java - 使用 WebSecurityConfigurerAdapter 在 Spring boot 2.x 中进行身份验证处理

Question

我正在使用 spring boot 2.0.5，对 5.0.8 的 spring 安全性有以下依赖

<dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-security</artifactId>
 </dependency>

出于测试目的，我从 rest Controller 中抛出了一个异常，如下所示。

@GetMapping("/greeting")
public Greeting greeting(@RequestParam(value = "name", defaultValue = "World") String name) {
        throw new org.springframework.security.authentication.BadCredentialsException("yoyo");
}

这是配置类的样子，

    @Configuration    
    @EnableWebSecurity
    public class BasicConfiguration extends WebSecurityConfigurerAdapter {
    
        @Override
        public void configure(WebSecurity web) throws Exception {
            web.ignoring().antMatchers("/error");
    
        }
    
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.csrf().disable().authorizeRequests().antMatchers("/error").permitAll();
        }
    }

自从它说的 spring boot 文档以来，我已经添加了/error，

Spring Boot 2.0 doesn’t deviate too much from Spring Security’sdefaults, as a result of which some of the endpoints that bypassedSpring Security in Spring Boot 1.5 are now secure by default. Theseinclude the error endpoint and paths to static resources such as/css/, /js/, /images/, /webjars/, /**/favicon.ico. If you wantto open these up, you need to explicitly configure that.

在spring boot应用类中也添加如下内容

@SpringBootApplication(exclude = {SecurityAutoConfiguration.class })

当我达到剩余终点时，我得到，

{
    "timestamp": "2021-01-17T03:52:50.069+0000",
    "status": 403,
    "error": "Forbidden",
    "message": "Access Denied",
    "path": "/greeting"
}

但我希望状态 401 带有 "message": "yoyo"如下所示，

{
    "timestamp": 2021-01-17T03:52:50.069+0000,
    "status": 401,
    "error": "Unauthorized",
    "message": "yoyo",
    "path": "/greeting"
}

我需要做哪些更改才能获得该响应

Answer 1

添加 http.exceptionHandling().authenticationEntryPoint(..) 以获得 Unauthorized 而不是 Forbidden for error 字段。

@Configuration
@EnableWebSecurity
public class BasicConfiguration extends WebSecurityConfigurerAdapter {
    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/error");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().authorizeRequests().antMatchers("/error").permitAll();

        http.exceptionHandling().authenticationEntryPoint((request, response, ex) -> {
            // You can add more logic to return different error codes
            response.sendError(401, "Unauthorized");
        });
    }
}

定义一个新类，它返回 ex.getMessage() 而不是 message 字段的 Access Denied。

@Component
public class CustomErrorAttributes extends DefaultErrorAttributes {
    @Override
    protected String getMessage(WebRequest webRequest, Throwable error) {
        return error.getMessage();
    }
}

输出:

{
    "timestamp": "2021-01-20T15:06:33.122+00:00",
    "status": 401,
    "error": "Unauthorized",
    "message": "yoyo",
    "path": "/greeting"
}