spring-security - 重定向到无状态 session 的原始 URL

Question

我正在尝试创建无状态安全性，从而将 JWT token 存储在 Cookie 而不是 SESSION 中。

问题是没有 session SavedRequestAwareAuthenticationSuccessHandler 不知道原始请求(在身份验证页面弹出之前)。所以在 77 here 行savedRequest 为空。

这看起来很奇怪，我想我做错了什么。登录无状态 session 后，如何允许页面重定向到请求的原始 URL？

1. 我禁用 session

       @Override
       protected void configure(HttpSecurity http) throws Exception {
           http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
   
          ....formLogin().loginPage("/login").permitAll().successHandler(authenticationSuccessHandler)
   
       }
   

2. 然后我创建一个自定义 AuthenticationSuccessHandler，它扩展了 SavedRequestAwareAuthenticationSuccessHandler。我将其注册为 successHandler(上图)。

    @Component
    public class JwtCookieAuthenticationSuccessHandler extends 
             SavedRequestAwareAuthenticationSuccessHandler {
       @Override
       public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication)
               throws IOException, ServletException {
   
           Cookie cookie = ... CREATE A COOKIE WITH A JWT
   
           response.addCookie(cookie);
   
           super.onAuthenticationSuccess(request, response, authentication);
       }
   
   }
   

编辑:这是我的依赖项:

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-dependencies</artifactId>
        <version>1.5.2.RELEASE</version>
        <type>pom</type>
        <scope>import</scope>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-test</artifactId>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>org.springframework.security.oauth</groupId>
        <artifactId>spring-security-oauth2</artifactId>
    </dependency>
</dependencies>

Answer 1

在你的配置中，添加:

.requestCache().requestCache(new CookieRequestCache())

完整示例:

   protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().csrfTokenRepository(new CookieCsrfTokenRepository())
                .and()
                .authorizeRequests()
                .antMatchers("/about").permitAll()
                .antMatchers("/accounts").hasRole("ADMINISTRATOR")
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
                .requestCache().requestCache(new CookieRequestCache())
                .and()
                .logout()
                .permitAll()
                .and()
                .sessionManagement()
                .maximumSessions(1)
                .sessionRegistry(sessionRegistry())
                .and()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .securityContext()
                .securityContextRepository(securityContextRepository);