插入Spring-安全过滤器明显破坏过滤器链

Question

public class SessionFilter extends GenericFilterBean {

    @Override
    public void doFilter(
        ServletRequest servletRequest,
        ServletResponse servletResponse,
        FilterChain filterChain
    ) throws IOException, ServletException {

        HttpServletRequest httpRequest = (HttpServletRequest) servletRequest;
        String authorizationHeader = httpRequest.getHeader(HttpHeaders.AUTHORIZATION);
        
        if (authorizationHeader != null && meetsCondition(authorizationHeader)) {
            SecurityContext sc = SecurityContextHolder.getContext();
            sc.setAuthentication(new CustomAuthentication(authorizationHeader));
            httpRequest.getSession(true)
                    .setAttribute(SPRING_SECURITY_CONTEXT_KEY, sc);
        }

        filterChain.doFilter(servletRequest, servletResponse);
    }
}

        http  //...
                .and().csrf().disable()
                .addFilterBefore(
                        new SessionFilter(),
                        SecurityContextPersistenceFilter.class
                 );

我的代码/理解所基于的来源：

• https://www.leafyjava.com/2018/10/overwriting-spring-security-context.html
• https://www.baeldung.com/spring-security-registrated-filters
• https://spring.io/guides/topicals/spring-security-architecture

Answer 1

我看不出过滤器有什么特别独特或奇怪的地方，所以问题可能不是过滤器本身，而是配置的其他部分。我只有几个笔记

>

在放入这个自定义类之前，您是否已经确认OAuth2筛选器工作正常？您是手动添加的还是使用@EnableResourceServer注释添加的？

我注意到您使用GenericFilterBean并手动添加它。我认为Spring Security会自动扫描GenericFilterBeans并将其添加到筛选器链中，这样它可能会在您的链中出现两次。