GraphQL Spring AccessDeniedException 处理

Question

我正在为我的解析器类使用注释“@PreAuthorize”，因此我得到了 AccessDeniedException。这就是我想要的，但它被扔到服务器上的我的日志控制台。 我尝试了很多方法来摆脱这个错误并以某种方式处理它，只是为了打印一行，例如“未经授权的尝试”，而不是整个堆栈跟踪。你知道我应该在哪里处理它吗？

2020-05-16 12:21:27.026  WARN 12308 --- [0.1-1100-exec-1] g.e.SimpleDataFetcherExceptionHandler    : Exception while fetching data (/somePath) : Access is denied

org.springframework.security.access.AccessDeniedException: Access is denied
    at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) ~[spring-security-core-5.1.5.RELEASE.jar:5.1.5.RELEASE]
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233) ~[spring-security-core-5.1.5.RELEASE.jar:5.1.5.RELEASE]
    at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:65) ~[spring-security-core-5.1.5.RELEASE.jar:5.1.5.RELEASE]
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) ~[spring-aop-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:688) ~[spring-aop-5.1.6.RELEASE.jar:5.1.6.RELEASE]```

Answer 1

您可以提供自己的 AsyncExecutionStrategy 扩展，然后使用自己的 DataFetchingExceptionHandler 构造它，如下所示：

@Component
public class QueryExecutionStrategy extends AsyncExecutionStrategy {
    public QueryExecutionStrategy() {
        super(new GraphQLExceptionHandler());
    }

    @Override
    public CompletableFuture<ExecutionResult> execute(ExecutionContext executionContext,
                                                      ExecutionStrategyParameters parameters)
            throws NonNullableFieldWasNullException {
        return super.execute(executionContext, parameters);
    }
}

虽然 ExceptionHandler 可能看起来像这样：

public class GraphQLExceptionHandler implements DataFetcherExceptionHandler {
    private final Logger log = LoggerFactory.getLogger(GraphQLExceptionHandler.class);

    @Override
    public DataFetcherExceptionHandlerResult onException(DataFetcherExceptionHandlerParameters handlerParameters) {
        Throwable exception = handlerParameters.getException();
        SourceLocation sourceLocation = handlerParameters.getSourceLocation();
        ExecutionPath path = handlerParameters.getPath();
        if (exception instanceof AccessDeniedException) {
            log.warn("unauthorized to access " +
                        path);
        }
        ExceptionWhileDataFetching error = new ExceptionWhileDataFetching(path, exception, sourceLocation);
        log.warn(error.getMessage(), exception);
        return DataFetcherExceptionHandlerResult.newResult().error(error).build();
    }
}

您还可以通过返回 DataFetcherExceptionHandlerResult 来完全禁用报告给客户端的任何错误，而不在 if 语句中附加任何错误。