Spring Security 使用空的基本身份验证凭据响应空主体

Question

I'm trying to make a basic authentication service, for some business logic i need to acceept all basic auth credentials and make them hit another service (and there it will be fail if the credentials are wrong). So I'm trying to throw an exception when the basic auth is not present, or are empty credentials.

This is my SecurityConfigurer:

@Configuration
@EnableWebSecurity
public class SecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

    @Autowired
    STGAuthenticationProvider authProvider;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authProvider);
    }
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .csrf().disable()
        .authorizeRequests().anyRequest().authenticated()
        .and().httpBasic();
    }

}

And this is my CustomAuthProvider:

    @Component
    public class STGAuthenticationProvider implements AuthenticationProvider {

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {

        String username = authentication.getName();
        String password = authentication.getCredentials().toString();


        if(!StringUtils.isBlank(username) && !StringUtils.isBlank(password)) {
            return new UsernamePasswordAuthenticationToken(username, password, new ArrayList<>());
        } else {
            throw new STGNoCredentialsException(Constants.Error.NO_CREDENTIALS);
        }

    }

    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }

}

Actually my app gives me "401 Unauthorized" if i send a request with no auth (I would really like to get my custom Exception you can see at my CustomAuthProvider). And when i send just 1 credential (username or password), or no one, my service answer me with empty body at POSTMAN. Can you guys help me?

Answer 1

From what I understand, your issue is similar to one I had a few days ago: I needed to return a 401 instead of a 403 whenever an endpoint was called with no authorisation or with auth token expired.
With respect to your code, I would add .exceptionHandling().authenticationEntryPoint(...) to your WebSecurityConfigurerAdapter as follows

@Configuration
@EnableWebSecurity
public class SecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
    /* other stuff */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .csrf().disable()
        .authorizeRequests().anyRequest().authenticated()
        .and().httpBasic()
        .exceptionHandling().authenticationEntryPoint(/*custom exception*/);
    }
}

and then, instead of /*custom exception*/ add something as new MyAuthException() , where MyAuthException looks like the following:

@Component
public class MyAuthException implements AuthenticationEntryPoint {

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response,
        AuthenticationException authException) /*throws ...*/ {
        response.setStatus(/* your status */);
        response.getWriter().write(/*the body of your answer*/);
        /* whatever else you want to add to your response */
        /* or you could throw an exception, I guess*/
    }
}

(I don't remember and right now I can't check whether this class needs to be marked as @Component , I think not).