache.catalina.connector.RequestFacade@27b774b2

servletPath:/auth/sing-in-pathInfo:null头：内容类型：应用程序/json用户代理：PostmanRuntime/7.25.0接受：/cache-control:no-cache-postman令牌：c5bb3320-9c22-4d3d-93e9-628fe0e6f82a主机：localhost:9000接受编码：gzip，deflate，br连接：保持活动内容长度：54

安全过滤链：[WebAsyncManagerIntegrationFilter SecurityContextPerISTence Filter HeaderWriterFilter LogoutFilter AuthenticationFilter AuthorizationFilter Request estCacheAware Filter SecurityContextHolderAware Request estFilter AnnamousAuthenticationFilter SessionManagementFilter ExceptionTranslationFilter SecurityInterceptor]

2020-06-13 20:52:42.048信息9956---[nio-9000-exec-2]组织。mongodb。驾驶员连接：打开连接[connectionId{localValue:2，serverValue:126}]到127.0.0.1:27017 2020-06-13 20:52:42.258信息9956-[nio-9000-exec-2]Spring Security调试器：

收到POST'/error'的请求：

org.apache.catalina.core.ApplicationHttpRequest@fafe057

servletPath：/错误路径信息：空标头：内容类型：应用程序/json用户代理：PostmanRuntime/7.25.0接受：/缓存控制：无缓存邮递员令牌：c5bb3320-9c22-4d3d-93e9-628fe0e6f82a主机：localhost:9000接受编码：gzip，放气，br连接：保持活动内容长度： 54

安全过滤链：[WebAsyncManagerIntegrationFilter SecurityContextPerISTence Filter HeaderWriterFilter LogoutFilter AuthenticationFilter AuthorizationFilter Request estCacheAware Filter SecurityContextHolderAware Request estFilter AnnamousAuthenticationFilter SessionManagementFilter ExceptionTranslationFilter SecurityInterceptor]

Answer 1

successfulAuthentication（）方法中没有任何内容。应该是这样的。

@Override
protected void successfulAuthentication(HttpServletRequest req,
                                        HttpServletResponse res,
                                        FilterChain chain,
                                        Authentication auth) throws IOException, ServletException {
        super.successfulAuthentication(req, res, chain, auth);
        chain.doFilter(req, res);
}

抱歉，我没有注意到“successfulAuthentication不调用”。您可以使用在调试模式下共享堆栈跟踪吗

@EnableWebSecurity(debug = true)