java - WebSecurity 忽略不适用于 AbstractAuthenticationProcessingFilter

Question

我创建了一个过滤器，在过滤器 super 构造函数中它需要一个 defaultFilterProcessesUrl。我通过 url /v1/** 选择了所有请求。

我需要不登录 /v1/users (POST 方法)和 /v1/users/signin (POST 方法)，但过滤器不允许。如何解决这个问题？

智威汤逊过滤器:

public class JwtAuthenticationTokenFilter extends AbstractAuthenticationProcessingFilter {

    public JwtAuthenticationTokenFilter() {
        super("/v1/**");
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException {

         String header = request.getHeader("Authorization");
         if(header == null || !header.startsWith("Bearer")){
             throw new RuntimeException("JWT token is missing");
         }

         String authenticationToken = header.substring(7);

        JwtAuthenticationToken token = new JwtAuthenticationToken(authenticationToken);
        return getAuthenticationManager().authenticate(token);
    }

    @Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
        super.successfulAuthentication(request, response, chain, authResult);
        chain.doFilter(request, response);
    }
}

Spring 安全配置:

public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private JwtAuthenticationProvider authenticationProvider;
    @Autowired
    private JwtAuthenticationEntryPoint entryPoint;

    @Bean
    public AuthenticationManager authenticationManager(){
        return new ProviderManager(Collections.singletonList(authenticationProvider));
    }

    @Bean
    public JwtAuthenticationTokenFilter authenticationTokenFilter(){
        JwtAuthenticationTokenFilter filter = new JwtAuthenticationTokenFilter();
        filter.setAuthenticationManager(authenticationManager());
        filter.setAuthenticationSuccessHandler(new JwtSuccessHandler());
        return filter;
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web
            .ignoring()
                .antMatchers(HttpMethod.POST, "/v1/users")
                .antMatchers(HttpMethod.POST, "/v1/users/signin")
                .antMatchers(HttpMethod.POST, "/token");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception{
        http
             .csrf().disable()
             .authorizeRequests()
                .anyRequest().hasAnyRole("SG_ADMIN", "O_ADMIN", "OS_ADMIN")
                .and()
             .exceptionHandling().authenticationEntryPoint(entryPoint)
                .and()
             .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

        http.addFilterBefore(authenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class);
        http.headers().cacheControl();
    }
}

Answer 1

您可以将另一个构造函数与 RequestMatcher 一起使用，参见AbstractAuthenticationProcessingFilter :

AbstractAuthenticationProcessingFilter

protected AbstractAuthenticationProcessingFilter(RequestMatcher requiresAuthenticationRequestMatcher)

Creates a new instance

Parameters:

requiresAuthenticationRequestMatcher - the RequestMatcher used to determine if authentication is required. Cannot be null.

您修改后的代码:

public JwtAuthenticationTokenFilter() {
    super(customRequestMatcher);
}

与

 RequestMatcher customRequestMatcher = new AndRequestMatcher(
      new AntPathRequestMatcher("/v1/**"), 
      new NegatedRequestMatcher(
          new AntPathRequestMatcher("/v1/users", "POST")
      ),
      new NegatedRequestMatcher(
          new AntPathRequestMatcher("/v1/users/signin", "POST")
      )
 );