带有SpringSecurity的REST API中的IP地址验证

Question

I have Spring Boot application with configured SpringSecurity. It uses token generated by UUID.randomUUID().toString(), returned by method login in UUIDAuthenticationService class in AuthUser object. Authorized users are kept in LoggedInUsers class. When I'm sending request to API token is verified by method findByToken in UUIDAuthenticationService class.

Lastly I added timeout for token verification. Now I want to add ip address verification. If user is logged in from address XXXX (which is kept in AuthUser object) he should be authorized with his token only form address XXXX How to do it?

My SecurityConfig.java:

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
@FieldDefaults(level = PRIVATE, makeFinal = true)
class SecurityConfig extends WebSecurityConfigurerAdapter {

private static final RequestMatcher PUBLIC_URLS = new OrRequestMatcher(
        new AntPathRequestMatcher("/api/login/login"),
);
private static final RequestMatcher PROTECTED_URLS = new NegatedRequestMatcher(PUBLIC_URLS);

TokenAuthenticationProvider provider;

SecurityConfig(final TokenAuthenticationProvider provider) {
    super();
    this.provider = requireNonNull(provider);
}

@Override
protected void configure(final AuthenticationManagerBuilder auth) {
    auth.authenticationProvider(provider);
}

@Override
public void configure(final WebSecurity web) {
    web.ignoring()
            .requestMatchers(PUBLIC_URLS);
    web.httpFirewall(defaultHttpFirewall());    
}

@Override
protected void configure(final HttpSecurity http) throws Exception {
    http
            .sessionManagement()
            .sessionCreationPolicy(STATELESS)
            .and()
            .exceptionHandling()
            // this entry point handles when you request a protected page and you are not yet
            // authenticated
            .defaultAuthenticationEntryPointFor(forbiddenEntryPoint(), PROTECTED_URLS)
            .and()
            .authenticationProvider(provider)
            .addFilterBefore(restAuthenticationFilter(), AnonymousAuthenticationFilter.class)
            .authorizeRequests()
            .antMatchers("/api/admin/**").hasAuthority("ROLE_ADMIN")
            .antMatchers("/api/application/**").hasAnyAuthority("ROLE_ADMIN", "ROLE_EMPLOYEE", "ROLE_PORTAL")
            .antMatchers("/api/rezerwacja/**").hasAnyAuthority("ROLE_ADMIN", "ROLE_EMPLOYEE")
            .anyRequest()
            .authenticated()
            .and()
            .csrf().disable()
            .formLogin().disable()
            .httpBasic().disable()
            .logout().disable();

}

@Bean
TokenAuthenticationFilter restAuthenticationFilter() throws Exception {
    final TokenAuthenticationFilter filter = new TokenAuthenticationFilter(PROTECTED_URLS);
    filter.setAuthenticationManager(authenticationManager());
    filter.setAuthenticationSuccessHandler(successHandler());
    return filter;
}

@Bean
SimpleUrlAuthenticationSuccessHandler successHandler() {
    final SimpleUrlAuthenticationSuccessHandler successHandler = new SimpleUrlAuthenticationSuccessHandler();
    successHandler.setRedirectStrategy(new NoRedirectStrategy());
    return successHandler;
}

/**
 * Disable Spring boot automatic filter registration.
 */
@Bean
FilterRegistrationBean disableAutoRegistration(final TokenAuthenticationFilter filter) {
    final FilterRegistrationBean registration = new FilterRegistrationBean(filter);
    registration.setEnabled(false);
    return registration;
}

@Bean
AuthenticationEntryPoint forbiddenEntryPoint() {
    return new HttpStatusEntryPoint(FORBIDDEN);
}

@Bean                                                 
public HttpFirewall defaultHttpFirewall() {
    return new DefaultHttpFirewall();
}
}

AbstractAuthenticationProcessingFilter.java:

@FieldDefaults(level = PRIVATE, makeFinal = true)
public final class TokenAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
private static final String BEARER = "Bearer";

public TokenAuthenticationFilter(final RequestMatcher requiresAuth) {
    super(requiresAuth);
}

@Override
public Authentication attemptAuthentication(
        final HttpServletRequest request,
        final HttpServletResponse response) {
    final String param = ofNullable(request.getHeader(AUTHORIZATION))
            .orElse(request.getParameter("t"));

    final String token = ofNullable(param)
            .map(value -> removeStart(value, BEARER))
            .map(String::trim)
            .orElseThrow(() -> new BadCredentialsException("Missing Authentication Token"));

    final Authentication auth = new UsernamePasswordAuthenticationToken(token, token);
    return getAuthenticationManager().authenticate(auth);
}

@Override
protected void successfulAuthentication(
        final HttpServletRequest request,
        final HttpServletResponse response,
        final FilterChain chain,
        final Authentication authResult) throws IOException, ServletException {
    super.successfulAuthentication(request, response, chain, authResult);
    chain.doFilter(request, response);
}
}

TokenAuthenticationProvider/java:

