java - 如何使用 SockJs 通过 STOMP Java 客户端验证 Spring 非 Web Websocket？

Question

如何使用 SockJs 通过 STOMP Java 客户端验证 Spring 非 Web Websocket？

基于 session 的身份验证？基于 token 的身份验证？

文档说:

现有的 Web 应用程序已经使用基于 HTTP 的身份验证。例如

Spring Security can secure the HTTP URLs of the application as usual. Since a WebSocket session begins with an HTTP handshake, that means URLs mapped to STOMP/WebSocket are already automatically protected and require authentication. Moreover the page that opens the WebSocket connection is itself likely protected and so by the time of the actual handshake, the user should have been authenticated.

http://docs.spring.io/spring/docs/current/spring-framework-reference/htmlsingle/#websocket-stomp-authentication

实际上，我在没有身份验证的情况下进行连接，并且正在发送消息。我的 Java 服务器应用程序使用 Spring 框架，但我的客户端是 java 客户端，而不是 Web 客户端。

Answer 1

官方文档说:

String url = "ws://127.0.0.1:8080/endpoint";
StompSessionHandler sessionHandler = new MyStompSessionHandler();
stompClient.connect(url, sessionHandler);

但还有其他带有附加参数 WebSocketHttpHeaders 的连接方法。我用它进行基本授权:

WebSocketHttpHeaders headers = new WebSocketHttpHeaders();
String auth = "user" + ":" + "password";
headers.add("Authorization", "Basic " + new String(Base64.getEncoder().encode(auth.getBytes())));
stompClient.connect(url, headers, new MyStompSessionHandler());