java - 使用 Spring Security + Spring Session 将身份验证设置为 true

Question

我有一个 Spring Security + Spring Session + Spring Boot 项目和一个带有自定义登录 POST 方法的 Controller 。我有自己的方法来验证客户的凭据。验证成功后，访问 session 并将标识设置为 true 的最佳实践是什么？

我已经尝试过，但没有结果:

    @PostMapping("/login")
    public ResponseEntity loginSubmit(@RequestBody LoginForm form) {
        Errors errors = authenticationService.validateLoginForm(form);
        if (!errors.hasErrors()) {
            CustomerDTO result = authenticationService.findCustomerByEmailAndPassword(form);
            boolean success = (result != null && result.getId() != null);
            SecurityContextHolder.getContext().getAuthentication().setAuthenticated(success);
            return new ResponseEntity(result, HttpStatus.OK);
        } else {
            return new ResponseEntity(errors.getAllErrors(), HttpStatus.OK);
        }
    }

我应该如何做呢？

Answer 1

我建议不要编写自己的端点，而是通过实现自己的 org.springframework.security.authentication.AuthenticationProvider 来集成到 Spring Security 框架中

或者简单地这样做

public void login(HttpServletRequest req, String user, String pass) { 
    UsernamePasswordAuthenticationToken authReqz = new UsernamePasswordAuthenticationToken(user, pass);
    Authentication auth = authManager.authenticate(authReq);

    SecurityContext sc = SecurityContextHolder.getContext();
    sc.setAuthentication(auth);
    HttpSession session = req.getSession(true);
    session.setAttribute(SPRING_SECURITY_CONTEXT_KEY, sc);
}

详细解释可见here