将angularJS与Spring安全性结合使用并发送JSON请求时出现问题

Question

I am using spring security for authentication and authorization. For sending a request I am using Angular JS http.post request. The sample 'home.jsp' code is:

<form role="form">
<div class="form-group">
    <label for="username">Username:</label> <input type="text"
        class="form-control" id="username" name="username" ng-model="userinfo.username"/>
</div>
<div class="form-group">
    <label for="password">Password:</label> <input type="password"
        class="form-control" id="password" name="password" ng-model="userinfo.password"/>
</div>
<button type="submit" class="btn btn-primary" ng-click='login()'>Submit</button>

My UserInfo class is bind with model:

UserInfo.java
private String username;
private String password;
// Generated getters & setters

The sample 'home.js' is: I am doing something below ie I am converting the userInfo in JSON string.

$scope.login = function() {
$http.post('login', angular.toJson(userInfo)
      .success(function(data) {
       // Some response handling
     })};

The login reach the server and all built in spring security filters executed but when I debug 'UserandPasswordAuthenticationFilter' it shows me request.getParameter('username') and password is NULL. I am sending the JSON string which is of type UserInfo class. Can any one please guide me that would I add a new filter which 'parse' the JSON string and convert into UserInfo object before executing the 'UserandPasswordAuthenticationFilter' and set the username and password in servlet request parameter and similarly another filter which convert the object into JSON while sending the response back?

Please help and propose the best solution.

Thanks.

Answer 1

You're faced with two options. Either just post what Spring is expecting from you (ie simple j_username and j_password parameters) or configure a different set of filters and auth providers that will construct and expect a different token (not UsernamePasswordToken that is being created by UsernamePasswordAuthenticationFilter now). Your auth provider should expect the new token type and check for it in its supports(Class<?> clazz) method.