Question

我学习Spring，并将Spring安全性集成到当前的API中。为简单起见，我从基本身份验证开始。

但是，我面临的问题是，如果不提供凭据，则会获得标准401以及JSON响应：

{
    "timestamp": "2018-07-07T18:40:00.752+0000",
    "status": 401,
    "error": "Unauthorized",
    "message": "Unauthorized",
    "path": "/courses"
}

但是，如果我通过正确的凭据，则会得到401，但没有任何响应正文。

这是我的WebSecurityConfiguration：

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
  @Autowired
  DetailsService detailsService;

  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(detailsService)
        .passwordEncoder(User.encoder);
  }

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
        .anyRequest().authenticated()
        .and()
        .httpBasic()
        .and()
        .csrf().disable();
  }
}

这是我的DetailsService：

@Component
public class DetailsService implements UserDetailsService {

  @Autowired
  private UserRepository userRepository;

  @Override
  public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    User user = userRepository.findByEmail(username);
    if (user == null) {
      throw new UsernameNotFoundException("User with email " + username + " was not found");
    }
    return new org.springframework.security.core.userdetails.User(
        user.getEmail(),
        user.getPassword(),
        AuthorityUtils.createAuthorityList(user.getRoles())
    );
  }
}

我应该指出这一点，我是通过电子邮件而不是用户名来查找用户。

这是我的用户实体：

@Entity
@Table(name = "users")
public class User extends BaseEntity {
  public static final PasswordEncoder encoder = new BCryptPasswordEncoder();

  @Column(name = "first_name")
  private String firstName;
  @JoinColumn(name = "last_name")
  private String lastName;
  private String email;
  @JsonIgnore
  private String password;
  @JsonIgnore
  private String[] roles;

  public User(String email, String firstName, String lastName, String password,
      String[] roles) {
    this.firstName = firstName;
    this.lastName = lastName;
    this.email = email;
    setPassword(password);
    this.roles = roles;
  }

// getters and setters
}

Answer 1

首先：检查user.getRoles()是否未抛出LazyInitializationException

第二：如果哈希值是在线生成的，则BCryptPasswordEncoder might not work

Spring Security基本身份验证始终获得401

1 个答案: