Angular 6，HttpClient，带有后端 Spring Boot！我的标头没有到达后端答案

【问题标题】：Angular 6, HtttpClient, with BackEnd Spring Boot! My Header don't reach to the backendAngular 6，HttpClient，带有后端 Spring Boot！我的标头没有到达后端
【发布时间】：2018-09-17 00:26:03
【问题描述】：

我正在尝试使用headers 发出get 请求，因为在我的后端检查了我在登录时生成的令牌。但由于某种原因，我无法获得授权标头，我在控制台中打印了所有标头，但我没有看到我的标头

这是我在 Angular 6 中的服务代码

import { Injectable } from '@angular/core';
import { HttpHeaders, HttpClient, HttpErrorResponse } from '@angular/common/http';
import { catchError, map, tap } from 'rxjs/operators';
import { Usuario } from '../clases/usuario';
import { throwError } from 'rxjs';

constructor(private http: HttpClient) {}
getAllUsers(token: string) {
  const httpOptions = {
    headers: new HttpHeaders({
      'Content-Type': 'application/json',
      'Authorization': 'my-auth-token'
    })
  };
  httpOptions.headers = httpOptions.headers.set('Authorization', token);
  return this.http.request('GET', this.usuarioUrl, httpOptions)
    .pipe(
      map((resp: Usuario[]) => {
        this.usuarios = resp;
        return this.usuarios;
      }),
      catchError(this.handleError)
    );
}

这是我后端的过滤器

public void doFilter(ServletRequest request, ServletResponse response,
    FilterChain chain) throws IOException, ServletException {
    if (!(((HttpServletRequest) request).getRequestURI().endsWith("/auth/login") ||
        ((HttpServletRequest) request).getRequestURI().endsWith("/auth/signup"))) {

      HttpServletRequest httpRequest = (HttpServletRequest) request;
      HttpServletResponse httpResponse = (HttpServletResponse) response;
      String authHeader = httpRequest.getHeader(AuthUtils.AUTH_HEADER_KEY);
      Enumeration < String > test = httpRequest.getHeaderNames();
      while (test.hasMoreElements()) {
        String headerName = test.nextElement();
        logger.info("Header " + headerName);
        logger.info("getHeader " + httpRequest.getHeader(headerName));
      }
      logger.info("AuthHeader " + authHeader);
      if (StringUtils.isEmpty(authHeader) || authHeader.split(" ").length != 1) {
        logger.error("No token");
        httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED, AUTH_ERROR_MSG);
      } else {
        JWTClaimsSet claimSet = null;
        try {
          claimSet = (JWTClaimsSet) AuthUtils.decodeToken(authHeader);
        } catch (ParseException e) {
          httpResponse.sendError(HttpServletResponse.SC_BAD_REQUEST, JWT_ERROR_MSG);
          return;
        } catch (JOSEException e) {
          httpResponse.sendError(HttpServletResponse.SC_BAD_REQUEST, JWT_INVALID_MSG);
          return;
        }
        // ensure that the token is not expired
        if (new DateTime(claimSet.getExpirationTime()).isBefore(DateTime.now())) {
          httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED, EXPIRE_ERROR_MSG);
        } else {
          chain.doFilter(request, response);
        }
      }
    } else {
      chain.doFilter(request, response);
    }

我的控制台就是这个

2018-09-16 19:57:00.877  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : Header host
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : getHeader localhost:8091
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : Header connection
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : getHeader keep-alive
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : Header access-control-request-method
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : getHeader POST
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : Header origin
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : getHeader http://localhost:4200
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : Header user-agent
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : getHeader Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : Header access-control-request-headers
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : getHeader authorization,content-type
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : Header accept
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : getHeader */*
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : Header accept-encoding
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : getHeader gzip, deflate, br
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : Header accept-language
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : getHeader es-ES,es;q=0.9
2018-09-16 19:57:00.878  INFO 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : AuthHeader null
2018-09-16 19:57:00.878 ERROR 8880 --- [nio-8091-exec-7] py.edu.una.rest.filters.AuthFilter       : No token

