Spring WebSecurity：IllegalStateException：无法将 null 值传递给构造函数

Question

我在对用户进行身份验证和注册的宁静服务中使用 spring 安全性。 我可以作为现有用户登录并获取用户信息。 但是，当我尝试创建新用户/注册用户时，我得到 IllegalArgumentException：无法将 null 值传递给 AuthorizationFilter 中的构造函数。 如果我从 WebSecurity class 中删除授权过滤器，它工作正常。

@EnableWebSecurity public class WebSecurity 扩展 WebSecurityConfigurerAdapter {

private final UserService userDetailsService;
private final BCryptPasswordEncoder bCrytpPasswordEncoder;

public WebSecurity(UserService userDetailsService, BCryptPasswordEncoder bCryptPasswordEncoder) {
    this.userDetailsService = userDetailsService;
    this.bCrytpPasswordEncoder = bCryptPasswordEncoder;
}

@Override
protected void configure(HttpSecurity http) throws Exception {  
    http.csrf()
        .disable()
        .authorizeRequests()
        .antMatchers(HttpMethod.POST, SecurityConstants.SIGN_UP_URL)
        .permitAll()
        .anyRequest()
        .authenticated()
        .and()
        .addFilter(getAuthenticationFilter())
        ***.addFilter(new AuthorizationFilter(authenticationManager()))***
        .sessionManagement()
        .sessionCreationPolicy(SessionCreationPolicy.STATELESS);;
}

@Override
public void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(userDetailsService).passwordEncoder(bCrytpPasswordEncoder);
}

public AuthenticationFilter getAuthenticationFilter() throws Exception {
    final AuthenticationFilter filter = new AuthenticationFilter(authenticationManager());
    filter.setFilterProcessesUrl("/user/login");
    return filter;
}

}

公共 class AuthorizationFilter 扩展 BasicAuthenticationFilter {

public AuthorizationFilter(AuthenticationManager authenticationManager) {
    super(authenticationManager);
}

@Override
protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain filterChain) throws IOException, ServletException {

    // when creating a new user the header is null and execution continues
    // to the next filter then the IllegalStateException is thrown
    String header = req.getHeader(SecurityConstants.HEADER_STRING);
    
    if (header == null || !header.startsWith(SecurityConstants.TOKEN_PREFIX)) {
        filterChain.doFilter(req, null);
        return;
    }
    
    UsernamePasswordAuthenticationToken authentication = getAuthentication(req);
    SecurityContextHolder.getContext().setAuthentication(authentication);
    filterChain.doFilter(req, res);
    
}

public UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest req) {
    String token = req.getHeader(SecurityConstants.HEADER_STRING);
    
    if (token != null) {
        token = token.replace(SecurityConstants.TOKEN_PREFIX, "");
        
        String user = Jwts.parser()
                .setSigningKey(SecurityConstants.getTokenSecret())
                .parseClaimsJws(token)
                .getBody()
                .getSubject();
        
        if (user != null) {
            return new UsernamePasswordAuthenticationToken(user, null, new ArrayList<>());
        }
    }
    
    return null;
}

}

堆栈跟踪：

java.lang.IllegalArgumentException: Cannot pass null values to constructor at org.springframework.util.Assert.isTrue(Assert.java:121) ~[spring-core-5.3.14.jar:5.3.14] at org.springframework. security.web.FilterInvocation.(FilterInvocation.java:71) ~[spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor. java:81) ~[spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web -5.6.1.jar:5.6.1] 在 org.s pringframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:122) ~[spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter (ExceptionTranslationFilter.java:116) ~[spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring- security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:126) ~[spring-security-web-5.6.1.jar:5.6 .1] 在组织 .springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:81) ~[spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain. doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:109) ~[spring -security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.1.jar: 5.6.1] at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:149) ~[spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.FilterChainProxy$ VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) ~ [spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.1. jar:5.6.1 ] at com.acme.estore.user.ws.security.AuthorizationFilter.doFilterInternal(AuthorizationFilter.java:30) ~[classes/:na] at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) ~[spring-web-5.3.14.jar:5.3.14] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.1.jar :5.6.1] at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:219) ~[spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security .web.authentication.A bstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:213) ~[spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~ [spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:103) ~[spring-security-web-5.6. 1.jar:5.6.1] at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:89) ~[spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.FilterChainProxy$VirtualFilterC hain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90) ~ [spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75) ~[spring-security-web-5.6.1. jar:5.6.1] at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) ~[spring-web-5.3.14.jar:5.3.14] at org.springframework.security.web. FilterChainProxy$VirtualFilterChain.doFilte r(FilterChainProxy.java:336) ~[spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:110) ~[spring -security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:80) ~[spring-security-web-5.6.1.jar: 5.6.1] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security. web.context.request.async.WebAsyncManagerIntegrati onFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:55) ~[spring-security-web-5.6.1.jar:5.6.1] at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) ~[spring -web-5.3.14.jar:5.3.14] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.1.jar:5.6. 1] at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:211) ~[spring-security-web-5.6.1.jar:5.6.1] at org.springframework.security.web.FilterChainProxy. doFilter(FilterChainProxy.java:1 83) ~[spring-security-web-5.6.1.jar:5.6.1] at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:354) ~[spring-web-5.3.14.jar :5.3.14] at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:267) ~[spring-web-5.3.14.jar:5.3.14] at org.apache.catalina.core.ApplicationFilterChain .internalDoFilter(ApplicationFilterChain.java:189) ~[tomcat-embed-core-9.0.56.jar:9.0.56] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[tomcat- embed-core-9.0.56.jar:9.0.56] 在 org.springframework.Z2567 A5EC9705EB7AC2C984033E06189DZ.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) ~[spring-web-5.3.14.jar:5.3.14] at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) ~ [spring-web-5.3.14.jar:5.3.14] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[tomcat-embed-core-9.0.56.jar:9.0. 56] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[tomcat-embed-core-9.0.56.jar:9.0.56] at org.springframework.web.filter.FormContentFilter. doFilterInternal(FormContentFilter.Z93F725A07423F E1C889F448B33D21F46Z:93) ~[spring-web-5.3.14.jar:5.3.14] at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) ~[spring-web-5.3.14.jar :5.3.14] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[tomcat-embed-core-9.0.56.jar:9.0.56] at org.apache.catalina.core .ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[tomcat-embed-core-9.0.56.jar:9.0.56] at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) ~[ spring-web-5.3.14.jar:5.3.14] 在 org.spr ingframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) ~[spring-web-5.3.14.jar:5.3.14] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189 ) ~[tomcat-embed-core-9.0.56.jar:9.0.56] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[tomcat-embed-core-9.0.56. jar:9.0.56] at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197) ~[tomcat-embed-core-9.0.56.jar:9.0.56] at org.apache.catalina. core.StandardContextValve.invoke（StandardContextValve.Z93F725A07423FE1C889F 448B33D21F46Z:97) [tomcat-embed-core-9.0.56.jar:9.0.56] at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:540) [tomcat-embed-core-9.0.56 .jar:9.0.56] at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135) [tomcat-embed-core-9.0.56.jar:9.0.56] at org.apache.catalina. valves.ErrorReportValve.invoke(ErrorReportValve.java:92) [tomcat-embed-core-9.0.56.jar:9.0.56] at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78) [tomcat -embed-core-9.0.56.jar:9.0.56] 在 org.apache.catalina.connector.CoyoteAda pter.service(CoyoteAdapter.java:357) [tomcat-embed-core-9.0.56.jar:9.0.56] at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:382) [tomcat-embed -core-9.0.56.jar:9.0.56] at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) [tomcat-embed-core-9.0.56.jar:9.0.56] at org. apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:895) [tomcat-embed-core-9.0.56.jar:9.0.56] at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun( NioEndpoint.java:1732) [tomcat-embed-core-9.0.56.Z68995FCBF432492D15484D04A9D2AC 40Z:9.0.56] at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-9.0.56.jar:9.0.56] at org.apache.tomcat .util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) [tomcat-embed-core-9.0.56.jar:9.0.56] at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor .java:659) [tomcat-embed-core-9.0.56.jar:9.0.56] at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed- core-9.0.56.jar:9.0.56] 在 Z93F725A07 423FE1C889F448B33D21F46Z.lang.Thread.run(Thread.java:748) [na:1.8.0_211]

Answer 1

我终于想通了，我觉得有点愚蠢，但它是：

在 AuthorizationFilter 我有这个方法调用：

if (header == null ||.header.startsWith(SecurityConstants.TOKEN_PREFIX)) { filterChain,doFilter(req; null); return; }

它应该是：

filterChain.doFilter(req,res);

大多数时候，答案就在你的脸上。 管视角！！