Question

我正在为应用程序中的身份验证实现JWT和Spring Security。

我有3个角色：管理员，主持人和用户。

例如，使用用户角色登录后，我得到了主页，但是一旦我点击进入用户空间在按钮上，我得到了：

2020-09-04 09：01：22.819错误10148 --- [nio-8080-exec-5] c.b.s.security.jwt.AuthEntryPointJwt：未经授权的错误：完整要访问此资源，必须进行身份验证

文件 webSecurityConfig.java 是：

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(
        // securedEnabled = true,
        // jsr250Enabled = true,
        prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    UserDetailsServiceImpl userDetailsService;

    @Autowired
    private AuthEntryPointJwt unauthorizedHandler;

    @Bean
    public AuthTokenFilter authenticationJwtTokenFilter() {
        return new AuthTokenFilter();
    }

    @Override
    public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
        authenticationManagerBuilder.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors().and().csrf().disable()
            .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
            .authorizeRequests().antMatchers("/api/auth/**").permitAll()
            .antMatchers("/api/test/**").permitAll()
            .anyRequest().authenticated();

        http.addFilterBefore(authenticationJwtTokenFilter(), UsernamePasswordAuthenticationFilter.class);
    }
}

AuthEntryPointJwt 类为：

@Component 公共类AuthEntryPointJwt实现AuthenticationEntryPoint {

  private static final Logger logger = LoggerFactory.getLogger(AuthEntryPointJwt.class);

  @Override
  public void commence(HttpServletRequest request, HttpServletResponse response,
          AuthenticationException authException) throws IOException, ServletException {
      logger.error("Unauthorized error: {}", authException.getMessage());
      response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Error: Unauthorized");
  }

}

AuthTokenFilter 类为：

公共类AuthTokenFilter扩展了OncePerRequestFilter { @Autowired 私人JwtUtils jwtUtils;

  @Autowired
  private UserDetailsServiceImpl userDetailsService;

  private static final Logger logger = LoggerFactory.getLogger(AuthTokenFilter.class);

  @Override
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
          throws ServletException, IOException {
      try {
          String jwt = parseJwt(request);
          if (jwt != null && jwtUtils.validateJwtToken(jwt)) {
              String username = jwtUtils.getUserNameFromJwtToken(jwt);

              UserDetails userDetails = userDetailsService.loadUserByUsername(username);
              UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(
                      userDetails, null, userDetails.getAuthorities());
              authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));

              SecurityContextHolder.getContext().setAuthentication(authentication);
          }
      } catch (Exception e) {
          logger.error("Cannot set user authentication: {}", e);
      }

      filterChain.doFilter(request, response);
  }

  private String parseJwt(HttpServletRequest request) {
      String headerAuth = request.getHeader("Authorization");

      if (StringUtils.hasText(headerAuth) && headerAuth.startsWith("Bearer ")) {
          return headerAuth.substring(7, headerAuth.length());
      }

      return null;
  }

}

JwtUtils 类是：

@Component 公共类JwtUtils { 私有静态最终Logger logger = LoggerFactory.getLogger（JwtUtils.class）;

  @Value("${bezkoder.app.jwtSecret}")
  private String jwtSecret;

  @Value("${bezkoder.app.jwtExpirationMs}")
  private int jwtExpirationMs;

  public String generateJwtToken(Authentication authentication) {

      UserDetailsImpl userPrincipal = (UserDetailsImpl) authentication.getPrincipal();

      return Jwts.builder()
              .setSubject((userPrincipal.getUsername()))
              .setIssuedAt(new Date())
              .setExpiration(new Date((new Date()).getTime() + jwtExpirationMs))
              .signWith(SignatureAlgorithm.HS512, jwtSecret)
              .compact();
  }

  public String getUserNameFromJwtToken(String token) {
      return Jwts.parser().setSigningKey(jwtSecret).parseClaimsJws(token).getBody().getSubject();
  }

  public boolean validateJwtToken(String authToken) {
      try {
          Jwts.parser().setSigningKey(jwtSecret).parseClaimsJws(authToken);
          return true;
      } catch (SignatureException e) {
          logger.error("Invalid JWT signature: {}", e.getMessage());
      } catch (MalformedJwtException e) {
          logger.error("Invalid JWT token: {}", e.getMessage());
      } catch (ExpiredJwtException e) {
          logger.error("JWT token is expired: {}", e.getMessage());
      } catch (UnsupportedJwtException e) {
          logger.error("JWT token is unsupported: {}", e.getMessage());
      } catch (IllegalArgumentException e) {
          logger.error("JWT claims string is empty: {}", e.getMessage());
      }

      return false;
  }

}

AuthController 类为：

@CrossOrigin（来源=“ *”，maxAge = 3600） @RestController @RequestMapping（“ / api / auth”）公共类AuthController { @Autowired AuthenticationManager authenticationManager;

      @Autowired
      UserRepository userRepository;

      @Autowired
      RoleRepository roleRepository;

      @Autowired
      PasswordEncoder encoder;

      @Autowired
      JwtUtils jwtUtils;

      @PostMapping("/signin")
      public ResponseEntity<?> authenticateUser(@Valid @RequestBody LoginRequest loginRequest) {

          System.out.println("---------------- auth 1 ");
          Authentication authentication = authenticationManager.authenticate(
                  new UsernamePasswordAuthenticationToken(loginRequest.getUsername(), loginRequest.getPassword()));

          SecurityContextHolder.getContext().setAuthentication(authentication);
          String jwt = jwtUtils.generateJwtToken(authentication);

          UserDetailsImpl userDetails = (UserDetailsImpl) authentication.getPrincipal();      
          List<String> roles = userDetails.getAuthorities().stream()
                  .map(item -> item.getAuthority())
                  .collect(Collectors.toList());

          return ResponseEntity.ok(new JwtResponse(jwt, 
                                                   userDetails.getId(), 
                                                   userDetails.getUsername(), 
                                                   userDetails.getEmail(), 
                                                   roles));
      }



      @GetMapping("/user")
      @PreAuthorize("hasRole('USER') or hasRole('MODERATOR') or hasRole('ADMIN')")
      public String userAccess()
      {
          System.out.println("---------------- test User ");
          return "User Content.";
      }
  }

我放入文件 application.properties ：

spring.datasource.url=...
spring.datasource.username=...
spring.datasource.password=...
spring.jpa.properties.hibernate.jdbc.lob.non_contextual_creation= true
spring.jpa.properties.hibernate.dialect=...
spring.jpa.hibernate.ddl-auto=update
bezkoder.app.jwtSecret= bezKoderSecretKey
bezkoder.app.jwtExpirationMs= 86400000

在浏览器控制台中，我得到了that exception。

能帮我解决这个问题吗？非常感谢。

Answer 1

您应该评论@PreAuthorize("hasRole('USER') or hasRole('MODERATOR') or hasRole('ADMIN')")。

告诉结果吗？

出现未经授权的错误：访问此资源需要完全认证

1 个答案: