Spring 引导 + jjwt 安全对错误请求不返回任何内容

Question

我的问题是，在发送带有错误登录凭据的请求或在未经身份验证的情况下访问端点时，我没有得到任何响应。 这是我发送良好请求时的外观：良好响应屏幕

这就是请求正文无效时的外观： Invalid credentials request

我的用户详细信息 class：

public class MyUserDetailService implements UserDetailsService {
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        return new User("foo", "foo", List.of());
    }
}

安全配置 class：

public class SecurityConfigurer extends WebSecurityConfigurerAdapter {
    @Autowired
    private MyUserDetailService myUserDetailService;
    @Autowired
    private JwtFilter jwtFilter;

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(myUserDetailService);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return NoOpPasswordEncoder.getInstance();
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/auth").permitAll()
                .anyRequest().authenticated()
                .and().sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and().csrf().disable();
        http.addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
    }
}

Jwt 滤波器 class：

@Component
public class JwtFilter extends OncePerRequestFilter {

    @Autowired
    private JwtUtil jwtUtil;
    @Autowired
    private MyUserDetailService myUserDetailService;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        final String authHeader = request.getHeader("Authorization");
        String username = null;
        String requestToken = null;

        if(authHeader != null && authHeader.startsWith("Bearer ")) {
            requestToken = authHeader.substring(7);
            username = jwtUtil.getUsernameFromToken(requestToken);
        }
        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
            UserDetails userDetails = myUserDetailService.loadUserByUsername(username);
            if(jwtUtil.validateToken(requestToken, userDetails)) {
                UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken =
                        new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
                usernamePasswordAuthenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
            }
        }
        filterChain.doFilter(request, response);
    }

最后是我的 controller：

@PostMapping("/auth")
    public AuthResponse auth(@RequestBody AuthRequest authRequest) throws Exception {
        try {
            authenticationManager.authenticate(
                    new UsernamePasswordAuthenticationToken(authRequest.getUsername(), authRequest.getPassword())
            );
        } catch (BadCredentialsException e) {
            throw new Exception("Invalid Credentials", e);
        }
        final UserDetails userDetails = myUserDetailService.loadUserByUsername(authRequest.getUsername());
        final String token = jwtUtil.generateToken(userDetails);
        return new AuthResponse(token);
    }

编辑：我忘了粘贴依赖项。

dependencies {
    implementation 'org.springframework.boot:spring-boot-starter-web'
    implementation 'org.springframework.boot:spring-boot-starter-security'
    implementation 'io.jsonwebtoken:jjwt:0.9.1'
    implementation 'javax.xml.bind:jaxb-api:2.2.4'
    testImplementation 'org.springframework.boot:spring-boot-starter-test'
}

我还有 AuthRequest 和 AuthResponse class ，其中包含用户名、密码、jwt 令牌以及所有构造函数、getter 和 setter （不值得在这里通过它）

Answer 1

您必须在验证时抛出异常（以下是我使用的，只需抓住概念，您的类和库可能会有所不同）：

Jwts.parser().setSigningKey(your_jwt_secret).parseClaimsJws(token);

因此，如果您的令牌无法解析，则抛出此错误并发送错误响应：

  httpServletResponse.setContentType("application/json");
  httpServletResponse.getWriter().write("your_custom_error");
  httpServletResponse.getWriter().flush();