Question

我正在尝试使用Spring Security开发具有JWT授权的spring boot rest API。我希望所有请求都通过过滤器以验证JWT令牌，但/authenticate请求除外，该请求应生成jwt令牌。但是使用下面的代码，/authenticate请求也被过滤器拦截，由于该请求失败，导致401失败。请让我知道下面的代码中缺少什么。

JwtTokenFilter类

@Component
public class JwtTokenFilter extends OncePerRequestFilter
{

    @Autowired
    private UserService     jwtUserDetailsService;
    @Autowired
    private JwtTokenUtil    jwtTokenUtil;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException
    {

        final String requestTokenHeader = request.getHeader("Authorization");
        String username = null;
        String jwtToken = null;
        // JWT Token is in the form "Bearer token". Remove Bearer word and get
        // only the Token
        if (requestTokenHeader != null && requestTokenHeader.startsWith("Bearer "))
        {
            jwtToken = requestTokenHeader.substring(7);
            try
            {
                username = jwtTokenUtil.getUsernameFromToken(jwtToken);
            }
            catch (IllegalArgumentException e)
            {
                System.out.println("Unable to get JWT Token");
            }
            catch (ExpiredJwtException e)
            {
                System.out.println("JWT Token has expired");
            }
        }
        else
        {
            logger.warn("JWT Token does not begin with Bearer String");
        }
        // Once we get the token validate it.
        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null)
        {
            UserDetails userDetails = this.jwtUserDetailsService.loadUserByUsername(username);
            // if token is valid configure Spring Security to manually set
            // authentication
            if (jwtTokenUtil.validateToken(jwtToken, userDetails))
            {
                UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
                usernamePasswordAuthenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                // After setting the Authentication in the context, we specify
                // that the current user is authenticated. So it passes the
                // Spring Security Configurations successfully.
                SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
            }
        }
        chain.doFilter(request, response);
    }
}

JwtConfig类

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class JwtConfigurer extends WebSecurityConfigurerAdapter
{

    @Autowired
    private JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;
    @Autowired
    private UserService                 jwtUserDetailsService;
    @Autowired
    private JwtTokenFilter              jwtRequestFilter;

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception
    {
        // configure AuthenticationManager so that it knows from where to load
        // user for matching credentials
        // Use BCryptPasswordEncoder
        auth.userDetailsService(jwtUserDetailsService).passwordEncoder(passwordEncoder());
    }
    @Bean
    public PasswordEncoder passwordEncoder()
    {
        return new BCryptPasswordEncoder();
    }
    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception
    {
        return super.authenticationManagerBean();
    }
    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception
    {
        // We don't need CSRF for this example

        httpSecurity.csrf().disable().
        // dont authenticate this particular request
                authorizeRequests().antMatchers("/authenticate").permitAll().
                // all other requests need to be authenticated
                anyRequest().authenticated().and().
                // make sure we use stateless session; session won't be used to
                // store user's state.
                exceptionHandling().authenticationEntryPoint(jwtAuthenticationEntryPoint).and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        // Add a filter to validate the tokens with every request
        httpSecurity.addFilterAfter(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
    }
}

控制器类

@RestController
@CrossOrigin
public class JwtAuthenticationController
{

    @Autowired
    private AuthenticationManager   authenticationManager;
    @Autowired
    private JwtTokenUtil            jwtTokenUtil;
    @Autowired
    private UserService             userDetailsService;

    @RequestMapping(value = "/authenticate", method = RequestMethod.POST)
    public ResponseEntity<?> createAuthenticationToken(@RequestBody User authenticationRequest) throws Exception
    {
        authenticate(authenticationRequest.getUsername(), authenticationRequest.getPassword());
        final UserDetails userDetails = userDetailsService.loadUserByUsername(authenticationRequest.getUsername());
        final String token = jwtTokenUtil.generateToken(userDetails);

        User u = new User();
        u.setUsername(authenticationRequest.getUsername());
        u.setToken(token);
        return ResponseEntity.ok(u);
    }
    private void authenticate(String username, String password) throws Exception
    {
        try
        {
            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password));
        }
        catch (DisabledException e)
        {
            throw new Exception("USER_DISABLED", e);
        }
        catch (BadCredentialsException e)
        {
            throw new Exception("INVALID_CREDENTIALS", e);
        }
    }
}

Answer 1

基本上，OncePerRequestFilter仅以这种方式工作。不确定是否可以避免。引用文档：

过滤器基类，旨在保证每个执行一次在任何servlet容器上请求分派。

您也可以尝试添加方法类型，以在端点上跳过身份验证。 .antMatchers(HttpMethod.GET, "/authenticate").permitAll()

Answer 2

正如Mohit所指出的，即使我在您的配置中也看不到任何错误。

如果您理解以下说明，它将帮助您解决。
即使/authenticate请求是allowAll配置的，该请求也应该通过您的JWT过滤器。但是FilterSecurityInterceptor是最后一个过滤器，它将根据将决定是否允许或拒绝请求来检查已配置的antMatchers和相关的限制/权限。

对于/authenticate方法，它应该通过filter和requestTokenHeader，用户名应该为null，并确保chain.doFilter(request, response);到达并且没有任何异常。

当到达FilterSecurityInterceptor并且如果您将日志级别设置为debug时，应打印如下所示的日志。

DEBUG - /app/admin/app-config at position 12 of 12 in additional filter chain; firing Filter: 'FilterSecurityInterceptor' 
DEBUG - Checking match of request : '/app/admin/app-config'; against '/resources/**' 
DEBUG - Checking match of request : '/app/admin/app-config'; against '/' 
DEBUG - Checking match of request : '/app/admin/app-config'; against '/login' 
DEBUG - Checking match of request : '/app/admin/app-config'; against '/api/**' 
DEBUG - Checking match of request : '/app/admin/app-config'; against '/app/admin/app-config' 
DEBUG - Secure object: FilterInvocation: URL: /app/admin/app-config; Attributes: [permitAll] 
DEBUG - Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@511cd205: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 696171A944493ACA1A0F7D560D93D42B; Granted Authorities: ROLE_ANONYMOUS 
DEBUG - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@6df827bf, returned: 1 
DEBUG - Authorization successful

附加这些日志，以便可以预测问题。

Answer 3

编写一个实现 org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter 的配置类，并覆盖configur方法，如下所示：

@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
    // dont authenticate this particular request. you can use a wild card here. e.g /unprotected/**
    httpSecurity.csrf().disable().authorizeRequests().antMatchers("/authenticate").permitAll().
            //authenticate everything else
    anyRequest().authenticated().and().exceptionHandling().authenticationEntryPoint(jwtAuthenticationEntryPoint).and().sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    // Add a filter to validate the tokens with every request
    httpSecurity.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
}

Answer 4

我为此苦苦挣扎了两天，最好的解决方案是将 Tom answer 与我的 SecurityConfig 上的此设置相结合：

override fun configure(http: HttpSecurity?) {
        // Disable CORS
        http!!.cors().disable()

        // Disable CSRF
        http.csrf().disable()

        // Set session management to stateless
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)

        //Add JwtTokenFilter
        http.addFilterBefore(jwtTokenFilter, UsernamePasswordAuthenticationFilter::class.java)
    }

在春季启动安全性中

4 个答案: