Question

已经花了一天时间寻找可行的解决方案。我将Spring用于后端，将Angular用于前端。我使用JWT管理身份验证。并且我想在用户登录后将JWT令牌存储在响应cookie中。然后根据每个请求将其自动发送回去。当用户在春季成功登录时，我会在响应中添加一个JWT cookie

    @PostMapping("/getLogin")
    public ResponseEntity<LoginModel> getLogin(@RequestBody LoginFour loginFour, HttpServletRequest request,
                                               HttpServletResponse response) {
        final LoginModel loginModel = userInformationService.getLoged(loginFour,
                loginFour.getIpAdress(), loginFour.getTimeZone());

        Cookie jwtCookie = new Cookie("JWT_TOKEN", loginModel.getJwt());
        jwtCookie.setMaxAge(15 * 60 * 1000);
        jwtCookie.setHttpOnly(false);
        jwtCookie.setSecure(false);
        response.addCookie(jwtCookie);

        return new ResponseEntity<>(loginModel, HttpStatus.OK);
    }

在浏览器中，当我检查“网络”标签时，我可以在响应标题中看到cookie

然后，当我发送另一个请求时，cookie不会在请求标头中发回

使用angular存储的其他cookie会以请求结束，但不会返回第一个请求的响应标头中提供的jet

这是我的HTTP拦截器

@Injectable()
export class HttpInterceptorService implements HttpInterceptor {

    constructor(private router: Router) {
    }

    intercept(req: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>> {
        console.log(req.url);
        const reqClone = this.addHeader(req);

        return next.handle(reqClone).pipe(
            catchError((error: HttpErrorResponse) => {
                if (error.status >= 200 && error.status < 300) {
                    return this.handleTextResponse(error);
                } else if (error.status == 403) {
                    localStorage.clear();
                    this.router.navigate(['/auth/login']);
                }
                return this.handleError(error);
            })
        );
    }

    private addHeader(req: HttpRequest<any>) {
        return req.clone({
            setHeaders: {
                'Content-Type': 'application/json'
            },
            withCredentials: true
        });
    }

这是我的春季安全配置

@EnableWebSecurity
public class SecurityConfigurer extends WebSecurityConfigurerAdapter {

    public static final String[] AUTHORIZED_PATHS = new String[]{
            "/login/getLogin",
            "/angularBeanLogin/resetPasswrod",
            "/angularBeanSignup/setUser",
            "/angularBeanTest/getUserSettingAccess",
            "/angularBeanTest/getUserRole",
            "/login/getAllPermitForChart"
    };

    private final UserDetailsServiceImpl userDetailService;
    private final JWTRequestFilter jwtRequestFilter;

    public SecurityConfigurer(UserDetailsServiceImpl userDetailService, JWTRequestFilter jwtRequestFilter) {
        this.userDetailService = userDetailService;
        this.jwtRequestFilter = jwtRequestFilter;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailService)
                .passwordEncoder(new PasswordEncoderImpl());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors().disable()
                .csrf().disable()
                .authorizeRequests().antMatchers(AUTHORIZED_PATHS).permitAll()
                .anyRequest().authenticated()
                .and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and().addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
}

不了解set-cookie不与其他cookie发送到服务器的原因

使用角度5.0.5和弹簧靴2.0.2释放

Answer 1

我已经使用下面的代码在每个请求中添加了cookie ...

import { Observable } from 'rxjs/Observable';
import { HttpInterceptor, HttpRequest, HttpHandler, HttpEvent } from '@angular/common/http';
import { Injectable } from '@angular/core';

@Injectable()
export class AuthInterceptor implements HttpInterceptor {
  constructor() {}

  intercept(request: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>> {
    request = request.clone({
      withCredentials: true
  });
  return next.handle(request);
  }
}

并如下所示添加到app.module.ts的提供程序数组。

import { AuthInterceptor } from './services/auth.interceptor';
import { HTTP_INTERCEPTORS } from '@angular/common/http';
import { HttpClientModule } from '@angular/common/http';
imports: [
    BrowserModule,HttpClientModule,FormsModule
  ],

providers: [
    {
    provide: HTTP_INTERCEPTORS,
    useClass: AuthInterceptor,
    multi: true,
    }
]

set-cookie不与http请求头一起发送回

1 个答案: