java - JERSEY - 将 javax.ws.rs.core.Response 作为 JSON 对象返回，并带有错误 :. .. 或 token :

Question

编辑:有没有办法返回一个具有以下任一功能的简单对象:

• token
• 错误
• 错误 和 详细信息

...无需创建新对象。最有效且最容易理解的方法是什么？

我正在尝试创建一个登录服务，@Consumes(MediaType.APPLICATION_JSON)(包含登录凭据:用户名、密码、消费者( boolean 值))。

如果凭据有效，我想返回一个 token (供前端使用)和一个响应代码 OK/200 ;像这样的 JSON 对象:

{"token":"aAKGKas211"}

否则，每种情况都会出现特定错误，并且我想返回不同的响应代码，如下所示:

{"error":"Invalid username or password"}

我尝试将字符串错误(=“无效的用户名或密码”)添加到 Response.Status.NOT_ACCEPTABLE).entity(error)，但我将字符串作为字符串而不是 JSON 对象获取。

这就是我的代码的样子:

@POST
@Path("/login")
@Produces(MediaType.APPLICATION_JSON)
@Consumes(MediaType.APPLICATION_JSON)
public Response login(@Context HttpServletRequest req, LoginInfo loginInfo) {
    CouponClientFacade facade = null;
    String token = null, error = null;

    // validate the REQUESTer's token, if he is already logged in return ERROR RESPONSE.
    System.out.println(loginInfo);
    System.out.println(req.getSession().getId());
    if (loginInfo == null)
        return Response.ok("Test").build();
    if (validateCredentials(loginInfo))
        return Response.status(Response.Status.NOT_ACCEPTABLE).entity("Invalid username or password").build();


    try { // Try to login into administrator
        facade = ClientType.ADMIN.login(loginInfo.getUsername(), loginInfo.getPassword());
    } catch (Exception E) { // Couldn't login into administrator
        try {
            if (loginInfo.isCustomer()) // Try to login into CUSTOMER account
                facade = ClientType.CUSTOMER.login(loginInfo.getUsername(), loginInfo.getPassword());
            else // Try to login into COMPANY account
                facade = ClientType.COMPANY.login(loginInfo.getUsername(), loginInfo.getPassword());

        } catch (BadUsernamePassword e) {
            return Response.status(Response.Status.FORBIDDEN).entity(error=e.getMessage()).build();
        } catch (UnexpectedError e) {
            return Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity(error=e.getMessage()).build();
        }
    }
    if (facade != null) {
        token = SessionManager.generateToken(req.getSession().getId(), facade);
        return Response.ok(token).build();
    } else return Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity(error="111").build();
}

编辑:

Answer 1

在“授权” header 中传递您的 token

基本身份验证为这个问题提供了解决方案，尽管不是很安全。通过基本身份验证，客户端使用 HTTP [Authorization] header 随每个请求发送 Base64 编码的凭据。这意味着每个请求独立于其他请求，服务器可能/不为客户端维护任何状态信息，这从可扩展性的角度来看是有好处的。

关于 HTTPS 的一句话:对于任何类型的安全实现，从基本身份验证到成熟的 OAuth2 实现，HTTPS 都是必须具备的。如果没有 HTTPS，无论您的实现方式如何，安全性都容易受到损害。

String plainClientCredentials="myusername:mypassword";
String base64ClientCredentials = new String(Base64.encodeBase64(plainClientCredentials.getBytes()));

HttpHeaders headers = getHeaders();
headers.add("Authorization", "Basic " + base64ClientCredentials);

这可能会产生类似的结果:

Authorization : Basic bXktdHJ1c3FOO1jbGllbnQ6c2VjcmV0...

基本身份验证和 Spring Security通过两个步骤，您可以在 Spring Security 配置中启用基本身份验证。1. 配置 httpBasic :配置 HTTP 基本身份验证。 [XML 中的 http 基础]2. 使用 BasicAuthenticationEntryPoint 配置身份验证入口点:如果身份验证失败 [凭据无效/丢失]，将触发此入口点。这非常重要，因为我们不希望 [Spring Security 默认行为] 在身份验证失败时重定向到登录页面 [我们没有登录页面]。

下面显示的是带有 httpBasic 和入口点设置的完整 Spring Security 配置。

package com.websystique.springmvc.security;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    private static String REALM="MY_TEST_REALM";

    @Autowired
    public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("bill").password("abc123").roles("ADMIN");
        auth.inMemoryAuthentication().withUser("tom").password("abc123").roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

      http.csrf().disable()
        .authorizeRequests()
        .antMatchers("/user/**").hasRole("ADMIN")
        .and().httpBasic().realmName(REALM).authenticationEntryPoint(getBasicAuthEntryPoint())
        .and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);//We don't need sessions to be created.
    }

    @Bean
    public CustomBasicAuthenticationEntryPoint getBasicAuthEntryPoint(){
        return new CustomBasicAuthenticationEntryPoint();
    }

    /* To allow Pre-flight [OPTIONS] request from browser */
    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers(HttpMethod.OPTIONS, "/**");
    }
}

