java - Spring工厂方法 'springSecurityFilterChain' org.apache.catalina.filters.RemoteIpFilter没有注册订单

Question

我正在尝试使 Spring Security 过滤器与 RemoteIpFilter 一起使用。

当前错误消息是。

Failed to instantiate [javax.servlet.Filter]: Factory method'springSecurityFilterChain' threw exception; nested exception is java.lang.IllegalArgumentException: The Filter class 
org.apache.catalina.filters.RemoteIpFilter does not have a registered order and cannot be added without a specified order. Consider using addFilterBefore or addFilterAfter instead.

如果我删除 RemoteIpFilter，配置将完美运行。

Spring Boot 环境之外的 RemoteIpFilter 示例并不多。

@Configuration
@EnableWebSecurity
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
private static final String X509_CERTIFICATE_NAME = "cert";
private static final Log logger = LogFactory.getLog(SpringSecurityConfig.class);

@Autowired
SecurityConfig securityConfig;

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .addFilter(preauthProcessingFilter())
        .csrf().disable() // there is a custom CSRF Filter
        .addFilter(remoteIpFilter())
        .authenticationProvider(preauthAuthProvider())
        .authorizeRequests()
            .anyRequest()
            .authenticated()
            .and()
        .logout()
            .logoutSuccessHandler((new HttpStatusReturningLogoutSuccessHandler(HttpStatus.OK)))
            .and()
        .sessionManagement()
            .sessionAuthenticationFailureHandler(sessionAuthenticationFailureHandler())
            .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
            .sessionFixation().migrateSession()
            .maximumSessions(securityConfig.getMaximumSessionsPerUser())
            .maxSessionsPreventsLogin(true)
            ;
}

@Bean
public AbstractPreAuthenticatedProcessingFilter preauthProcessingFilter() throws Exception{
    RequestHeaderAuthenticationFilter filter = new RequestHeaderAuthenticationFilter();
    filter.setPrincipalRequestHeader(X509_CERTIFICATE_NAME);
    filter.setAuthenticationManager(authenticationManager());
    filter.setContinueFilterChainOnUnsuccessfulAuthentication(false);
    return filter;
}

@Bean
public RemoteIpFilter remoteIpFilter() {
    RemoteIpFilter filter = new RemoteIpFilter();
    return filter;
}

Answer 1

我认为你得到的异常清楚地告诉你应该做什么:
考虑使用 addFilterBefore 或 addFilterAfter 代替。

但首先让我们看一下 docs :
addFilter(javax.servlet.Filter filter) - 添加一个过滤器，该过滤器必须是安全框架内提供的过滤器之一的实例或扩展其中一个过滤器。

您的过滤器RemoteIpFilter不是spring提供的过滤器，因为它来自apache。

有两种方法可以解决这个问题:
1.您可以使用Spring过滤器类包装RemoteIpFilter，例如GenericFilterBean
2. 或者您可以使用其中一种方法来代替 addFilter(filter):
addFilterBefore(filter, class)
addFilterAfter(filter, class)
addFilterAt(过滤器，类)

另请查看this文章可能会有所帮助