java - 如何将 JwtFilter 异常传递给服务器 JSON 答案？

Question

我的智威特过滤器:

 public class JWTAuthorizationFilter extends BasicAuthenticationFilter {

    public JWTAuthorizationFilter(AuthenticationManager authManager) {
        super(authManager);
    }

    @Override
    protected void doFilterInternal(HttpServletRequest req,
                                    HttpServletResponse res,
                                    FilterChain chain) throws IOException, ServletException {
        String header = req.getHeader("Authorization");

        if (header == null || !header.startsWith("Bearer ")) {
            chain.doFilter(req, res);
            return;
        }

        UsernamePasswordAuthenticationToken authentication = getAuthentication(req);

        SecurityContextHolder.getContext().setAuthentication(authentication);
        chain.doFilter(req, res);
    }

    private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request) {
        String token = request.getHeader("Authorization");
        if (token != null) {
            // parse the token.


            byte[] keyBytes = Decoders.BASE64.decode("kaslsafdhlkjsdfhlksjdafhlaksjdfhlaskajdhflaksdaf87687687asdafasdhfasdfsdfdfjalskjfhlaskdhflasdjhl3434");
            Key key = Keys.hmacShaKeyFor(keyBytes);

            String cleanToken = token.replace("Bearer ", "");
            String user = Jwts.parser().setSigningKey(key).parseClaimsJws(cleanToken).getBody().getSubject();

            if (user != null) {
                return new UsernamePasswordAuthenticationToken(user, null, new ArrayList<>());
            }
            return null;
        }
        return null;
    }
}

它抛出“JWT 签名与本地计算的签名不匹配。JWT 有效性无法断言，不应被信任。”异常。

我尝试用 authenticationEntryPoint(new JwtAuthenticationEntryPoint()) 捕获它:

    @Component("restAuthenticationEntryPoint")
public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint {

    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authenticationException) throws IOException, ServletException {

        response.setContentType("application/json");
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        response.getOutputStream().println("{ \"error\": \"" + authenticationException.getMessage() + "\" }");

    }

}

但是我得到:

{
    "error": "Full authentication is required to access this resource"
}

如何从过滤器中获取异常并传递给 http 应答？

Answer 1

我终于找到了答案。在过滤器中我修改响应:

try {
    UsernamePasswordAuthenticationToken authentication = getAuthentication(req);

    SecurityContextHolder.getContext().setAuthentication(authentication);
    chain.doFilter(req, res);
}catch (Exception e){


    res.setStatus(HttpStatus.INTERNAL_SERVER_ERROR.value());
    res.getWriter().write(convertObjectToJson(e));
}