以及实际的入口点，如果身份验证失败，将触发该入口点。您可以对其进行自定义以发送自定义内容作为响应。

package com.websystique.springmvc.security;

import java.io.IOException;
import java.io.PrintWriter;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint;

public class CustomBasicAuthenticationEntryPoint extends BasicAuthenticationEntryPoint {

    @Override
    public void commence(final HttpServletRequest request, 
            final HttpServletResponse response, 
            final AuthenticationException authException) throws IOException, ServletException {
        //Authentication failed, send error response.
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        response.addHeader("WWW-Authenticate", "Basic realm=" + getRealmName() + "");

        PrintWriter writer = response.getWriter();
        writer.println("HTTP Status 401 : " + authException.getMessage());
    }

    @Override
    public void afterPropertiesSet() throws Exception {
        setRealmName("MY_TEST_REALM");
        super.afterPropertiesSet();
    }
}

这就是配置基本安全性所需的全部内容。现在让我们通过我们良好的旧 REST API 来看看一切的实际情况

REST API简单的 Spring REST API，为用户提供服务。客户端可以使用标准 HTML 动词执行 CRUD 操作，符合 REST 风格。

package com.websystique.springmvc.controller;

import java.util.List;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.util.UriComponentsBuilder;

import com.websystique.springmvc.model.User;
import com.websystique.springmvc.service.UserService;

@RestController
public class HelloWorldRestController {

    @Autowired
    UserService userService;  //Service which will do all data retrieval/manipulation work


    //-------------------Retrieve All Users--------------------------------------------------------

    @RequestMapping(value = "/user/", method = RequestMethod.GET)
    public ResponseEntity<List<User>> listAllUsers() {
        List<User> users = userService.findAllUsers();
        if(users.isEmpty()){
            return new ResponseEntity<List<User>>(HttpStatus.NO_CONTENT);//You many decide to return HttpStatus.NOT_FOUND
        }
        return new ResponseEntity<List<User>>(users, HttpStatus.OK);
    }


    //-------------------Retrieve Single User--------------------------------------------------------

    @RequestMapping(value = "/user/{id}", method = RequestMethod.GET, produces = {MediaType.APPLICATION_JSON_VALUE,MediaType.APPLICATION_XML_VALUE})
    public ResponseEntity<User> getUser(@PathVariable("id") long id) {
        System.out.println("Fetching User with id " + id);
        User user = userService.findById(id);
        if (user == null) {
            System.out.println("User with id " + id + " not found");
            return new ResponseEntity<User>(HttpStatus.NOT_FOUND);
        }
        return new ResponseEntity<User>(user, HttpStatus.OK);
    }



    //-------------------Create a User--------------------------------------------------------

    @RequestMapping(value = "/user/", method = RequestMethod.POST)
    public ResponseEntity<Void> createUser(@RequestBody User user, UriComponentsBuilder ucBuilder) {
        System.out.println("Creating User " + user.getName());

        if (userService.isUserExist(user)) {
            System.out.println("A User with name " + user.getName() + " already exist");
            return new ResponseEntity<Void>(HttpStatus.CONFLICT);
        }

        userService.saveUser(user);

        HttpHeaders headers = new HttpHeaders();
        headers.setLocation(ucBuilder.path("/user/{id}").buildAndExpand(user.getId()).toUri());
        return new ResponseEntity<Void>(headers, HttpStatus.CREATED);
    }


    //------------------- Update a User --------------------------------------------------------

    @RequestMapping(value = "/user/{id}", method = RequestMethod.PUT)
    public ResponseEntity<User> updateUser(@PathVariable("id") long id, @RequestBody User user) {
        System.out.println("Updating User " + id);

        User currentUser = userService.findById(id);

        if (currentUser==null) {
            System.out.println("User with id " + id + " not found");
            return new ResponseEntity<User>(HttpStatus.NOT_FOUND);
        }

        currentUser.setName(user.getName());
        currentUser.setAge(user.getAge());
        currentUser.setSalary(user.getSalary());

        userService.updateUser(currentUser);
        return new ResponseEntity<User>(currentUser, HttpStatus.OK);
    }

    //------------------- Delete a User --------------------------------------------------------

    @RequestMapping(value = "/user/{id}", method = RequestMethod.DELETE)
    public ResponseEntity<User> deleteUser(@PathVariable("id") long id) {
        System.out.println("Fetching & Deleting User with id " + id);

        User user = userService.findById(id);
        if (user == null) {
            System.out.println("Unable to delete. User with id " + id + " not found");
            return new ResponseEntity<User>(HttpStatus.NOT_FOUND);
        }

        userService.deleteUserById(id);
        return new ResponseEntity<User>(HttpStatus.NO_CONTENT);
    }


    //------------------- Delete All Users --------------------------------------------------------

    @RequestMapping(value = "/user/", method = RequestMethod.DELETE)
    public ResponseEntity<User> deleteAllUsers() {
        System.out.println("Deleting All Users");

        userService.deleteAllUsers();
        return new ResponseEntity<User>(HttpStatus.NO_CONTENT);
    }

}