我正在使用spring 4.0和java 8.0
我已将我的应用程序配置为使用OAuth authentication。
目前有三个网址用于身份验证和授权，如下所示。但是我觉得在URL查询参数或标题中发送令牌不够智能，因为它增加了安全性受损的漏洞。
对于＆＃39; grant_type =密码＆＃39; ，对于＆＃39; grant_type = refresh_token＆＃39;
最后访问我拥有的安全资源 我的问题：Spring中是否有任何配置（首选JAVA配置），它将指示我的spring应用程序接受请求正文中的标记而不是请求标头或查询参数。 以下是我的配置文件供参考： AuthorizationServer WebSecurityConfigurerAdapter ResourceServerConfiguration CustomUserDetailsService 是否有更安全的方式使用@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
private static String REALM = "MY_OAUTH_REALM";
/*
* The token store is the store where all the tokens are stored, It can be
* InMemory, JDBC, etc.
*/
@Autowired
private TokenStore tokenStore;
@Autowired
private UserApprovalHandler userApprovalHandler;
@Autowired
@Qualifier("authenticationManagerBean")
private AuthenticationManager authenticationManager;
/**
* SpringData JPA dataSource injected.
*/
@Autowired
private DataSource dataSource;
/**
* Autowiring the {@link CustomUserDetailsService} for configuring the
* {@link UserDetailsService} which provides the required user details to
* the security context.
*
* This extra implementation of the userDetailsService is necessary because
* after OAuth 2.0 version - 2.0.10.RELEASE the UserDetails service is not
* automatically extracted from the context.
*
* Here is a link to the documentation in the gitHub community. <a href=
* "https://github.com/royclarkson/spring-rest-service-oauth/issues/19">
* Documentation</a>
*/
@Autowired
private UserDetailsService userDetailsService;
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
//@formatter:off
clients.jdbc(dataSource);/*.withClient("my-trusted-client")
.authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
.authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT").scopes("read", "write", "trust").secret("secret")
.accessTokenValiditySeconds(120).// Access token is only valid for 2 minutes.
refreshTokenValiditySeconds(600);// Refresh token is only valid for 10 minutes.
//@Formatter:on
*/ }
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints.tokenStore(tokenStore).userApprovalHandler(userApprovalHandler)
.authenticationManager(authenticationManager).userDetailsService(userDetailsService);
}
@Override
public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
oauthServer.realm(REALM + "/client");
}
}
@Configuration
@EnableWebSecurity
public class OAuth2SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Autowired
private ClientDetailsService clientDetailsService;
@Autowired
private DataSource dataSource;
@Autowired
@Qualifier("customAuthenticationProvider")
private AuthenticationProvider authenticationProvider;
/**
* Defines custom authentication provider.
*/
@Override
protected void configure(AuthenticationManagerBuilder authManagerBuilder) throws Exception {
authManagerBuilder.authenticationProvider(authenticationProvider);
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()).and().authorizeRequests()
.antMatchers("/oauth/token").permitAll();
}
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/students/**");
}
@Override
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Bean
public TokenStore tokenStore() {
return new JdbcTokenStore(dataSource);
}
@Bean
@Autowired
public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore) {
TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
handler.setTokenStore(tokenStore);
handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService));
handler.setClientDetailsService(clientDetailsService);
return handler;
}
/**
* This Approval store is used to direct the OAuth server to use the
* tokenStore that is exposed as a spring bean and uses the database to
* store all the tokens.
*
* @param tokenStore
* @return The Approval store which uses the tokenStore injected into the
* spring context as a bean.
* @throws Exception
*/
@Bean
@Autowired
public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception {
TokenApprovalStore store = new TokenApprovalStore();
store.setTokenStore(tokenStore);
return store;
}
}
@Configuration
@EnableResourceServer
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
private static final String RESOURCE_ID = "my_rest_api";
@Override
public void configure(ResourceServerSecurityConfigurer resources) {
resources.resourceId(RESOURCE_ID).stateless(false);
}
@Override
public void configure(HttpSecurity http) throws Exception {
http.csrf().and().requestMatchers().antMatchers("/user/**").and().authorizeRequests()
.antMatchers("/user/**").access("hasRole('ADMIN')").and().exceptionHandling()
.accessDeniedHandler(new OAuth2AccessDeniedHandler());
}
}
/**
* The modified {@link UserDetailsService} implementation for providing the
* current authorized user to the spring context along with the roles he/she
* possesses.
*
* @author KalyanaP
*
*/
@Service
public class CustomUserDetailsService implements UserDetailsService {
@Autowired
UserComponent userComponent;
@Override
@Transactional(readOnly = true)
public UserDetails loadUserByUsername(String email) throws UsernameNotFoundException {
User user = userComponent.getUser(email);
List<GrantedAuthority> authorities = new ArrayList<>();
authorities.add(new SimpleGrantedAuthority(user.getRole().getRole()));
return new AuthUser(user);
}
}
OAuth提供spring身份验证？