如何在我的后端获取授权标头进行检查？请帮忙！为什么它没有到达我的后端？

【问题讨论】：

您能否显示 AuthUtils.AUTH_HEADER_KEY 的值，您是否在客户端调试令牌已通过。
public static final String AUTH_HEADER_KEY = "Authorization";
是的，我打印 console.log(token) 并且令牌在那里
您的过滤器代码很好，并且可以正常工作，因为我刚刚检查过其他客户端，您可以将 AUTH_HEADER_KEY 更改为“授权”
您的日志也未显示授权，因此客户端未在标头中发送授权似乎有些问题，因为它显示标头授权日志 2018-09-17 08:24:11.497 INFO 14664 --- [io-8080-exec-10] c.k.d.config.JWTAuthorizationFilter : getHeader sjdkdjksdjjfldfkldfkdlfkdlkfldkfdk

标签： java angular spring-boot http-headers

【解决方案1】：

请在过滤器中使用以下代码以允许 OPTIONS 方法请求，我所做的更改主要在这里：

if(httpRequest.getMethod().equalsIgnoreCase(HttpMethod.OPTIONS.name())) {
            chain.doFilter(request, response);
        }

要了解为什么需要 OPTIONS，请阅读此线程的答案：OPTIONS requests 和 CORS preflight OPTIONS request，这将暂时解决您的问题。

AuthFilter中你的过滤方法代码

public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        if(httpRequest.getMethod().equalsIgnoreCase(HttpMethod.OPTIONS.name())) {
            chain.doFilter(request, response);
        } else {
            if (!(((HttpServletRequest)request).getRequestURI().endsWith("/auth/login")
                    || ((HttpServletRequest)request).getRequestURI().endsWith("/auth/signup"))){

                String authHeader = httpRequest.getHeader(AuthUtils.AUTH_HEADER_KEY);
                Enumeration<String> prueba = httpRequest.getHeaderNames();
                while ( prueba.hasMoreElements()) {
                    String headerName = prueba.nextElement();
                    logger.info("Header "+ headerName);
                    logger.info("getHeader "+httpRequest.getHeader(headerName));
                }
                logger.info("AuthHeader "+ authHeader);
                if (StringUtils.isEmpty(authHeader) || authHeader.split(" ").length != 1) {
                    logger.error("No tiene token");
                    httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED, AUTH_ERROR_MSG);
                } else {
                    JWTClaimsSet claimSet = null;
                    try {
                        claimSet = (JWTClaimsSet) AuthUtils.decodeToken(authHeader);
                    } catch (ParseException e) {
                        httpResponse.sendError(HttpServletResponse.SC_BAD_REQUEST, JWT_ERROR_MSG);
                        return;
                    } catch (JOSEException e) {
                        httpResponse.sendError(HttpServletResponse.SC_BAD_REQUEST, JWT_INVALID_MSG);
                        return;
                    }
                    // ensure that the token is not expired
                    if (new DateTime(claimSet.getExpirationTime()).isBefore(DateTime.now())) {
                        httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED, EXPIRE_ERROR_MSG);
                    } else {
                        chain.doFilter(request, response);
                    }
                }
            }else{
                chain.doFilter(request, response);
            }
        }

    }

推荐：

我建议使用 Spring 安全性来管理您的 Auth Filter 和 OPTIONS 请求，以覆盖 http，如下所示：

@Override
protected void configure(HttpSecurity http) throws Exception
{
     http
    .csrf().disable()
    .authorizeRequests()
      .antMatchers(HttpMethod.OPTIONS,"/**").permitAll()//allow CORS option calls
      .antMatchers("/resources/**").permitAll()
      .anyRequest().authenticated()
    .and()
    .//add filter here

}

【讨论】：

感谢@kj007 这解决了你救我一命的问题！