@Component
@AllArgsConstructor(access = PACKAGE)
@FieldDefaults(level = PRIVATE, makeFinal = true)
public final class TokenAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {
@NonNull
UserAuthenticationService auth;

@Override
protected void additionalAuthenticationChecks(final UserDetails d, final UsernamePasswordAuthenticationToken auth) {
    // Nothing to do
}

@Override
protected UserDetails retrieveUser(final String username, final UsernamePasswordAuthenticationToken authentication) {
    final Object token = authentication.getCredentials();
    return Optional
            .ofNullable(token)
            .map(String::valueOf)
            .flatMap(auth::findByToken)
            .orElseThrow(() -> new UsernameNotFoundException("Cannot find user with authentication token=" + token));
}
}

UUIDAuthenticationService.java:

@Service
@AllArgsConstructor(access = PACKAGE)
@FieldDefaults(level = PRIVATE, makeFinal = true)
public final class UUIDAuthenticationService implements UserAuthenticationService {

private static final Logger log = LoggerFactory.getLogger(UUIDAuthenticationService.class);

@NonNull
UserCrudService users;

@Autowired
LoginManager loginMgr;

@Override
public AuthUser login(final String username, final String password) throws Exception { //throws Exception {

    AuthUser user = loginMgr.loginUser(username, password);
    if (user != null) {
        users.delete(user);
        users.save(user);
        log.info("Zalogowano użytkownika {}, przydzielono token: {}", user.getUsername(), user.getUuid());
    }

    return Optional
            .ofNullable(user)
            .orElseThrow(() -> new RuntimeException("Błędny login lub hasło"));
}

@Override
public Optional<AuthUser> findByToken(final String token) {

    AuthUser user = users.find(token).orElse(null); // get();
    if (user != null) {
        Date now = Date.from(OffsetDateTime.now(ZoneOffset.UTC).toInstant());
        int ileSekund = Math.round((now.getTime() - user.getLastAccess().getTime()) / 1000);        // timeout dla tokena
        if (ileSekund > finals.tokenTimeout) {
            log.info("Token {} dla użytkownika {} przekroczył timeout", user.getUuid(), user.getUsername());
            users.delete(user);
            user = null;
        }
        else {
            user.ping();
        }
    }
    return Optional.ofNullable(user); //users.find(token);
}

@Override
public void logout(final AuthUser user) {

    users.delete(user);
}
}

I thought about creating method findByTokenAndIp in UUIDAuthenticationService, but I don't know how to find ip address of user sending request and how to get ip address while logging in login method in UUIDAuthenticationService (I need it while I'm creating AuthUser object).

Answer 1

You had access to HttpServletRequest request in your filter so you can extract the IP from it.

See https://www.mkyong.com/java/how-to-get-client-ip-address-in-java/

After having the IP, you can deny the request anyway that you want!

Answer 2

I would briefly do the following steps:

save the IP in the UUIDAuthenticationService. You can add HttpServletRequest request as a param, if you're using a controller/requestmapping, because it's auto-injected:

@RequestMapping("/login")
public void lgin(@RequestBody Credentials cred, HttpServletRequest request){
    String ip = request.getRemoteAddr();
    //...
}

Within the authentication filter, use the IP as the "username" for the UsernamePasswordAuthenticationToken and the token as the "password". There is also already the HttpServletRequest request that gives you the IP by getRemoteAddr() . It's also possible to create an own instance of AbstractAuthenticationToken or even UsernamePasswordAuthenticationToken , which explictly holds an IP or even the request for the authentication-manager.

Then, you just need to adapt the changes to your retrieveUser method.

Answer 3

I modified controller to get ip address with HttpServletRequest parameter and add parameter ipAddress to login method.

@PostMapping("/login")
public AuthUser login(InputStream inputStream, HttpServletRequest request) throws Exception {

    final String ipAddress = request.getRemoteAddr();
    if (ipAddress == null || ipAddress.equals("")) {
        throw new Exception("Nie udało się ustalić adresu IP klienta");
    }

    Login login = loginMgr.prepareLogin(inputStream);
    return authentication
            .login(login.getUsername(), login.getPasword(), ipAddress);
}

And modified method retrieveUser in TokenAuthenticationProvider

@Override
protected UserDetails retrieveUser(final String username, final UsernamePasswordAuthenticationToken authentication) {

    System.out.println("Verification: "+authentication.getPrincipal()+" => "+authentication.getCredentials());

    final Object token = authentication.getCredentials();
    final String ipAddress= Optional
            .ofNullable(authentication.getPrincipal())
            .map(String::valueOf)
            .orElse("");

    return Optional
            .ofNullable(token)
            .map(String::valueOf)
            .flatMap(auth::findByToken)
            .filter(user -> user.ipAddress.equals(ipAddress))   // weryfikacja adresu ip
            .orElseThrow(() -> new UsernameNotFoundException("Cannot find user with authentication token=" + token));
}

And it works. Thans for help.