基于角色的安全性基于Jsonwebtoken，在Spring Boot中对不同的控制器使用不同的角色

Question

I am successfully able to authenticate users, acquire a jsonwebtoken, and access protected urls. I am persisting a claim to the token with a role of "user" or "admin". What I would ideally, like to be able to do, after verifying the user, is persist the role based on the user role/roles, and protect specific url's in my api, based on those. I have the following setup. How do I apply security to a specific url to differentiate based on role in the token?

Package com.vicentex.api;

// imports excluded for brevity

 @SpringBootApplication
 public class VicentexTradingApiApplication {

 @Bean
 public FilterRegistrationBean jwtFilter() {
    final FilterRegistrationBean registrationBean = new FilterRegistrationBean();
    registrationBean.setFilter(new JwtFilter());
    registrationBean.addUrlPatterns("/api/*");

    return registrationBean;
 }

 public static void main(String[] args) {
    SpringApplication.run(VicentexTradingApiApplication.class, args);
 }
}

/////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////

 @RestController
 public class UserController {

    @Autowired
    private UserService userService;

    @RequestMapping(value = "/api/users", method = RequestMethod.GET)
    List<User> getAllUsers(){
       return this.userService.getAllUsers();
    }

    @RequestMapping(value = "/api/users/{userName}",method = RequestMethod.GET)
    User getUser(@PathVariable String userName) {
       return this.userService.getUser(userName);
    }

    @RequestMapping(value = "/api/users", method = RequestMethod.POST)
    void addUser(@RequestBody User user) {
       this.userService.addUser(user);
    }

    @RequestMapping(value = "/api/users", method = RequestMethod.PUT)
    void updateUser(@RequestBody User user) {
       this.userService.updateUser(user);
    }


    @RequestMapping(value = "/api/users/{userName}", method = RequestMethod.DELETE)
    void deleteUser(@PathVariable String userName) {
       this.userService.deleteUser(userName);
    }

    @RequestMapping(value = "/register", method = RequestMethod.POST)
    public User registerUser(@RequestBody User user) {
       userService.addUser(user);
       return user;
    }


    @RequestMapping(value = "/login", method = RequestMethod.POST)
    public String login(@RequestBody User login) throws ServletException {

        System.out.println("Controller Secret: " + Constants.secretKey);

        String jwtToken = "";

        if (login.getUserName() == null || login.getPassword() == null) {
           throw new ServletException("Please fill in username and password");
        }

        String userName = login.getUserName();
        String password = login.getPassword();

        User user = userService.Authenticate(userName, password);


        if (user == null) {
           throw new ServletException("User not found.");
        }

        String pwd = user.getPassword();

        if (!password.equals(pwd)) {
           throw new ServletException("Invalid login. Please check your name and password.");
        }


        if (user.isAdmin()) {

           jwtToken = Jwts.builder()
                .setSubject(userName)
                .claim("roles", "admin")
                .setIssuedAt(new Date())
                .signWith(SignatureAlgorithm.HS256, Constants.secretKey)
                .compact();
        } else {

           jwtToken = Jwts.builder()
                .setSubject(userName)
                .claim("roles", "user")
                .setIssuedAt(new Date())
                .signWith(SignatureAlgorithm.HS256, Constants.secretKey)
                .compact();

        }

        return jwtToken;
    }


  }

  ////////////////////////////////////////////////////////////////////
  ////////////////////////////////////////////////////////////////////

  package com.vicentex.api.models;

  @Document(collection = "Users")
  public class User {

    @Id 
    private ObjectId id;
    private String userName;
    private String fullName;
    private String email;
    private String password;
    private String image;
    private boolean isAdmin = false; //flagged for simplicity. Will be an array

    Account acct;

