将 x-auth-token 发送到 Spring Boot 时，Angular 应用程序出现 401 错误，我做错了什么？

Question

我有一个带有 Spring Boot 后端项目的 Angular 2 前端。初始登录页面接受用户名和密码并将其发送到后端并得到"xAuthToken"作为响应，我存储在localstorage中，当我尝试刷新页面时，角度得到401错误。我怎样才能让spring security接受@ 987654323@?

角度 -

@Injectable()
export class LoginService {

  constructor(private http:Http) { }

  sendCredentials(username:String,password:String){
      let url="http://localhost:8181/token";
      let encodedCred=btoa(username+":"+password);
      let basicHeader="Basic "+encodedCred;
      let header=new Headers({
        "Content-Type":  "application/json",
        "Authorization": basicHeader
      });
   return this.http.get(url,{headers:header});
  }

  checkSession(){
    let url="http://localhost:8181/checkSession";
    console.log("pp=="+localStorage.getItem('xAuthToken'));
    let header=new Headers({
      'x-auth-token':  localStorage.getItem('xAuthToken')
    });
 return this.http.get(url,{headers:header});
  }


}



export class LoginComponent implements OnInit {

 private credentials={"username":"","password":""};
 private loggedIn:boolean=false;

  constructor(private loginService:LoginService) { }

  onSubmit(){
    this.loginService.sendCredentials(this.credentials.username,this.credentials.password).
    subscribe(res => {
            console.log(res);
            console.log(res.json());
            localStorage.setItem("xAuthToken", res.json().token);
            this.loggedIn=true;
            //location.reload();
          },
          error => {
            console.log(error);
          }
      );
  
  
  }
  
  ngOnInit() {
    this.loginService.checkSession().subscribe(
      res=>{
        this.loggedIn=true;
      },
      error=>{
        console.log(error);
      }
    );
  }

}

春天-

@CrossOrigin(origins = "http://localhost:4200")
@RestController
public class LoginController {

    @Autowired
    private UserService userService;
    
    @RequestMapping(value = "/token")
    public Map<String, String> token(HttpSession session, HttpServletRequest request) {
        System.out.println(request.getRemoteHost());
        
        String remoteHost = request.getRemoteHost();
        int portNumber = request.getRemotePort();
        
        System.out.println(remoteHost+":"+portNumber);
        System.out.println(request.getRemoteAddr());
        
        return Collections.singletonMap("token", session.getId());
    }
    @CrossOrigin(origins = "http://localhost:4200",allowedHeaders = "x-auth-token")
    @RequestMapping(value = "/checkSession")
    public ResponseEntity checkSession() {
        System.out.print("insiden checksession");
        return new ResponseEntity("Session Active", HttpStatus.OK);
    } 
    
}




@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter{
    
    @Autowired
    Environment env; 

    @Autowired
    UserSecurityService useSecurityService;
    
    private BCryptPasswordEncoder passwordEncoder() {
        return SecurityUtility.passwordEncoder();
    }
    
    private static final String[] PUBLIC_MATHCES= {
            "/css/**",
            "/js/**",
            "/image/**",
            "/book/**",
            "/user/**"
    };

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(useSecurityService).passwordEncoder(passwordEncoder());
        
        
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers(PUBLIC_MATHCES).permitAll()
            .anyRequest().authenticated();
        http.csrf().disable()
            .cors()
            .and()
            .httpBasic();
        
    }
    
    
    
    
}

Answer 1

身份验证流程似乎没有完全通过。您需要通过拦截 HTTP 请求并注入用户来编写对用户的身份验证，然后只有 spring 提供对经过身份验证的路径的访问。

@Autowired
private MyBasicAuthenticationEntryPoint authenticationEntryPoint;

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth.inMemoryAuthentication()
      .withUser("user1").password(passwordEncoder().encode("user1Pass"))
      .authorities("ROLE_USER");
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    // ... standard code here ...

    http.addFilterAfter(new CustomFilter(),
      BasicAuthenticationFilter.class);
}

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

}

请参考Baeldung post for spring security auth