Question

在最新的利用WebFlux的Spring Security中，安全配置的工作方式如下，

SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
http.authorizeExchange().pathMatchers("/**") ....

在存在hasIpAddress（“ xxx.xxx.xxx.xxx”）方法之前，我们可以使用它来配置IP白名单，现在它已经不存在了。

如何为新的Spring Security Webflux指定IP白名单？

Answer 1

花了我一段时间才能弄清楚，但最终我找到了一种可行的方法。请检查https://github.com/ozkanpakdil/spring-examples/tree/master/webflux-ip-whitelist并告诉我是否有帮助。

您可以像这样定义WebSecurityConfig

import org.springframework.context.annotation.Bean;
import org.springframework.security.authorization.AuthorizationDecision;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.server.SecurityWebFilterChain;
import org.springframework.security.web.server.authorization.AuthorizationContext;
import reactor.core.publisher.Mono;

import java.util.ArrayList;

@EnableWebFluxSecurity
public class WebSecurityConfig {

    ArrayList<String> whiteListIp = new ArrayList();

    public WebSecurityConfig() {
        whiteListIp.add("0:0:0:0:0:0:0:1");
        whiteListIp.add("192.168.1.1");
        whiteListIp.add("127.0.0.1");
    }

    @Bean
    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        http
                .authorizeExchange()
                .anyExchange()
                .access(this::whiteListIp)
                .and()
                .httpBasic();

        return http.build();
    }

    private Mono<AuthorizationDecision> whiteListIp(Mono<Authentication> authentication, AuthorizationContext context) {
        String ip = context.getExchange().getRequest().getRemoteAddress().getAddress().toString().replace("/", "");
        return authentication.map((a) -> new AuthorizationDecision(a.isAuthenticated()))
                .defaultIfEmpty(new AuthorizationDecision(
                        (whiteListIp.contains(ip)) ? true : false
                ));
    }

}

并列出您的IP白色。

Spring Security WebFlux IP白名单

1 个答案: