Question

Grails 1.3.7 + spring-security-core插件

有没有办法从authFail闭包中检索登录表单中输入的密码？我可以通过

获取用户名

session[UsernamePasswordAuthenticationFilter.SPRING_SECURITY_LAST_USERNAME_KEY]

但似乎没有办法获取密码。

session[UsernamePasswordAuthenticationFilter.SPRING_SECURITY_FORM_PASSWORD_KEY]

始终返回null。

Answer 1

首先：不要这样做。我敢打赌，无论你想做什么都会打破安全。将密码写入HTML表单的密码字段是其中一个不好的情况。在会话中存储密码也不是一个好主意。

回答您的问题：覆盖UsernamePasswordAuthenticationFilter并在弹簧配置中使用您的自定义类。

复制attemptAuthentication的内容并添加您需要的任何会话。在完成所需的操作后，从会话中删除密码是非常明智的

request.getSession().removeAttribute(SPRING_SECURITY_LAST_PASSWORD_KEY);

过滤类：

    public class MyFilter extends UsernamePasswordAuthenticationFilter{
    public static final String SPRING_SECURITY_LAST_PASSWORD_KEY = "SPRING_SECURITY_LAST_PASSWORD";


    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        if (postOnly && !request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
        }

        String username = obtainUsername(request);
        String password = obtainPassword(request);

        if (username == null) {
            username = "";
        }

        if (password == null) {
            password = "";
        }

        username = username.trim();

        UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);

        // Place the last username attempted into HttpSession for views
        HttpSession session = request.getSession(false);

        if (session != null || getAllowSessionCreation()) {
            request.getSession().setAttribute(SPRING_SECURITY_LAST_USERNAME_KEY, TextEscapeUtils.escapeEntities(username));
            request.getSession().setAttribute(SPRING_SECURITY_LAST_PASSWORD_KEY, TextEscapeUtils.escapeEntities(password));
        }

        // Allow subclasses to set the "details" property
        setDetails(request, authRequest);

        return this.getAuthenticationManager().authenticate(authRequest);
    }
}

在authFail闭包中检索尝试的密码

1 个答案: