Question

在我的安全配置类中，我已允许对欢迎URL以及遵循“ welcome / **”格式的任何其他URL的请求。

这是我的安全配置类：

@EnableGlobalMethodSecurity(prePostEnabled = true)
//@Configuration
@EnableWebSecurity
public class JwtSecurityConfiguration extends WebSecurityConfigurerAdapter {


    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }


    private final CustomerDetailsService customerDetailsService;

    @Autowired
    private JwtAuthenticationEntryPoint unauthorizedHandler;

    @Autowired
    public JwtSecurityConfiguration(CustomerDetailsService customerDetailsService) {

        this.customerDetailsService = customerDetailsService;
    }


    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth
                .userDetailsService(customerDetailsService)
                .passwordEncoder(passwordEncoderBean());
    }

    @Bean
    public PasswordEncoder passwordEncoderBean() {
        return new BCryptPasswordEncoder();
    }



    @Override
    public void configure(WebSecurity web) throws Exception {

        web.ignoring().antMatchers("**/resources/static/**")
                .and()
                .ignoring()
                .antMatchers(
                        HttpMethod.GET,
                        "/",
                        "/*.html",
                        "/favicon.ico",
                        "/**/*.html",
                        "/**/*.css",
                        "/**/*.js",
                        "/index_assets/**"
                );
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.csrf().disable()
                .authorizeRequests()
                .antMatchers("/welcome/login").permitAll()
                .antMatchers("/welcome").permitAll()
                .antMatchers("/welcome/signup").permitAll()
                .antMatchers("admin/rest/**").authenticated()
                .and()
                .exceptionHandling().authenticationEntryPoint(unauthorizedHandler)
                .and()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

        //http.addFilterBefore(new JWTAuthenticationFilter(authenticationManager()), UsernamePasswordAuthenticationFilter.class);

         http.addFilterBefore(new JWTAuthorizationFilter(authenticationManager(),customerDetailsService),UsernamePasswordAuthenticationFilter.class);

        // disable page caching
        http
                .headers()
                .frameOptions().sameOrigin()  // required to set for H2 else H2 Console will be blank.
                .cacheControl();

        //http.headers().cacheControl();

    }
}

但是我注意到在我的JWTAuthorizationFilter.class中，doFilterInternal（）方法选择了此URL

public class JWTAuthorizationFilter  extends OncePerRequestFilter {

    private final CustomerDetailsService customerDetailsService;

    @Autowired
    DefaultCookieService defaultCookieService;


    public JWTAuthorizationFilter(AuthenticationManager authenticationManager, CustomerDetailsService customerDetailsService) {

       // super(authenticationManager);

        this.customerDetailsService = customerDetailsService;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {

        String header = request.getHeader(HEADER);

        if(Objects.isNull(header) || !header.startsWith(TOKEN_PREFIX)){


            return;


        }

        UsernamePasswordAuthenticationToken usernamePasswordAuth = getAuthenticationToken(request);

        SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuth);

        chain.doFilter(request,response);

    }

    private UsernamePasswordAuthenticationToken getAuthenticationToken(HttpServletRequest request){

        String token = request.getHeader(HEADER);

        if(Objects.isNull(token)) return null;

        String username = Jwts.parser().setSigningKey(SECRET)
                .parseClaimsJws(token.replace(TOKEN_PREFIX,""))
                .getBody()
                .getSubject();


        UserDetails userDetails = customerDetailsService.loadUserByUsername(username);

        return username != null ? new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities()) : null;
    }
}

这是什么原因？

Answer 1

假定过滤器可以接收每个请求。无论您是否允许安全配置，都没有关系。

您有两种选择：

如果您不希望welcome/**通过过滤器，则可以将其添加到网络忽略

@Override
public void configure(WebSecurity web) throws Exception {

    web.ignoring().antMatchers("**/resources/static/**")
            .and()
            .ignoring()
            .antMatchers(
                    HttpMethod.GET,
                    "/",
                    "/*.html",
                    "/favicon.ico",
                    "/**/*.html",
                    "/**/*.css",
                    "/**/*.js",
                    "/index_assets/**",
                    "/welcome/**"
            );
}

但是请注意，它将跳过所有过滤器，您可能不希望这样做。

在doFilterInternal方法中，找到welcome/**模式时将其跳过。

春季安全性：即使允许使用URL，我的授权过滤器也可以授权我的请求

1 个答案: