基于令牌的身份验证SecurityContextHolder有时不为空

我有基于令牌的授权，我面临的事情是，认证后我获得令牌，然后我尝试手动发送调用服务器没有令牌，我刷新它快速，有时它允许我得到的数据作为授权莫名其妙适当的数据是SecurityContextHolder，不知道它是如何出现在那里，当令牌不会被发送到服务器，是的，我使用STATELESS会议基于令牌的身份验证SecurityContextHolder有时不为空

这里是我的配置：

public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 

    @Autowired 
    private UserDetailsService userDetailsService; 

    @Autowired 
    private AuthenticationEntryPoint authenticationEntryPoint; 

    @Autowired 
    private AccessDeniedHandler accessDeniedHandler; 

    @Autowired 
    public void configureAuthentication(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception { 
     authenticationManagerBuilder 
       .userDetailsService(this.userDetailsService) 
       .passwordEncoder(passwordEncoder()); 
    } 

    @Bean 
    public PasswordEncoder passwordEncoder() { 
     return new BCryptPasswordEncoder(); 
    } 

    @Bean 
    @Override 
    public AuthenticationManager authenticationManagerBean() throws Exception{ 
     return super.authenticationManagerBean(); 
    } 

    @Bean 
    public AuthenticationTokenFilter authenticationTokenFilterBean() throws Exception{ 
     AuthenticationTokenFilter authenticationTokenFilter = new AuthenticationTokenFilter(); 
     authenticationTokenFilter.setAuthenticationManager(authenticationManagerBean()); 
     return authenticationTokenFilter; 
    } 

    @Override 
    protected void configure(HttpSecurity httpSecurity) throws Exception { 
     httpSecurity 
       .csrf() 
       .disable() 
       .httpBasic().disable() 
       .addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class) 
       .sessionManagement() 
        .sessionCreationPolicy(SessionCreationPolicy.STATELESS) 
       .and() 
       .exceptionHandling() 
        .authenticationEntryPoint(authenticationEntryPoint) 
        .accessDeniedHandler(accessDeniedHandler) 
       .and() 
       .authorizeRequests() 
        .antMatchers(HttpMethod.OPTIONS, "/**").permitAll() 
        .antMatchers("/**").permitAll() 
        .antMatchers("/auth/**").permitAll() 
       .anyRequest().authenticated(); 
    } 
}

AuthenticationTokenFilter

public class AuthenticationTokenFilter extends UsernamePasswordAuthenticationFilter { 
    @Autowired 
    private TokenUtils tokenUtils; 

    @Autowired 
    private UserDetailsService userDetailsService; 

    @Override 
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) 
      throws IOException, ServletException { 

     tokenUtils = WebApplicationContextUtils 
       .getRequiredWebApplicationContext(this.getServletContext()) 
       .getBean(TokenUtils.class); 
     userDetailsService = WebApplicationContextUtils 
       .getRequiredWebApplicationContext(this.getServletContext()) 
       .getBean(UserDetailsService.class); 


     HttpServletResponse resp = (HttpServletResponse) response; 
     resp.setHeader("Access-Control-Allow-Origin", "*"); 
     resp.setHeader("Access-Control-Allow-Methods", "POST, GET, PUT, OPTIONS, DELETE, PATCH"); 
     resp.setHeader("Access-Control-Max-Age", "3600"); 
     resp.setHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, " + Constants.tokenHeader); 


     HttpServletRequest httpRequest = (HttpServletRequest) request; 
     String authToken = httpRequest.getHeader(Constants.tokenHeader); 

     Authentication auth = SecurityContextHolder.getContext().getAuthentication(); 
     if(authToken != null){ 
      String username = this.tokenUtils.getUsernameFromToken(authToken); 
      if (username != null && auth == null) { 
       UserDetails userDetails = this.userDetailsService.loadUserByUsername(username); 
       if (this.tokenUtils.validateToken(authToken, userDetails)) { 
        UsernamePasswordAuthenticationToken authentication = 
          new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities()); 
        authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(httpRequest)); 
        SecurityContextHolder.getContext().setAuthentication(authentication); 
       } 
      } 
     } 

     chain.doFilter(request, response); 
    } 
}

来源

2016-11-20 Misho Janiashvili

基于令牌的身份验证SecurityContextHolder有时不为空

回答

相关问题