Spring JWTAuthenticationFilter 返回 403 但无论如何都会执行请求

Question

我一直在玩 Spring Security，我一直在尝试让 JWTAuthorizationFilter 为我的请求工作，但是如果用户未按预期登录，过滤器确实返回 403 禁止请求，请求是在不应该的时候仍然执行。

例如，如果我有一个创建新项目的方法，该项目已创建，服务器返回 403 但预期的行为是 403 并且没有创建项目。

我一直使用https://github.com/devdojobr/springboot-essentials/blob/master/src/main/java/br/com/devdojo/config/JWTAuthenticationFilter.java 作为参考，但我仍然没有运气。

我最好的猜测是过滤器链有问题，但我不太确定这可能是什么问题

我在下面附加了我的 Filter 类和我的 SecurityConfig：

任何帮助或指示都会很棒。

JWTAuthorizationFilter.java

package uk.ac.qub.eeecs.csc3045.year1819.cs1.server.security;

import io.jsonwebtoken.Jwts;
import java.io.IOException;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
import org.springframework.stereotype.Component;
import uk.ac.qub.eeecs.csc3045.year1819.cs1.server.service.SpringUserDetailService;

@Component
public class JWTAuthorizationFilter extends BasicAuthenticationFilter {

  @Value("${security.jwt.token.secret-key:secret-key}")
  private String secretKey = "secret-key";

  @Value("${security.jwt.token.expire-length:3600000}")
  private long validityInMilliseconds = 3600000;

  private final SpringUserDetailService springUserDetailService;

  public JWTAuthorizationFilter(
      AuthenticationManager authenticationManager, SpringUserDetailService springUserDetailService) {
    super(authenticationManager);
    this.springUserDetailService = springUserDetailService;
  }

  @Override
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
      FilterChain chain) throws IOException, ServletException {
    super.doFilterInternal(request, response, chain);

    String header = request.getHeader("Authorization");

    if (header == null || !header.startsWith("Bearer "))  {
      chain.doFilter(request, response);
      return;
    }

    UsernamePasswordAuthenticationToken authenticationToken = getAuthenticationToken(request);

    SecurityContextHolder.getContext().setAuthentication(authenticationToken);
    chain.doFilter(request,response);
  }

  private UsernamePasswordAuthenticationToken getAuthenticationToken(HttpServletRequest request)  {
    String token = request.getHeader("Authorization");
    if (token != null)  {
      //parse token
      String user = Jwts.parser()
          .setSigningKey(secretKey)
          .parseClaimsJws(token.replace("Bearer ", ""))
          .getBody()
          .getSubject();
      UserDetails userDetails = springUserDetailService.loadUserByUsername(user);

      if (user != null) {
        return new UsernamePasswordAuthenticationToken(user, null, userDetails.getAuthorities());
      }
        return null;
    }
    return null;
  }
}

SecurityConfig.java

package uk.ac.qub.eeecs.csc3045.year1819.cs1.server.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import uk.ac.qub.eeecs.csc3045.year1819.cs1.server.security.JWTAuthorizationFilter;
import uk.ac.qub.eeecs.csc3045.year1819.cs1.server.service.SpringUserDetailService;

/**
 * Configuration settings for management of JWT.
 *
 * JWT Implementation adapted from @see <a href="https://jwt.io/</a>
 */
@Configuration
@EnableConfigurationProperties
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

  @Autowired
  private SpringUserDetailService springUserDetailService;

  @Override
  @Bean
  public AuthenticationManager authenticationManagerBean() throws Exception {
    return super.authenticationManagerBean();
  }

  /**
   * Configure settings for JWT.
   *
   * @param http Spring security builder.
   * @throws Exception
   */
  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.cors().and().csrf().disable().authorizeRequests()
        .antMatchers("/v2/users/login").permitAll()
        .anyRequest().authenticated()
        .and()
        .addFilter(new JWTAuthorizationFilter(authenticationManager(), springUserDetailService));
  }
}

Answer 1

当您没有找到任何UserDetails 时，您不应继续执行过滤器链。 尝试抛出AuthenticationException 并通过AuthenticationEntryPoint 开始。

您可以在 Spring Security JWT : JwtAuthorizationFilter 上检查确切的行为