java - 为什么 Spring Security 使用默认的预认证检查？

Question

我最近一直在我雇主的一个基于 Spring 的 Java 应用程序中实现一些安全改进，并且我已经覆盖了 Spring Security 的 AbstractUserDetailsAuthenticationProvider 类，以便围绕用户身份验证进行一些额外的处理。在此过程中，我意识到 DefaultPreAuthenticationChecks 内部类在身份验证提供程序通过执行密码验证的 additionalAuthenticationChecks 方法运行之前执行用户帐户检查。如果用户被禁用、过期或锁定，将抛出异常，从而将相关消息显示在屏幕上。对我来说，在成功验证密码之前检查用户帐户并提供该帐户的详细信息是一个明显的安全风险，因为它可能会暴露用户帐户是否存在。有谁知道 Spring Security 以这种方式做事的充分理由？显然，我可以通过使用什么都不做的 check 方法创建我自己的虚拟类来覆盖 DefaultPreAuthenticationChecks 类，但遗憾的是，这必须首先完成.

提前致谢。

附言我在相关笔记上发现了一个问题 here ，但似乎没有人问这个潜在安全漏洞为何存在的问题。

Answer 1

我想我参加聚会有点晚了，但万一还有人想知道，社区实际上有 discussed this issue before

引用自开发者

Luke Taylor said:

This isn’t the case. It’s up to you what failure message you show to the user when a login fails – there’s nothing to stop you saying “login failed” regardless of the cause. It’s also not uncommon for applications to inform a user that their account has been locked after a fixed number of login attempts. The desired behaviour will depend on exactly how you interpret the different status flags (which is not strictly defined by the framework). The exceptions also drive the generation of events by the AuthenticationManager, so they are not necessarily there for user consumption at all. A sysadmin may want to be informed anytime someone is trying to use a locked or disabled account, for example, not just when they use the correct password.

It can also be argued that checking the password before the account locked status and showing a “locked” message only when a correct password is given would also allow brute-force password checking even after the account has been locked.

So I disagree that the behaviour is “incorrect”. I think it might be useful to be able to customize things though. Perhaps we should have methods

preAuthenticationChecks(UserDetails user)

postAuthentication(UserDetails user)

which could be overridden to alter when the differed flags are checked.

tl;dr:社区意识到了这个问题，但他们认为这不是潜在的安全漏洞，相反他们认为这取决于“您如何解释不同的状态标志”，是的，它很容易改变使用 setPostAuthenticationChecks(UserDetailsChecker postAuthenticationChecks) 和 setPreAuthenticationChecks(UserDetailsChecker preAuthenticationChecks)

的默认行为