使用解析 JSON 有效负载的自定义身份验证过滤器在身份验证后禁止获取 403

Question

What I'm trying to do is just authenticate in-memory default user using a custom authentication filter that parses a JSON payload that contain the username and the password.

SecurityConfig.java

package ali.yousef.authdemo.config.security;

@Configuration
@EnableWebSecurity
public class SecurityConfig
{
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception
    {
        AuthenticationManager authenticationManager = authenticationConfiguration.getAuthenticationManager();

        return authenticationManager;
    }

    @Bean
    PasswordEncoder passwordEncoder()
    {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception
    {
        JsonUserPasswordAuthenticationFilter jsonUserPasswordAuthenticationFilter = new JsonUserPasswordAuthenticationFilter();
        jsonUserPasswordAuthenticationFilter.setAuthenticationManager(authenticationManager);

        http
                .csrf().disable()
                .formLogin().disable()
                .addFilterAt(jsonUserPasswordAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
                .authorizeHttpRequests()
                .requestMatchers("/api/**").authenticated()
                .anyRequest().permitAll();

        return http.build();
    }
}

JsonUserPasswordAuthenticationFilter.java

package ali.yousef.authdemo.config.security;

public class JsonUserPasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter
{
    protected JsonUserPasswordAuthenticationFilter(AuthenticationManager authenticationManager)
    {
        this.setAuthenticationManager(authenticationManager);
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException
    {
        UsernamePasswordDto usernamePasswordDto;

        try
        {
            usernamePasswordDto = new ObjectMapper().readValue(request.getInputStream(), UsernamePasswordDto.class);
            System.out.println(usernamePasswordDto.toString());
        }
        catch (IOException ioe)
        {
            throw new AuthenticationServiceException(ioe.getMessage(), ioe);
        }

        UsernamePasswordAuthenticationToken authToken =
                new UsernamePasswordAuthenticationToken(usernamePasswordDto.getUsername(), usernamePasswordDto.getPassword());

        return this.getAuthenticationManager().authenticate(authToken);
    }
}

TestController.java

@RestController
public class TestController
{
    @GetMapping("/api/hello")
    public String hello(Principal principal)
    {
        return "hello " + principal.getName();
    }
}

When authenticating the default user it gets authenticated and return the home page but when I try to send a request to /api/hello it respond with 403 .

EDIT: I edited how I register the custom authentication filter. But the same problem is present. It seems like the security context gets cleared after successful authentication and I get anonymousUser from principal.

Answer 1

Extending a UsernamePassWordAuthenticationFilter brings in more customizations than you need to set up a custom auth filter.. see this post for more details why your filter is not getting called - link

You can achieve the same using OncePerRequestFilter as below -

@Component
public class JsonUserPasswordAuthenticationFilter extends OncePerRequestFilter
{

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
        throws ServletException, IOException {
    
        UsernamePasswordAuthenticationToken authToken = YOUR_LOGIC(); // new UsernamePasswordAuthenticationToken("test", "passwd",Collections.emptyList()); as you have no authorities empty list is important here...
    
        SecurityContextHolder.getContext().setAuthentication(authToken);

        filterChain.doFilter(request, response);
    
    }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig
{

    @Bean
    PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http, JsonUserPasswordAuthenticationFilter filter) throws Exception {
    http
        .csrf().disable()
        .formLogin().disable()
        .addFilterBefore(filter, UsernamePasswordAuthenticationFilter.class)
        .authorizeHttpRequests(auth -> {
          auth.requestMatchers(new AntPathRequestMatcher("/api/**")).authenticated()
        .anyRequest().permitAll();
        })  ;

    return http.build();
}