得到错误的异常响应 (403)

Question

我有一个登录控制器，如果凭据错误 - 应该返回 BadCredentialsException 和 json 中的消息，但我得到的是 403 响应。

我的代码：

控制器 -

@PostMapping("/login")
public ResponseEntity<AuthenticationResponse> login(@Valid @RequestBody AuthenticationRequest data) {
    try {

        System.out.println(data);
        String email = data.getEmail();
        Authentication authentication = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(email, data.getPassword()));
        SecurityContextHolder.getContext().setAuthentication(authentication);
        String token = jwtTokenProvider.createToken(email);
        AuthenticationResponse response = new AuthenticationResponse(email, token);
        return ok(response);
    } catch (AuthenticationException ex) {
        throw new BadCredentialsException(messageSource.getMessage("authController.invalidCredentials", null, null));
    }
}

安全配置 -

http
                .httpBasic().disable()
                .csrf().disable()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .authorizeRequests()
                .antMatchers("/**")
                .permitAll()
                .and()
                .apply(new JwtConfigurer(jwtTokenProvider))
                .and()
                .cors().and().csrf()
                .disable();

令牌创建 -

    public String createToken(String username) {
        Claims claims = Jwts.claims().setSubject(username);

        Date now = new Date();
        Date validity = new Date(now.getTime() + validityInMilliseconds);

        return Jwts.builder()
                .setClaims(claims)
                .setIssuedAt(now)
                .setExpiration(validity)
                .signWith(HS256, secretKey)
                .compact();
    }

我得到的当前 Json 是 -

    {
        "timestamp": "2021-03-14T23:34:49.038+00:00",
        "status": 403,
        "error": "Forbidden",
        "message": "",
        "path": "/auth/login/"
    }

目标是在 json 中获取消息，即凭据有问题。非常感谢您的帮助:)

Answer 1

因为默认的Authentication入口点是org.springframework.security.web.authentication.Http403ForbiddenEntryPoint

您可以像这样覆盖默认身份验证入口点：

public static class Message {
    private String message;

    public Message(String message) {
        this.message = message;
    }

    public String getMessage() {
        return message;
    }
}

private static final ObjectMapper objectMapper = new ObjectMapper();

@Override
protected void configure(HttpSecurity http) throws Exception {
    // set your authentication entry point
    http.exceptionHandling().authenticationEntryPoint((request, response, authException) -> {
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); // you could replace your custom HTTP status
        response.setContentType("application/json");
        response.setCharacterEncoding("UTF-8");

        PrintWriter out = response.getWriter();
        out.print(objectMapper.writeValueAsString(new Message(authException.getMessage())));
        out.flush();
    });

    http
            .httpBasic().disable()
            .csrf().disable()

            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .authorizeRequests()
            .antMatchers("/**")
            .permitAll()
            .and()
            .apply(new JwtConfigurer(jwtTokenProvider))
            .and()
            .cors().and().csrf()
            .disable();
}

您还可以检查异常类型：

    if (authException instanceof BadCredentialsException) {
        // Do somthing
    }

Answer 2

试试这个：

安全配置

            http
            .httpBasic().disable()
            .csrf().disable()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .authorizeRequests()
            .antMatchers("/auth/login")
            .permitAll()
            .and()
            .apply(new JwtConfigurer(jwtTokenProvider))
            .and()
            .cors().and().csrf()
            .disable()
            .anyRequest().authenticated()
            .and().apply(securityConfigurerAdapter());;