Spring Security OAuth2在重定向之前操縱請求URL

Question

我有一個使用春季安全性OAuth2保護的Vaadin應用程序。 除偶爾使用PUSH或HEARTBEAT端點首先請求然后觸發身份驗證過程，並且用戶最終進入錯誤的頁面（這些端點不應被用戶直接訪問）之外，此方法工作正常。

一個簡單但不安全的解決方案是在這些端點上允許permitAll() 。 但是，由於這構成了威脅，我需要解決這個問題。

為此，我想解析並可能在成功身份驗證重定向到請求URL之前對其進行編輯。 我將如何去做呢？

我想我需要在鏈中的某處添加一個過濾器以攔截請求並對其進行編輯。 但是我不確定在哪里。

這是我的客戶：

@Configuration
@EnableOAuth2Sso
public class OAuthConfig extends WebSecurityConfigurerAdapter
{

    @Override
    protected void configure(HttpSecurity http) throws Exception
    {
        http.csrf().disable()
                .authorizeRequests()
                .antMatchers("/login**").permitAll()
                .antMatchers("/vaadinServlet/PUSH/**").permitAll()          //todo fix this hole
                .antMatchers("/vaadinServlet/HEARTBEAT/**").permitAll()      //todo fix this hole
                .anyRequest().authenticated()
                .and()
                .logout()
                .logoutSuccessUrl("/")
                .logoutRequestMatcher(new AntPathRequestMatcher("/logout"));

    }

    @Override
    public void configure(WebSecurity web) throws Exception
    {
        web.ignoring().antMatchers("/css/*").antMatchers("/VAADIN/**"); // Static resources are ignored
    }

}

和服務器：

@Configuration
@EnableAuthorizationServer
public class OAuth2Config extends AuthorizationServerConfigurerAdapter
{
//jwt token stuff & my own client/auth providers. Should not be important.
...
}

服務器登錄表格：

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter
{

    @Autowired
    private RestAuthenticationProvider authenticationProvider;

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception
    {
        auth.authenticationProvider(authenticationProvider);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception
    {
        http
                .authorizeRequests()
                .antMatchers(HttpMethod.GET, "/forgetPassword*").permitAll()
                .antMatchers(HttpMethod.POST,"/user/resetPassword*").permitAll()
                .antMatchers(HttpMethod.GET,"/user/changePassword*").permitAll()
                .antMatchers("/user/updatePassword*", "/user/savePassword*", "/updatePassword*")
                .hasAnyAuthority("CHANGE_PASSWORD_PRIVILEGE","ROLE_USER")
                .anyRequest().authenticated()
                .and()
                    .formLogin()
                    .loginPage("/login")
                    .permitAll()
                .and()
                    .csrf().csrfTokenRepository(csrfTokenRepository());
    }

    private CsrfTokenRepository csrfTokenRepository()
    {
        HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
        repository.setHeaderName("X-XSRF-TOKEN");
        return repository;
    }

}

Answer 1

只需在您的項目中添加一些實現

1：創建身份驗證失敗處理程序

@Component
public class CustomAuthenticationFailureHandler extends SimpleUrlAuthenticationFailureHandler {


    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
        System.out.print("here failure");



        String s=request.getParameter("username");
        setDefaultFailureUrl("/login?error&username="+s);
        super.onAuthenticationFailure(request,response,exception);
    }

}

2：身份驗證成功處理程序

@Component
public class CustomAuthenticationSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request , HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        /* custom Block 
Do any thing here
  */

        setDefaultTargetUrl("/home/");
        super.onAuthenticationSuccess(request,response,authentication);
    }
}

3：訪問請求入口點

@Component
public class CustomAuthenticationEntryPoint implements AuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {
        System.out.print("Unauthorized Access");

        httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
    }
}

根據您的要求實施組件。