java - 通过 GET 使 spring `login` 过滤器可用

Question

我们使用的是 spring security 版本 4.2.3，

我想配置 login 过滤器可通过 GET 使用。 (默认情况下，使用 GET http 方法调用 http://127.0.0.1/login 返回 404。)

为此，我扩展了 UsernamePasswordAuthenticationFilter 以配置我自己的过滤器并按如下方式配置

<beans:bean id="myUsernamePasswordAuthenticationFilter"
            class="foo.bar.MyUsernamePasswordAuthenticationFilter">
            <beans:property name="authenticationManager" ref="authenticationManager"/>
            <beans:property name="postOnly" value="false"/>
</beans:bean>

还有

<http entry-point-ref="authenticationEntryPoint">
        <custom-filter before="FORM_LOGIN_FILTER" ref="myUsernamePasswordAuthenticationFilter"/>
    ......

它不起作用!

在调试过程中，我发现在 UsernamePasswordAuthenticationFilter 构造函数中有一个硬编码行，如下所示:

public UsernamePasswordAuthenticationFilter() {
        super(new AntPathRequestMatcher("/login", "POST"));
    }

我认为，这导致 AntPathRequestMatcher.matches 总是返回 false

那么我可以配置 login 过滤器以通过 GET 访问吗？所以调用http://127.0.0.1/login/username=foo&bar=bar会被处理？!怎么样？

Answer 1

你必须使用 postOnly :

Defines whether only HTTP POST requests will be allowed by this filter. If set to true, and an authentication request is received which is not a POST request, an exception will be raised immediately and authentication will not be attempted. The unsuccessfulAuthentication() method will be called as if handling a failed authentication.

和setRequiresAuthenticationRequestMatcher , 请参阅 AbstractAuthenticationProcessingFilter :

This filter will intercept a request and attempt to perform authentication from that request if the request matches the setRequiresAuthenticationRequestMatcher(RequestMatcher).

带有 RequestMatcher匹配 HTTP GET。例如:

new AntPathRequestMatcher("/login", "GET")

参见 AntPathRequestMatcher :

Creates a matcher with the supplied pattern and HTTP method in a case insensitive manner.