附加请求标题后弹簧安全认证

Question

我们想添加标题到我们的请求后发布spring安全认证。

但是，标题不会被追加。 我们可以通过Zuul过滤器来完成，但不能使用弹簧安全过滤器。

public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { 
    httpServletRequestWrapper = new HttpServletRequestWrapper(request) { 
     @Override 
     public String getHeader(String name) { 
      if (name.equalsIgnoreCase(ENV - HEADER)) { 

       return active; 
      } else if (name.equalsIgnoreCase(USERID)) { 

       return (String) authentication.getPrincipal(); 
      } else { 
       return super.getHeader(name); 
      } 
     } 
    }; 

    filterChain.doFilter(httpServletRequestWrapper, servletResponse); 
} 

Answer 1

在您的安全配置文件中运行过滤器以在org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter之后添加标题以请求。

@Override 
protected void configure(HttpSecurity http) throws Exception { 
    http.exceptionHandling().and().anonymous().and().servletApi().and().headers().and().authorizeRequests() 

    // Your existing security configurations 

    // Assuming UsernamePasswordAuthenticationFilter is the filter 
    .addFilterAfter(new AddHeaderFilter(), UsernamePasswordAuthenticationFilter.class); 
} 

UsernamePasswordAuthenticationFilter是为spring安全认证运行的enbuild弹簧过滤器。

Answer 2

添加您的阳明海运或属性文件配置

zuul: 
    sensitiveHeaders: Cookie,Set-Cookie 
    add-proxy-headers: true 

然后zuul让头去其他终点。