java - Spring引导安全: Issue while showing login page in Angular 8

Question

我正在为我的项目实现登录功能。在前端我使用 Angular 8。我以这种方式实现，因此 Angular 8 和 Springboot 在同一端口 8090 上运行。

我的路由为

const routes: Routes = [
  { path: '', component: EmployeeComponent,canActivate:[AuthGaurdService] },
  { path: 'addemployee', component: AddEmployeeComponent,canActivate:[AuthGaurdService]},
  { path: 'login', component: LoginComponent },
  { path: 'logout', component: LogoutComponent,canActivate:[AuthGaurdService] },
];

Java端:我已经将其设置为允许所有/登录请求

Web安全配置

 @Override
    protected void configure(HttpSecurity httpSecurity)
        throws Exception
    {
        // We don't need CSRF for this example
        httpSecurity.csrf().disable()
            // dont authenticate this particular request
            .authorizeRequests().antMatchers("/login").permitAll()
            .antMatchers(HttpMethod.OPTIONS, "/**").permitAll().anyRequest().authenticated().and().
            // make sure we use stateless session; session won't be used to
            // store user's state.
            exceptionHandling().authenticationEntryPoint(jwtAuthenticationEntryPoint).and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        // Add a filter to validate the tokens with every request
        httpSecurity.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
    }
}

但在调用 localhost:8090/login 时，我仍然面对浏览器

Whitelabel Error Page This application has no explicit mapping for /error, so you are seeing this as a fallback.

Wed Feb 26 14:42:50 IST 2020 There was an unexpected error (type=Not Found, status=404). No message available

在后端，我面临

2020-02-26 14:30:44.045 WARN 5184 --- [nio-8090-exec-1] org.freelancing.utils.JwtRequestFilter : JWT Token does not begin with Bearer String 2020-02-26 14:42:49.945 WARN 5184 --- [nio-8090-exec-3] org.freelancing.utils.JwtRequestFilter : JWT Token does not begin with Bearer String 2020-02-26 14:42:51.287 WARN 5184 --- [nio-8090-exec-4] org.freelancing.utils.JwtRequestFilter : JWT Token does not begin with Bearer String

我认为这是在这个街区

@Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
                                    FilterChain chain)
        throws ServletException,
        IOException
    {
        final String requestTokenHeader = request.getHeader("Authorization");
        String username = null;
        String jwtToken = null;
        // JWT Token is in the form "Bearer token". Remove Bearer word and get
        // only the Token
        if (requestTokenHeader != null && requestTokenHeader.startsWith("Bearer "))
        {
            jwtToken = requestTokenHeader.substring(7);
            try
            {
                username = jwtTokenUtil.getUsernameFromToken(jwtToken);
            }
            catch (IllegalArgumentException e)
            {
                System.out.println("Unable to get JWT Token");
            }
            catch (ExpiredJwtException e)
            {
                System.out.println("JWT Token has expired");
            }
        }
        else
        {
            logger.warn("JWT Token does not begin with Bearer String");
        }
        // Once we get the token validate it.
        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null)
        {
            UserDetails userDetails = this.jwtUserDetailsService.loadUserByUsername(username);
            // if token is valid configure Spring Security to manually set
            // authentication
            if (jwtTokenUtil.validateToken(jwtToken, userDetails))
            {
                UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken =
                    new UsernamePasswordAuthenticationToken(userDetails, null,
                                                            userDetails.getAuthorities());
                usernamePasswordAuthenticationToken
                    .setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                // After setting the Authentication in the context, we specify
                // that the current user is authenticated. So it passes the
                // Spring Security Configurations successfully.
                SecurityContextHolder.getContext()
                    .setAuthentication(usernamePasswordAuthenticationToken);
            }
        }
        chain.doFilter(request, response);
    }

我需要的是渲染登录页面，然后获取凭据并创建 header 。但即使在点击 localhost:8090/login 时，它也会要求上面代码中的 header ，因为 header 为空，这就是我收到的错误:

JWT Token does not begin with Bearer String

登录组件

<div class="container">
  <div>
    User Name : <input type="text" name="username" [(ngModel)]="username">
    Password : <input type="password" name="password" [(ngModel)]="password">
  </div>
  <button (click)=checkLogin() class="btn btn-success">
    Login
  </button>
</div>

安全方面的新手，请帮忙

Answer 1

我假设你的 Angular 应用程序在调用它时根本不会显示。您不应尝试在同一台计算机上的同一端口上运行两个不同的服务，因为您的浏览器将无法区分哪些服务应获取您的请求。

当前您正在向您的 API (URL:*/login) 发送 GET 请求，但您可能尚未设置该请求。因此，您将在错误消息中收到 404，但您希望请求被定向到您的 Angular 应用程序以显示您的应用程序(例如登录掩码)。