java - Spring Security - 需要添加自定义cookie

Question

我是 Servlet 新手。我需要生成自定义值 cookie。在下面提到的代码中，生成了 session cookie，但我还需要一个具有自定义值的 session cookie。

public ServletContextInitializer servletContextInitializer() {
    servletContext -> servletContext.getSessionCookieConfig().setName("sessiondemo");
}

我的Servlet代码如下。在评论行中我需要添加cookie。基本上，我重定向了来这里初始化 servlet session 的请求，同时我还需要在 servletcontext 中生成一个名为 hello 和 value world 的 cookie。

public class WebSecurityConfigurer extends WebMvcConfigurerAdapter {

    @Autowired
    private Environment environment;
    UserDetails user;

    @Override
    public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/login").setViewName("login");
    }

    @Bean
    public ServletContextInitializer servletContextInitializer() {
        /* This code doesn't work here. I need to use here to set up the cookie
        Cookie cookie = new Cookie("YourCookieName", "CookieStringValue");
        cookie.setMaxAge(10 * 365 * 24 * 60 * 60); // set cookie for 10 years
        response.addCookie(cookie); */
        return servletContext -> servletContext.getSessionCookieConfig()
                .setName("oneKosmosIdpSessionId");
    }

    @Configuration
    @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
    protected static class ApplicationSecurity extends WebSecurityConfigurerAdapter {

        @Autowired
        private IdpConfiguration idpConfiguration;

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                    .csrf().disable()
                    .authorizeRequests()
                    .antMatchers("/", "/metadata", "/favicon.ico", "/api/**", "/*.css",
                            "/css/**", "/js/**", "/img/**", "/fonts/**").permitAll()
                    .antMatchers("/admin/**").hasRole("ADMIN")
                    .anyRequest().hasRole("USER")
                    .and()
                    .formLogin()
                    .loginPage("/login")
                    .permitAll()
                    .defaultSuccessUrl("/user.html", true)
                    .failureUrl("/login?error=true")
                    .permitAll()
                    .and()
                    .logout()
                    .logoutSuccessUrl("/");
        }

        @Override
        public void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.authenticationProvider(new AuthenticationProvider(idpConfiguration));
        }
    }
}

Answer 1

sessionCookieConfig 类用于更改 Servlet 引擎的常规 cookie 设置。

由于您使用的是 Spring Security，因此 session 管理由 Spring 处理。所以，你实际上并不需要cookie。如果您需要存储任何用户级参数，请将其存储在您自己的 Spring UserDetails 对象实现中，并在 View 中检索它。

This tag allows access to the current Authentication object stored in the security context. It renders a property of the object directly in the JSP. So, for example, if the principal property of the Authentication is an instance of Spring Security's UserDetails object, then using will render the name of the current user.

Of course, it isn't necessary to use JSP tags for this kind of thing and some people prefer to keep as little logic as possible in the view. You can access the Authentication object in your MVC controller (by calling SecurityContextHolder.getContext().getAuthentication()) and add the data directly to your model for rendering by the view.

来源:https://docs.spring.io/spring-security/site/docs/3.0.x/reference/taglibs.html