SPRING @RestController：将 Cookie 从每个方法传递给服务

Question

我有一个@RestController，其中每个方法都需要将（WebSSO）cookie 传递给服务。该服务反过来使用 cookie 进行身份验证。我在控制器中自动装配服务 bean。该服务有一个设置器setCredentials(String webSSOCookie)。一种简单的方法是在每个方法中调用此设置器。我想做得更好；例如使用HandlerInterceptor。但是，HandlerInterceptor 无权访问控制器（因此也无法访问其成员） - 对吗？

在jersey 中，我可以使用filter。我如何在 SPRING 中实现它？

@RestController
@RequestMapping("/documents")
public class ECMRestController {

    @Autowired
    public ECMService ecmService;   

    @RequestMapping(value="/{documentId}", method=RequestMethod.DELETE)
    public void deleteDocument(@RequestParam("documentId") String documentId) throws IllegalArgumentException, HttpClientErrorException {
         // I could get and pass the cookie to ecmService in every method.
         // ecmService.setCredentials(webSSOCookieObtainedfromRequest);
         // However I don't want to do it that way.
         ecmService.deleteDocument(documentId);
    }

   // Other REST Methods that need to pass the cookie in the same way.

}

Answer 1

您可以请求 SecurityContextHolder 查询您在过滤器中自定义的当前身份验证。

MyCustomAuth auth = (MyCustomAuth) SecurityContextHolder.getContext().getAuthentication();
auth.getCookie();

或者您可以在可以从任何地方检索的上下文中使用 ThreadLocal：

public class CookieContext {
    private static final ThreadLocal<Cookie> COOKIE = new ThreadLocal<>();
    private static final CookieContext INSTANCE = new CookieContext();

    public void setCookie(Cookie value) {
        COOKIE.set(value);
    }

    public Cookie getCookie() {
        return COOKIE.get();
    }

    public static CookieContext getContext() {
        return INSTANCE;
    }
}



public class CookieInterceptor extends HandlerInterceptorAdapter {

    public boolean preHandle(HttpServletRequest request, HttpServletResponse response,
                         Object handler) throws Exception {
        CookieContext context = CookieContext.getContext();
        context.setCookie(request.getCookies()[0]);
    }
}