spring boot 安全认证验证正文内容

Question

我想验证一个发布请求正文键值对，但我想在拦截器/过滤器的帮助下做同样的事情。我该怎么做？

Answer 1

您可以创建一个自定义请求过滤器来检查请求：

public class MyFilter implements OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) {
        var user = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
        // do stuff you need to do here
        
        filterChain.doFilter(request, response);
    }
}

然后在您的 WebSecurityConfiguration 类中像这样注册过滤器

public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.addFilterAfter(new MyFilter(), BasicAuthenticationFilter.class);
    }
}

Answer 2

您可以扩展 HandlerInterceptorAdapter 并通过覆盖 preHandle() 方法在请求之上执行您的自定义操作/过滤器。

伪代码在这里：

@Component
public class SimpleInterceptor extends HandlerInterceptorAdapter {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
        // Handle your request here. In your case, authentication check should go here.
        return true;
    }
}

将SimpleInterceptor 添加到注册表以拦截请求。

@Configuration
@EnableWebMvc
public class SimpleMvnConfigurer implements WebMvcConfigurer {

    @Autowired
    SimpleInterceptor simpleInterceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(simpleInterceptor);
    }
}

就是这样！
编辑1： 要从preHandle 方法发送响应，请遵循以下伪代码：

@Override                                                                                           
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
    // Handle your request here. AIn your case, authentication check should go here.                
    if (!isValidAuth()) {                                                                           
        // Populate the response here.                                                              
        try {                                                                                       
            response.setStatus(401);                                                                
            response.getWriter().write("Authentication failed.");                                   
        } catch (IOException e) {                                                                   
            e.printStackTrace();                                                                    
        }                                                                                           
        return false;                                                                               
    }                                                                                               
    return true;                                                                                    
}                                                                                                   ```

Answer 3

你可以用过滤器试试这个。

public class SimpleFilter implements Filter {

    private void throwUnauthorized(ServletResponse res) throws IOException {
        HttpServletResponse response = (HttpServletResponse) res;
        response.reset();
        response.setHeader("Content-Type", "application/json;charset=UTF-8");
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
    }

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {

        HttpServletRequest request = (HttpServletRequest) req;

        if (!isValidAuth(request)) {
            throwUnauthorized(res);
        }
        chain.doFilter(req, res);

    }

    private boolean isValidAuth(HttpServletRequest request) {
        // YOUR LOGIC GOES HERE.
        return false;
    }

    @Override
    public void destroy() {
    }

    @Override
    public void init(FilterConfig arg0) {
    }

}

使用 FilterRegistrationBean 注册过滤器

@Bean                                                                                      
public FilterRegistrationBean<SimpleFilter> simpleFilter() {                               
    FilterRegistrationBean<SimpleFilter> registrationBean = new FilterRegistrationBean<>();
    registrationBean.setFilter(new SimpleFilter());                                        
                                                                                           
    return registrationBean;                                                               
}                                                                                          

让我知道这是否有效。