Spring Boot，默认身份验证失败处理程序如何工作

Question

This is the thing, I have developed a simple spring boot security app using a in memory DB. On successfull authentication it redirects to another site, my problem comes on authentication failure because it shows me a blank screen.

I have set up a single spring security app and implemented an AuthenticationFailureHandler and an AuthenticationSuccessHandler. When I'm not using a custom AuthenticationFailureHandler I do get a BAD CREDENTIALS message on the screen.

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;

import com.tech.app.security.handler.CsegAuthenticationFailureHandler;
import com.tech.app.security.handler.CsegAuthenticationSuccessHandler;

@SuppressWarnings("deprecation")
@Configuration
@EnableWebSecurity
public class CsegSecurityConfig extends WebSecurityConfigurerAdapter{

    @Autowired
    private CsegAuthenticationSuccessHandler successHandler;
    @Autowired
    private CsegAuthenticationFailureHandler failureHandler;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests().antMatchers(HttpMethod.POST, "/login").permitAll()
            .anyRequest().authenticated().and()
            .formLogin()
            .successHandler(successHandler)
            .failureHandler(failureHandler);

    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .inMemoryAuthentication().passwordEncoder(NoOpPasswordEncoder.getInstance()).withUser("user").password("password").roles("USER");
    }



}

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.DefaultRedirectStrategy;
import org.springframework.security.web.RedirectStrategy;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.stereotype.Component;

import com.fasterxml.jackson.databind.ObjectMapper;

@Component
public class CsegAuthenticationFailureHandler implements AuthenticationFailureHandler{

    private ObjectMapper objectMapper = new ObjectMapper();
    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
            AuthenticationException exception) throws IOException, ServletException {

        System.out.println("credenciales invalidas");
        response.setStatus(HttpStatus.UNAUTHORIZED.value());
        Map<String, Object> data = new HashMap<>();
        data.put("timestamp", Calendar.getInstance().getTime());
        data.put("exception", exception.getMessage());

        response.getOutputStream()
          .println(objectMapper.writeValueAsString(data));
        redirectStrategy.sendRedirect(request, response, "/login?error=true");

    }

}

What I want is that on authentication failure save a record in the DB and return to the default login page generated by spring with the corresponding BAD CREDENTIALS message on the screen. Also I want to know where is that default AuthenticationFailureHandler and how it works. All I get is a blank screen

Answer 1

Redirection is made by setting proper Location header to the response. Having youtput stream, you must first write protocol, headers, response body - in that specific order.

You cannot write headers if you started writing body (unless you are buffering the output). So either write body, or do redirection.