如何在 Spring MVC 应用程序中实现 Spring 安全性？

Question

I'm new to Spring security. I have implemented spring security and have generated the JWT token. Now i need to get the user from the token and set it in the session so that the session for that user maintains until the token expires or logged out. On the other hand i need to access the API's from the controller but the spring security is not allowing to access the API's without the JWT Token. Is it possible to access the API's in my controller by setting the JWT Token globally or in the session for all the requests.

Here is what i tried till now ,

  UsernamePasswordAuthenticationToken authenticationToken=new UsernamePasswordAuthenticationToken(loginRequest.getUserName(), loginRequest.getPassword());
                Authentication authentication = this.authenticationManager.authenticate(authenticationToken);
                SecurityContextHolder.getContext().setAuthentication(authentication);
                String jwt = tokenProvider.generateToken(authentication);               
                logger.info("jwt is:"+jwt);
                logger.info("authentication:"+authentication.getName());
                User user2 = new User();
                user2.setUserFirstName(user.getFirstName());
                user2.setUserLastName(user.getLastName());
                request.getSession().setAttribute("loggedInUser",user2);
                request.getSession().setMaxInactiveInterval(60);
                request.getSession().setAttribute("menu", MenuUtils.buildMenu(user2));
                return "home";

I'm doing this while signing in the user. I'm using Thymeleaf in the frontend.

Thanks for the help in advance !!

Answer 1

You need to add the jwt token to the request headers, when accessing the apis:

headers.add(HttpHeaders.AUTHORIZATION, "Bearer " + jwt);

This allows the api's to read the headers, and check the user and his permissions

You don't need to store the user on the session. The token itself has an expiry date, and it should be send from the browser to the server on every request.