java - 为什么我的自定义 AuthenticationProvider 无法抛出或处理 BadCredentialsException？

Question

我尝试使用 JWT 来保护基于 Spring Security 的资源，以实现以下目标:1. Token无效或过期，返回401。2. 授权成功，但无权访问部分控制者。然后返回403。现在有问题了。当用户无法通过身份验证时，我在自定义的 AuthenticationProvider(名为 TokenAuthenticationProvider)中抛出 BadCredentialsException。但最终返回403。我该如何处理异常并返回403 http代码。

我尝试实现 AuthenticationEntryPoint 但它不起作用。处理异常的另一种方法是使用自定义过滤器来捕获异常。但这种方式肯定行不通，因为即使是http响应也不会显示500 BadCredentialsException。所以一定有一个地方已经捕获了这个异常，而我无法理解。

TokenAuthenticationProvider.class

public class TokenAuthenticationProvider implements AuthenticationProvider {

    UserService userService;

    public TokenAuthenticationProvider(UserService userService) {
        this.userService = userService;
    }

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        throw new BadCredentialsException("hello");
    }

    @Override
    public boolean supports(Class<?> aClass) {
        System.out.println(aClass);
        TokenAuthenticationProvider.class.isAssignableFrom(aClass);
        return true;
    }
}

WebSecurity.class

@EnableWebSecurity
public class WebSecurity extends WebSecurityConfigurerAdapter {

    @Autowired
    UserService userService;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .antMatcher("/**")
                .addFilterAfter(new TokenAuthenticationFilter(), BasicAuthenticationFilter.class)
                .authorizeRequests()
                .anyRequest().hasRole("API");
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth){
        auth.authenticationProvider(new TokenAuthenticationProvider(userService));
    }
}

TokenAuthenticationFilter.class

public class TokenAuthenticationFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {
        SecurityContextHolder.getContext().setAuthentication(new TokenAuthentication("hello"));
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }
}

上面的代码已经过简化。我没有遵循正常流程，而是直接抛出 BadCredentialsException。我该如何处理此异常并返回 401 http 代码。

Answer 1

您需要实现两个过滤器来控制生成的 JWT。

第一个过滤器是进行身份验证，并在身份验证成功时将 JWT 发送给客户端。

public class JWTAuthenticationFilter extends UsernamePasswordAuthenticationFilter {

    private final AuthenticationManager authenticationManager;

    public JWTAuthenticationFilter(AuthenticationManager authenticationManger) {
        this.authenticationManager = authenticationManger;
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, 
            HttpServletResponse response) throws AuthenticationException {
        try {
            AuthenticationRequest authRequest = new ObjectMapper().readValue(request.getInputStream(), 
                    AuthenticationRequest.class);
            return authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(
                    authRequest.getUsername(), authRequest.getPassword(), new ArrayList<>()));
        } catch (IOException e) {
            throw new RuntimeException(e);
        }
    }

    @Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response,
            FilterChain chain, Authentication auth) throws IOException {
        Date expirationDate = DateUtil.getDateAddDays(new Date(), 1);
        String token = Jwts.builder().setIssuedAt(new Date()).setIssuer(WebSecurity.ISSUER)
                .setSubject(((ClientDetails)auth.getPrincipal()).getUsername())
                .setExpiration(expirationDate)
                .signWith(SignatureAlgorithm.HS512, HardCodeUtil.JWT_KEY).compact();
        response.addHeader(WebSecurity.HEADER_AUTHORIZATION, WebSecurity.PREFIX_JWT + token);
        response.addHeader(WebSecurity.HEADER_JWT_EXPIRATION_DATE, String.valueOf(expirationDate.getTime()));
        ObjectMapper mapper = new ObjectMapper();
        ClientExtraParams extraParams = new ClientExtraParams((byte)1);
        String body = mapper.writeValueAsString(new ClientLoginResponse(((ClientDetails)auth.getPrincipal()).getClient(),
                extraParams));
        response.setContentType("application/json");
        response.getWriter().write(body);
        response.getWriter().flush();
        response.getWriter().close();
    }

}

第二个过滤器是在访问资源之前验证每个 JWT:

public class JWTAuthorizationFilter extends BasicAuthenticationFilter {

    private static final Logger log = Logger.getLogger(JWTAuthorizationFilter.class.getName());

    public JWTAuthorizationFilter(AuthenticationManager authManager) {
        super(authManager);
    }

    @Override
    protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain)
            throws IOException, ServletException {
        String header = req.getHeader(WebSecurity.HEADER_AUTHORIZATION);
        if (header == null || !header.startsWith(WebSecurity.PREFIX_JWT)) {
            chain.doFilter(req, res);
            return;
        }
        try {
            UsernamePasswordAuthenticationToken authentication = getAuthentication(req);
            SecurityContextHolder.getContext().setAuthentication(authentication);
            chain.doFilter(req, res);
        }catch (SignatureException ex) {
            log.log(Level.SEVERE, "JWT SIGNING INVALID");
        }catch (MalformedJwtException ex) {
            log.log(Level.SEVERE, "JWT STRUCTURE INVALID");
        }catch (ExpiredJwtException ex) {
            log.log(Level.SEVERE, "JWT EXPIRED");
            GeneralResponse jwtInvalidResponse = new GeneralResponse(ErrorsEnum.JWT_EXPIRED);
            ObjectMapper mapper = new ObjectMapper();
            String body = mapper.writeValueAsString(jwtInvalidResponse);
            res.setContentType("application/json");
            res.getWriter().write(body);
            res.getWriter().flush();
            res.getWriter().close();
        }catch (UnsupportedJwtException ex) {
            log.log(Level.SEVERE, "JWT UNSUPPORTED");
        }catch (IllegalArgumentException ex) {
            log.log(Level.SEVERE, "ILLEGAL ARGUMENT JWT ENVIADO");
        }
    }

    private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request) {
        String token = request.getHeader(WebSecurity.HEADER_AUTHORIZATION);
        if (token != null) {
            String user = Jwts.parser()
                    .setSigningKey(HardCodeUtil.JWT_KEY)
                    .parseClaimsJws(token.replace(WebSecurity.PREFIX_JWT, ""))
                    .getBody()
                    .getSubject();
            if (user != null) {
                return new UsernamePasswordAuthenticationToken(user, null, new ArrayList<>());
            }
        }
        return null;
    }

}

在 HttpSecurity 的 Spring 配置中添加以下过滤器:

.and().addFilter(new JWTAuthenticationFilter(authenticationManager()))
                    .addFilter(new JWTAuthorizationFilter(authenticationManager()));

我使用这个库实现了这个:

    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt</artifactId>
        <version>0.9.1</version>
    </dependency>