java - 过滤器模式定义不适用

Question

我通过 @Bean 注释定义了我的 AlanCookieFilter:

@Bean
    public Filter alanCookieFilter() {
        return new AlanCookieFilter(); // type of AbstractPreAuthenticatedProcessingFilter
    }

然后我使用 WebSecurityConfigurerAdapter 添加了过滤器:

@Configuration
public class AlanOAuthWebConfig extends WebSecurityConfigurerAdapter {


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.addFilter(alanCookieFilter()).antMatcher("/**");
    }   
}

但是当我启动应用程序时，我收到以下日志消息:

o.s.b.c.embedded.FilterRegistrationBean  : Mapping filter: 'alanCookieFilter' to: [/*]

看来AlanCookieFilter仍然映射到/*而不是/**。我对这种挥舞行为感到完全困惑。

Answer 1

您添加了两次过滤器。第一次作为 Servlet Filter第二次出现在 filter chain Spring 安全。

默认情况下，Spring Boot 将您的过滤器映射到 /*，请参阅 Spring Boot Docs :

By default, if the context contains only a single Servlet it will be mapped to /. In the case of multiple Servlets beans the bean name will be used as a path prefix. Filters will map to /*.

If convention-based mapping is not flexible enough you can use the ServletRegistrationBean and FilterRegistrationBean classes for complete control. You can also register items directly if your bean implements the ServletContextInitializer interface.

要更改映射，另请参阅:How to add a filter class in Spring Boot?

您应该只将 Spring Security 过滤器(或扩展)添加到过滤器链中，请参阅 HttpSecurity.html#addFilter :

Adds a Filter that must be an instance of or extend one of the Filters provided within the Security framework.

您的过滤器扩展了AbstractPreAuthenticatedProcessingFilter，并且应该仅添加到过滤器链中。

停止 Spring Boot 映射过滤器的一种方法是:不要使用 @Bean 公开过滤器，请参阅 Spring Boot Docs .

When using an embedded servlet container you can register Servlets and Filters directly as Spring beans.