    @DBRef
    List<Transaction> transactions;


    public User() {
       super();
    }

    public User(String userName, String fullName, String email, String password, String image) {
       super();
       this.userName = userName;
       this.fullName = fullName;
       this.email = email;
       this.password = password; //note to remember to encrypt on creation
       this.image = image;
    }


    public String getUserName() {
        return userName;
    }

    public void setUserName(String userName) {
        this.userName = userName;
    }
    public String getFullName() {
        return fullName;
    }
    public void setFullName(String fullName) {
        this.fullName = fullName;
    }
    public String getEmail() {
        return email;
    }
    public void setEmail(String email) {
        this.email = email;
    }
    public String getPassword() {
        return password;
    }
    public void setPassword(String password) {
        this.password = password;
    }
    public String getImage() {
        return image;
    }
    public void setImage(String image) {
        this.image = image;
    }

    public boolean isAdmin() {
        return isAdmin;
    }

    public void setAdmin(boolean isAdmin) {
        this.isAdmin = isAdmin;
    }

    public Account getAcct() {
        return acct;
    }

    public void setAcct(Account acct) {
        this.acct = acct;
    }

    public List<Transaction> getTransactions() {
        return transactions;
    }

    public void setTransactions(List<Transaction> transactions) {
        this.transactions = transactions;
    }

 }

Answer 1

In Spring you will use @PreAuthorize( "hasRole('somrole')" ) annotation on the method level. Spring is expecting the role to be in "authorities" claim.

Answer 2

In order to utilize @PreAuthorize, I had to include Spring Security as a dependency in my pom.xml. This forced me to have a password for the API, which isn't what I wanted. Worse, if I disabled the password, it basically defeated the purpose, as nothing else worked. I simply wanted to utilize the jsonwebtoken as a security mechanism over https, and protect a specific subset of url's based on roles in the token. So, what I actually ended up doing was this:

public class JwtFilter extends GenericFilterBean {

  public void doFilter(final ServletRequest req, final ServletResponse res, final FilterChain chain)
        throws IOException, ServletException {

    System.out.println("Secret Key: " + Constants.secretKey);

    final HttpServletRequest request = (HttpServletRequest) req;
    final HttpServletResponse response = (HttpServletResponse) res;
    final String authHeader = request.getHeader("authorization");

    if ("OPTIONS".equals(request.getMethod())) {

        response.setStatus(HttpServletResponse.SC_OK);
        chain.doFilter(req, res);

    } else {

        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
            throw new ServletException("Missing or invalid Authorization header");
        }

        final String token = authHeader.substring(7);

        try {

            final Claims claims = Jwts.parser().setSigningKey(Constants.secretKey).parseClaimsJws(token).getBody();

            String[] roles = claims.get("roles").toString().split(",");

            if (request.getRequestURI().contains("/api/")) {
                if (!Arrays.asList(roles).contains("user")) {
                    System.out.println("ROLES: " + claims.get("roles"));
                    throw new ServletException("A minimum security credential of 'user' is required to access this resource!");
                }
            }

            if (request.getRequestURI().contains("/api/admin")) {
                if (!Arrays.asList(roles).contains("admin")) {
                    System.out.println("ROLES: " + claims.get("roles"));
                    throw new ServletException("This route is restricted to administrators only");
                }
            }


            request.setAttribute("claims", claims);

        } catch (final SignatureException e) {
            throw new ServletException("Invalid token");
        }

        chain.doFilter(req, res);
     }
   }
 }

 ///////////////////////////////////////////////////////////////
 ///////////////////////////////////////////////////////////////
 // In addition, I changed the login code in the user controller

 if (user.isAdmin()) {

        jwtToken = Jwts.builder()
                .setSubject(userName)
                .claim("roles", "admin,user")
                .setIssuedAt(new Date())
                .signWith(SignatureAlgorithm.HS256, Constants.secretKey)
                .compact();
    } else {

        jwtToken = Jwts.builder()
                .setSubject(userName)
                .claim("roles", "user")
                .setIssuedAt(new Date())
                .signWith(SignatureAlgorithm.HS256, Constants.secretKey)
                .compact();

    }

Technically, I could create a collection with the security mappings for role/uri, and loop through each one based on the URI being requested, without ever having to decorate a controller.