Question

我定义了一个自定义过滤器，我在BasicAutenticationFilter之后添加了...

问题是，当我对微服务执行ping操作（在这种情况下，通过牧场主的健康状况检查）时，它总是进入过滤器，并且做某事是假定不应该这样做的，我说这应该是不应该的，因为我放了ping antmatchers以允许所有请求，我的过滤器中的代码是这样的：

@Override
public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain)
        throws IOException, ServletException {

    logger.debug(this + "received authentication request from " + request.getRemoteHost() + " to " + request.getLocalName());

    if (request instanceof HttpServletRequest) {
        if (isAuthenticationRequired()) {
            authenticate(request,response);
        } else {
            logger.debug("session already contained valid Authentication - not checking again");
        }
    }
    chain.doFilter(request, response);
}   

private boolean isAuthenticationRequired() {
    Authentication existingAuth = SecurityContextHolder.getContext().getAuthentication();
    if ((existingAuth == null) || !existingAuth.isAuthenticated()) {
        return true;
    }
    return false;
}

我假设，当您使用SecurityContextHolder.getContext（）。getAuthentication（）;时，它应该验证antmatchers并返回true，我知道我知道这样做确实很神奇，但是然后，我需要找到一个方法来验证请求并告诉spring security在antmatchers列表中。 / p>

Answer 1

您可以只使用过滤器进行运行状况检查。将其放置在FIRST

的位置

public class HealthFilter extends OncePerRequestFilter {

    private String healthPath = "/healthcheck/**";
    private AntPathRequestMatcher matcher = new AntPathRequestMatcher(healthPath);

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain) throws ServletException, IOException {

        if (matcher.matches(request)) { //evaluate health check
            //do anything you want over here.
            //including performing your health check
            response.getWriter().write("OK");
            response.setStatus(200);
        }
        else {
            //only execute the other filters if we're not doing a health check
            filterChain.doFilter(request, response);
        }

    }
}

在线integration tests are available

如何在自定义过滤器中验证Spring Security antmatcher

1 个答案: