Spring 记住我身份验证后 JSF/Primefaces Ajax 请求的 ViewExpiredException答案

【问题标题】：ViewExpiredException for JSF/Primefaces Ajax Request after Spring RememberMe AuthentificationSpring 记住我身份验证后 JSF/Primefaces Ajax 请求的 ViewExpiredException
【发布时间】：2013-12-15 03:51:35
【问题描述】：

我对 Primefaces 和客户端视图状态有疑问

<context-param>
    <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
    <param-value>client</param-value>
</context-param>

尝试恢复 AJAX 请求的视图时，我收到了 ViewExpiredException。这目前仅在通过 Spring RememberMe 执行身份验证时发生，并且仅适用于 AJAX 请求，而不适用于页面完全重新加载的情况。

一些分析：

系统尝试恢复视图

com.sun.faces.renderkit.ClientSideStateHelper.doGetState(String stateString)

然后调用

com.sun.faces.renderkit.ByteArrayGuard.decrypt(byte[] bytes)

这里方法

 Arrays.equals(macBytes, macBytesCalculated)

失败和错误

ERROR: MAC did not verify!

被触发，这会阻止视图被恢复。我猜这与AJAX请求的给定内容和ByteArrayGuard中的解密之间的不同加密逻辑有关。

我还测试了https://java.net/jira/browse/JAVASERVERFACES-2553 中提供的最新版本，但是它并没有改变行为。（与 JAVASERVERFACES-2553 相反，我的问题与线程安全无关......）

有什么想法吗？

感谢和亲切的问候，克里斯

堆栈跟踪：

ERROR: MAC did not verify!
Nov 29, 2013 2:58:15 AM com.sun.faces.context.AjaxExceptionHandlerImpl handlePartialResponseError
SEVERE: javax.faces.application.ViewExpiredException: viewId:/page.xhtml - Ansicht /pages.xhtml konnte nicht wiederhergestellt werden.
at com.sun.faces.lifecycle.RestoreViewPhase.execute(RestoreViewPhase.java:210)
at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:101)
at com.sun.faces.lifecycle.RestoreViewPhase.doPhase(RestoreViewPhase.java:121)
at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:198)
at javax.faces.webapp.FacesServlet.service(FacesServlet.java:646)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:118)
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:84)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:113)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:103)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:113)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:139)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:54)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:45)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilter(BasicAuthenticationFilter.java:150)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter.doFilter(DefaultLoginPageGeneratingFilter.java:91)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:183)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:183)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:105)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:343)
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:260)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1001)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:585)
at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:724)

【问题讨论】：

标签： ajax spring jsf primefaces

【解决方案1】：

使用下面的代码

使用 PROJECT_STAGE 代替 STATE_SAVING_METHOD 并将参数值用作 Development

【讨论】：

您好，感谢您的回答，您能否简要解释一下为什么 PROJECT_STAGE=Development 应该可以解决问题？我做了一些研究，看起来问题是由于系统在启动时生成了一个新的随机密钥。我使用 Mojarra，它无法像 myfaces 那样定义静态机密 (org.apache.myfaces.MAC_SECRET)。没错，我正在尝试修补 com.sun.faces.renderkit.ByteArrayGuard 以便始终使用相同的密钥。

【解决方案2】：

我的想法是正确的，可以通过修补com.sun.faces.renderkit.ByteArrayGuard中的setupKeyAndMac()方法解决问题，从而防止在服务器启动时生成新的随机密钥：

private void setupKeyAndMac() {

try {
    // caution, use exact this length!
    String secret = "1256325896545822129522";
    sk = new SecretKeySpec(new Base64().decode(secret.getBytes()), "AES");
    // KeyGenerator kg = KeyGenerator.getInstance(KEY_ALGORITHM);
    // kg.init(KEY_LENGTH); // 256 if you're using the Unlimited Policy Files
    // sk = kg.generateKey();

} catch (Exception e) {
    throw new FacesException(e);
}
}

请参阅http://svn.apache.org/repos/asf/myfaces/shared/trunk/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java 以获取可以在 web.xml 中配置静态 MAC 机密的实现参考。

【讨论】：