Question

我想跳过针对/ preImages请求的JWT令牌身份验证。

我已经在JwtSecurityConfig文件中尝试过此操作，但没有成功。

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/api/preImages");
}

在ServerApplication中，我编写了此方法来实现它：

//JwtAuthenticationTokenFilter.java

import java.io.IOException;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;

public class JwtAuthenticationTokenFilter extends AbstractAuthenticationProcessingFilter {

public JwtAuthenticationTokenFilter() {
    super("/api/**");
}

@Override
public Authentication attemptAuthentication(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws AuthenticationException, IOException, ServletException {

    String header = httpServletRequest.getHeader("Authorisation");


    if (header == null || !header.startsWith("Token ")) {
        throw new RuntimeException("JWT Token is missing");
    }

    String authenticationToken = header.substring(6);

    JwtAuthenticationToken token = new JwtAuthenticationToken(authenticationToken);
    return getAuthenticationManager().authenticate(token);
}


@Override
protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
    super.successfulAuthentication(request, response, chain, authResult);
    chain.doFilter(request, response);
}
}

//JwtSecurityConfig.java

import java.util.Collections;

@EnableGlobalMethodSecurity(prePostEnabled = true)
@EnableWebSecurity
@Configuration
public class JwtSecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private JwtAuthenticationProvider authenticationProvider;
@Autowired
private JwtAuthenticationEntryPoint entryPoint;

@Bean
public AuthenticationManager authenticationManager() {
    return new ProviderManager(Collections.singletonList(authenticationProvider));
}

@Bean
public JwtAuthenticationTokenFilter authenticationTokenFilter() {
    JwtAuthenticationTokenFilter filter = new JwtAuthenticationTokenFilter();
    filter.setAuthenticationManager(authenticationManager());
    filter.setAuthenticationSuccessHandler(new JwtSuccessHandler());
    return filter;
}


@Override
protected void configure(HttpSecurity http) throws Exception {

    http.csrf().disable().authorizeRequests( ).antMatchers( "/api/preImages" ).permitAll();
    http.authorizeRequests().antMatchers("**/api/**").authenticated()
            .and()
            .exceptionHandling().authenticationEntryPoint(entryPoint)
            .and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

    http.addFilterBefore(authenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class);
    http.headers().cacheControl();

}

}

但是对于“ / api / preImages”请求，它也显示“ JWT令牌丢失”。

自定义页面的JWT令牌化跳过URL

Answer 1

要添加要从过滤/安全性中排除的路径，您需要重写WebSecurityConfigurerAdapter的另一种方法：

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/api/preImages");
}

第二种方法可能是在标头中未找到令牌但创建“来宾”身份验证的情况下不在过滤器中引发异常。

自定义页面的JWT令牌化跳过URL

1 个答案: