java - 当路径变量中包含点或句点时，为什么我会收到“在 SecurityContext 中找不到身份验证对象”？

Question

阅读了大量与以下 Spring 错误消息相关的帖子后。

在 SecurityContext 中找不到身份验证对象

我相信我可能正在处理 Spring 中的一个错误...但我想验证一下。我正在使用 Spring Authentication 来保护 Rest WebService。这是请求映射。

@RequestMapping(value = "/users/{login:.+}/", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
@Timed
@RolesAllowed(AuthoritiesConstants.ADMIN)
ResponseEntity<User> getUser(@PathVariable String login) {
    log.debug("REST request to get User : {}", login);
    return userRepository.findOneByLogin(login)
            .map(user -> new ResponseEntity<>(user, HttpStatus.OK))
            .orElse(new ResponseEntity<>(HttpStatus.NOT_FOUND));
}

我必须支持使用电子邮件登录的旧用户。这意味着某些用户的名字中会包含点。处理路径变量中的点的问题似乎已经解决了很多次，建议只需将标准路径变量 {login} 更改为 {login:.+}。

鉴于以下两个请求。

curl 'http://localhost:8080/api/users/areifers/?cacheBuster=1448012530942 ' -H“AuthHeader: super secret ”

上述请求将按设计工作并返回适当的用户信息。

curl 'http://localhost:8080/api/users/arei.fers/?cacheBuster=1448012530942 ' -H“AuthHeader: super secret ”

在路径变量中添加单个点或句点，请求将不再有效。未调用身份验证过滤器，这使得调试变得困难。返回的响应如下:

{"timestamp":1448014341997,"status":500,"error":"Internal Server Error","exception":"org.springframework.security.authentication.AuthenticationCredentialsNotFoundException","message":"An Authentication object was not found in the SecurityContext","path":"/api/users/areif.ers/"} 

我有什么遗漏的吗？为什么仅在路径中添加句点时，两个具有完全相同 header 的相同请求会得到不同的处理？我能想到的唯一理由是 {login:.+} 在某处被覆盖/忽略。不幸的是，我不确定深入研究这种可能性的最佳方法是什么。任何和所有指导表示赞赏。

更新我尝试通过将代码更改为

来对此进行更多试验

@RequestMapping(value = "/users/{login:.+}/", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
@Timed  
ResponseEntity<User> getUser(@PathVariable String login) {

    if(!SecurityUtils.isUserInRole(AuthoritiesConstants.ADMIN)){
         return new ResponseEntity<>(HttpStatus.FORBIDDEN);
    }

    log.debug("REST request to get User : {}", login);          
    return userRepository.findOneByLogin(login)
            .map(user -> new ResponseEntity<>(user, HttpStatus.OK))
            .orElse(new ResponseEntity<>(HttpStatus.NOT_FOUND));
}

请求 Controller 被正确调用，但是，由于原始错误将指示给定两个请求，而唯一的区别是路径变量中的点/句点，当路径变量中包含点/句点时，SecurityUtils Context 确实为 Null。这种方法至少给了我一个转储所有 header 以检查请求分解的位置。以下是工作请求与空安全上下文请求的分割

工作请求调试

[INFO] com.dcc.cpmadmin.web.rest.UserResource - url: http://localhost:8080/api/users/areifers/?cacheBuster=1448018046034
[INFO] com.dcc.cpmadmin.web.rest.UserResource - method:GET
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: host:localhost:8080
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: accept-encoding:gzip, deflate, sdch
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: accept-language:en-US,en;q=0.8
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: user-agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: accept:application/json, text/plain, */*
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: referer:http://localhost:8080/
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: x-auth-token:areifers:1448378026027:586ca2d1295c333e58ae1a249e8fc04e
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: cookie:_ga=GA1.1.1411040107.1423942263; NG_TRANSLATE_LANG_KEY=%22en%22; JSESSIONID=A4F3003CDCAF1CE26EFBF220739EEBAC
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: connection:keep-alive
[INFO] com.dcc.cpmadmin.web.rest.UserResource - Attribute: 'cacheBuster', Value: '1448018046034'
[DEBUG] com.dcc.cpmadmin.web.rest.UserResource - REST request to get User : areifers
Hibernate: select user0_.id as id1_31_, user0_.created_by as created_2_31_, user0_.c

安全上下文 NULL 请求详细信息

[INFO] com.dcc.cpmadmin.web.rest.UserResource - url: http://localhost:8080/api/users/arei.fers/?cacheBuster=1448018046034
[INFO] com.dcc.cpmadmin.web.rest.UserResource - method:GET
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: host:localhost:8080
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: accept-encoding:gzip, deflate, sdch
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: accept-language:en-US,en;q=0.8
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: user-agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: accept:application/json, text/plain, */*
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: referer:http://localhost:8080/
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: x-auth-token:areifers:1448378026027:586ca2d1295c333e58ae1a249e8fc04e
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: cookie:_ga=GA1.1.1411040107.1423942263; NG_TRANSLATE_LANG_KEY=%22en%22; JSESSIONID=A4F3003CDCAF1CE26EFBF220739EEBAC
[INFO] com.dcc.cpmadmin.web.rest.UserResource - header: connection:keep-alive
[INFO] com.dcc.cpmadmin.web.rest.UserResource - Attribute: 'cacheBuster', Value: '1448018046034'

摘要请注意，请求中的所有内容(我在沮丧状态下看到的)绝对是相同的，包括 x-auth-header 和 JSessionID，它们都与此应用程序中的身份验证相关。我越来越确信这是一个错误，有人可以确认吗？

为了完整性，这是完整的错误日志

[ERROR] org.apache.catalina.core.ContainerBase.[Tomcat].[localhost].[/].[dispatcherServlet] - Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed; nested exception is org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext] with root cause
org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.credentialsNotFound(AbstractSecurityInterceptor.java:339) ~[spring-security-core-3.2.7.RELEASE.jar:3.2.7.RELEASE]
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:198) ~[spring-security-core-3.2.7.RELEASE.jar:3.2.7.RELEASE]
    at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:60) ~[spring-security-core-3.2.7.RELEASE.jar:3.2.7.RELEASE]
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) ~[spring-aop-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:92) ~[spring-aop-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) ~[spring-aop-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at com.ryantenney.metrics.spring.TimedMethodInterceptor.invoke(TimedMethodInterceptor.java:48) ~[metrics-spring-3.0.3.jar:na]
    at com.ryantenney.metrics.spring.TimedMethodInterceptor.invoke(TimedMethodInterceptor.java:34) ~[metrics-spring-3.0.3.jar:na]
    at com.ryantenney.metrics.spring.AbstractMetricMethodInterceptor.invoke(AbstractMetricMethodInterceptor.java:59) ~[metrics-spring-3.0.3.jar:na]
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) ~[spring-aop-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:653) ~[spring-aop-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at com.dcc.cpmadmin.web.rest.UserResource$$EnhancerBySpringCGLIB$$20b66579.getUser(<generated>) ~[spring-core-4.1.6.RELEASE.jar:na]
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_65]
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_65]
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_65]
    at java.lang.reflect.Method.invoke(Method.java:497) ~[na:1.8.0_65]
    at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:221) ~[spring-web-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:137) ~[spring-web-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:110) ~[spring-webmvc-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandleMethod(RequestMappingHandlerAdapter.java:776) ~[spring-webmvc-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:705) ~[spring-webmvc-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85) ~[spring-webmvc-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:959) ~[spring-webmvc-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:893) ~[spring-webmvc-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:966) ~[spring-webmvc-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:857) ~[spring-webmvc-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:618) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:842) ~[spring-webmvc-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:725) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:291) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) ~[tomcat-embed-websocket-8.0.20.jar:8.0.20]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at com.codahale.metrics.servlet.AbstractInstrumentedFilter.doFilter(AbstractInstrumentedFilter.java:104) ~[metrics-servlet-3.1.1.jar:3.1.1]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.springframework.boot.actuate.autoconfigure.EndpointWebMvcAutoConfiguration$ApplicationContextHeaderFilter.doFilterInternal(EndpointWebMvcAutoConfiguration.java:291) ~[spring-boot-actuator-1.2.3.RELEASE.jar:1.2.3.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:77) ~[spring-web-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:186) ~[spring-security-web-3.2.7.RELEASE.jar:3.2.7.RELEASE]
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160) ~[spring-security-web-3.2.7.RELEASE.jar:3.2.7.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.springframework.boot.actuate.trace.WebRequestTraceFilter.doFilterInternal(WebRequestTraceFilter.java:102) ~[spring-boot-actuator-1.2.3.RELEASE.jar:1.2.3.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:85) ~[spring-web-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) ~[tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106) [tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501) [tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142) [tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) [tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) [tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:516) [tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1086) [tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:659) [tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.coyote.http11.Http11NioProtocol$Http11ConnectionHandler.process(Http11NioProtocol.java:223) [tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1558) [tomcat-embed-core-8.0.20.jar:8.0.20]
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1515) [tomcat-embed-core-8.0.20.jar:8.0.20]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_65]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_65]
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.0.20.jar:8.0.20]
    at java.lang.Thread.run(Thread.java:745) [na:1.8.0_65]

更新第二个根据添加尾部斜杠的建议，我将代码更新为以下内容，删除变量上的 :.+ 并添加/，错误日志对于更复杂的用户名保持不变。

@RequestMapping(value = "/users/{login}/", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
    @Timed  
    @RolesAllowed({ AuthoritiesConstants.ADMIN, AuthoritiesConstants.FACULTY })
    ResponseEntity<User> getUser(@PathVariable String login, HttpServletRequest req) {

        printRequestInfo(req);

        log.debug("REST request to get User : {}", login);          
        return userRepository.findOneByLogin(login)
                .map(user -> new ResponseEntity<>(user, HttpStatus.OK))
                .orElse(new ResponseEntity<>(HttpStatus.NOT_FOUND));
    }

错误日志保持不变。

Answer 1

URL 将通过使用尾部斜杠来接受特殊字符。在请求映射路径变量中添加斜杠，如以下代码片段所示。

http://localhost:8080/utooa/service/api/admin/test/Takeoff.Java@gmail.com/

@RequestMapping(value ="/test/{name}/", 
method = RequestMethod.POST, 
headers="Accept=application/json")

    public void test(@PathVariable String name) 
    {
        System.out.println(name);
    }