java - 针对 Spring Security 的应用程序身份验证

Question

我在我的 android 应用程序中使用带有 rest API 的 spring 后端来通过用户名和密码字段对用户进行身份验证。

当我像 postman 一样使用 rest-client 对其进行身份验证时，它已通过身份验证。

这是我的 postman 快照

我在两种情况下都得到了这个结果，无论是在 URL 中还是在正文中传递参数。

但是从我的 android 应用程序调用它时我得到 404

这是我使用 volley 库的客户端调用

 private void callLoginVolley() {
    try {
        RequestQueue requestQueue = Volley.newRequestQueue(this);
        String URL = AppConstants.BASE_URL + AppConstants.ADMIN_LOGIN;//+"email="+username.getText().toString()+"&password="+password.getText().toString();
        Log.i("url", String.valueOf(URL));

        StringRequest stringRequest = new StringRequest(Request.Method.POST, URL, new Response.Listener<String>() {
            @Override
            public void onResponse(String response) {
                try {

                    JSONObject jsonObject = new JSONObject(response);

                } catch (Exception e) {
                    e.printStackTrace();
                }

            }
        }, new Response.ErrorListener() {
            @Override
            public void onErrorResponse(VolleyError error) {

                Toast.makeText(getApplicationContext(), "failed!", Toast.LENGTH_LONG).show();

            }
        }) {


            @Override
            public Map<String, String> getHeaders() throws AuthFailureError {
                Map<String, String> pars = new HashMap<String, String>();
                pars.put("Content-Type", "application/x-www-form-urlencoded");
                return pars;
            }

            @Override
            protected Map<String, String> getParams() throws AuthFailureError {
                HashMap<String, String> params = new HashMap<String, String>();

                params.put("email", username.getText().toString()); //Add the data you'd like to send to the server.
                params.put("password", password.getText().toString());
                Log.d("myData", "->" + params);

                return params;
            }

        };

        requestQueue.add(stringRequest);
    } catch (Exception e) {
        e.printStackTrace();
    }
}

这是我的 spring 安全代码

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.jdbcAuthentication().usersByUsernameQuery(usersQuery).authoritiesByUsernameQuery(rolesQuery)
            .dataSource(dataSource).passwordEncoder(bCryptPasswordEncoder);
}

@Override
protected void configure(HttpSecurity http) throws Exception {

    http.authorizeRequests().antMatchers("/").permitAll().antMatchers("/login", "/loginfailure").permitAll()
            .antMatchers("/registration").permitAll().antMatchers("/admin/**").hasAuthority("ADMIN").anyRequest()
            .authenticated().and().csrf().disable()
            .formLogin().loginPage("/login")
            .failureUrl("/loginfailure")
            .defaultSuccessUrl("/loginsucess")
            .usernameParameter("email")
            .passwordParameter("password")
            .and().logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout")).logoutSuccessUrl("/").and()
            .exceptionHandling().accessDeniedPage("/access-denied");
}

这是我成功和失败的休息电话

@RequestMapping(value="/loginsucess", method = RequestMethod.GET)
public ResponseEntity<Object> loginSuccess() {
    Map response = new HashMap<>();

    /*Set some session variables*/
    Object authUser = SecurityContextHolder.getContext().getAuthentication().getPrincipal();  
    response.put("username", authUser);  
    response.put("authorities", SecurityContextHolder.getContext().getAuthentication().getAuthorities()); 
    response.put("status", "success");

    ResponseEntity<Object> responseEntity= new ResponseEntity<Object>(response,HttpStatus.OK);
    logger.info("response"+responseEntity);

    return responseEntity;

}

/登录失败

@RequestMapping(value="/loginfailure", method = RequestMethod.GET)
public ResponseEntity<Object> loginFailure() {
    Map response = new HashMap<>();

    response.put("status", "login failed");

    ResponseEntity<Object> responseEntity= new ResponseEntity<Object>(response,HttpStatus.OK);
    logger.info("response"+responseEntity);

    return responseEntity;

}

期待您的回复...

Answer 1

在 antMatchers 中添加“/loginsucess”http.authorizeRequests().antMatchers("/").permitAll().antMatchers("/login", "/loginfailure").permitAll()

希望它能解决您的问题:)