java - spring boot，默认身份验证失败处理程序如何工作

Question

就是这样，我使用内存数据库开发了一个简单的 spring boot 安全应用程序。身份验证成功后，它会重定向到另一个站点，我的问题是身份验证失败，因为它显示了一个空白屏幕。

我已经设置了一个 spring 安全应用程序并实现了一个 AuthenticationFailureHandler 和一个 AuthenticationSuccessHandler。当我不使用自定义 AuthenticationFailureHandler 时，我确实会在屏幕上收到 BAD CREDENTIALS 消息。

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;

import com.tech.app.security.handler.CsegAuthenticationFailureHandler;
import com.tech.app.security.handler.CsegAuthenticationSuccessHandler;

@SuppressWarnings("deprecation")
@Configuration
@EnableWebSecurity
public class CsegSecurityConfig extends WebSecurityConfigurerAdapter{

    @Autowired
    private CsegAuthenticationSuccessHandler successHandler;
    @Autowired
    private CsegAuthenticationFailureHandler failureHandler;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests().antMatchers(HttpMethod.POST, "/login").permitAll()
            .anyRequest().authenticated().and()
            .formLogin()
            .successHandler(successHandler)
            .failureHandler(failureHandler);

    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .inMemoryAuthentication().passwordEncoder(NoOpPasswordEncoder.getInstance()).withUser("user").password("password").roles("USER");
    }



}

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.DefaultRedirectStrategy;
import org.springframework.security.web.RedirectStrategy;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.stereotype.Component;

import com.fasterxml.jackson.databind.ObjectMapper;

@Component
public class CsegAuthenticationFailureHandler implements AuthenticationFailureHandler{

    private ObjectMapper objectMapper = new ObjectMapper();
    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
            AuthenticationException exception) throws IOException, ServletException {

        System.out.println("credenciales invalidas");
        response.setStatus(HttpStatus.UNAUTHORIZED.value());
        Map<String, Object> data = new HashMap<>();
        data.put("timestamp", Calendar.getInstance().getTime());
        data.put("exception", exception.getMessage());

        response.getOutputStream()
          .println(objectMapper.writeValueAsString(data));
        redirectStrategy.sendRedirect(request, response, "/login?error=true");

    }

}

我想要的是在身份验证失败时在数据库中保存一条记录并返回到 spring 生成的默认登录页面，并在屏幕上显示相应的 BAD CREDENTIALS 消息。我还想知道默认的 AuthenticationFailureHandler 在哪里以及它是如何工作的。我得到的只是一个空白屏幕

Answer 1

重定向是通过为响应设置适当的 Location header 来实现的。有了输出流，您必须首先按照特定顺序编写协议(protocol)、 header 、响应主体。

如果你开始写正文，你就不能写标题(除非你正在缓冲输出)。所以要么写正文，要么做重定向。