Question

我刚刚开始学习oAuth2授权来保护我的API。而且这个过程非常复杂。我的API是使用Jersey开发的，而Apache Oltu是使用oAuth2授权开发的。现在，可以生成令牌，但是，每次我尝试生成新令牌时，服务器都会创建一个@ApplicationScoped bean的新实例。这是我从互联网上获得的bean代码：

@ApplicationScoped
public class Database {

private Set<String> authCodes = new HashSet<>();
private Set<String> tokens = new HashSet<>();

public void addAuthCode(String authCode) {
    authCodes.add(authCode);
}

public boolean isValidAuthCode(String authCode) {
    return authCodes.contains(authCode);
}

public void addToken(String token) {
    tokens.add(token);
}

public boolean isValidToken(String token) {
    return tokens.contains(token);
}
}

这是授权码：

@Path("/authz")
public class AuthzEndpoint {

@Inject
Database database;

@GET
public Response authorize(@Context HttpServletRequest request)
        throws URISyntaxException, OAuthSystemException {
    try {
        OAuthAuthzRequest oauthRequest = new OAuthAuthzRequest(request);
        OAuthIssuerImpl oauthIssuerImpl = new OAuthIssuerImpl(new MD5Generator());

        //build response according to response_type
        String responseType = oauthRequest.getParam(OAuth.OAUTH_RESPONSE_TYPE);

        OAuthASResponse.OAuthAuthorizationResponseBuilder builder =
                OAuthASResponse.authorizationResponse(request, HttpServletResponse.SC_FOUND);

        if (responseType.equals(ResponseType.CODE.toString())) {
            final String authorizationCode = oauthIssuerImpl.authorizationCode();
            database.addAuthCode(authorizationCode);
            builder.setCode(authorizationCode);
        }
        if (responseType.equals(ResponseType.TOKEN.toString())) {
            final String accessToken = oauthIssuerImpl.accessToken();
            database.addToken(accessToken);

            builder.setAccessToken(accessToken);
            builder.setExpiresIn(3600l);
        }

        String redirectURI = oauthRequest.getParam(OAuth.OAUTH_REDIRECT_URI);
        final OAuthResponse response = builder.location(redirectURI).buildQueryMessage();
        URI url = new URI(response.getLocationUri());
        return Response.status(response.getResponseStatus()).location(url).build();
    } catch (OAuthProblemException e) {
        final Response.ResponseBuilder responseBuilder = Response.status(HttpServletResponse.SC_FOUND);
        String redirectUri = e.getRedirectUri();

        if (OAuthUtils.isEmpty(redirectUri)) {
            throw new WebApplicationException(
                    responseBuilder.entity("OAuth callback url needs to be provided by client!!!").build());
        }
        final OAuthResponse response =
                OAuthASResponse.errorResponse(HttpServletResponse.SC_FOUND)
                        .error(e).location(redirectUri).buildQueryMessage();
        final URI location = new URI(response.getLocationUri());
        return responseBuilder.location(location).build();
    }
}
}

如你所见，那里有@Inject数据库注释，并在代码的某些部分调用了addToken（）方法。当我尝试从我的主Web服务验证令牌时，数据库bean是空的。这是代码

@Inject
Database database;

@POST
@Path("validateLogin")
@Consumes("application/x-www-form-urlencoded")
@Produces({"application/xml", "application/json", "text/plain", "text/html"})
public Response validateLogin(@HeaderParam("Authorization") String token, @FormParam("username") String username, @FormParam("password") String password) {

    System.out.println(token.substring(7,token.length()));
    System.out.println(database.isValidToken(token.substring(7, token.length())));
    System.out.println(database);

    if (!database.isValidToken(token.substring(7, token.length()))) {
        return Response.status(Response.Status.UNAUTHORIZED).build();
    }
    else {
        String result;
        if (username == null || password == null) {
            return Response.status(Response.Status.BAD_REQUEST).build();
        }
        else {
            STCWebService stcWebService = new STCWebService();
            result = stcWebService.validateLogin(username,password);
            if (result.isEmpty()) {
                return Response.status(Response.Status.INTERNAL_SERVER_ERROR).build();
            }
            else {
                return Response
                        .status(200)
                        .entity(result)
                        .type(MediaType.APPLICATION_JSON)
                        .header("Access-Control-Allow-Origin", "*")
                        .header("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT")
                        .build();
            }
        }
    }
}

我一直认为web.xml文件或ResourceConfig.java或者甚至在ApplicationBinder中可能存在一些错误。几个小时我偶然发现了这个问题。任何帮助表示赞赏。

修改

这是ApplicationBinder代码

public class MyApplicationBinder extends AbstractBinder {
    @Override
    protected void configure() {
        bind(Database.class).to(Database.class);
    }
}

并链接到此MyApplication

public class MyApplication extends ResourceConfig {
    public MyApplication() {
        register(new MyApplicationBinder());
        packages("com.package");
    }
}

我根据此问题Dependency injection with Jersey 2.0

创建了ApplicationBinder和MyApplication代码

Answer 1

问题是如何绑定Database。

bind(Database.class).to(Database.class);

ApplicationScoped无效。您需要使用AbstractBinder配置范围。有几种方法。

只是实例化
```
bind(new Database()).to(Database.class);
```
这将自动使其成为单身人士。然而，一个问题是，如果Database拥有它自己的依赖项，它们将不会被注入。这样，您可以使用下一个解决方案
使用in(Scope)方法向服务添加范围。未提供时，默认范围为PerLookup，这意味着每次请求时都会创建一个新范围。还有其他范围，例如Singleton和RequestScope
```
bind(Database.class).to(Database.class).in(Singleton.class);
```
确保它是javax.inject.Singleton而不是EJB。

您应该在链接到的问题中向下滚动到my post： - ）

ApplicationScope类每次都在Jersey 2.0中创建新实例

1 个答案: