![](/img/trans.png)
[英]Returning a list of javax.ws.rs.core.Response resulting in 500
[英]JERSEY - returning javax.ws.rs.core.Response as a JSON object with either error:… or token:
編輯 :有沒有辦法返回具有以下任一條件的簡單對象:
...而無需創建新對象。 什么是最有效和最容易理解的方法?
我正在嘗試提供一個@Consumes(MediaType.APPLICATION_JSON)
的登錄服務(包含登錄憑據:用戶名,密碼,consumer(boolean))。
如果憑據有效,我想返回一個令牌,以備將來在前端使用,並返回一個響應代碼 OK / 200 ; 類似於以下JSON對象:
{"token":"aAKGKas211"}
否則,在每種情況下我都會遇到特定的錯誤,我想返回一個不同的RESPONSE CODE ,它看起來像這樣:
{"error":"Invalid username or password"}
我試圖向Response.Status.NOT_ACCEPTABLE).entity(error)添加一個字符串錯誤(=“無效的用戶名或密碼”),但是我將字符串作為字符串而不是作為JSON對象。
這是我的代碼的樣子:
@POST
@Path("/login")
@Produces(MediaType.APPLICATION_JSON)
@Consumes(MediaType.APPLICATION_JSON)
public Response login(@Context HttpServletRequest req, LoginInfo loginInfo) {
CouponClientFacade facade = null;
String token = null, error = null;
// validate the REQUESTer's token, if he is already logged in return ERROR RESPONSE.
System.out.println(loginInfo);
System.out.println(req.getSession().getId());
if (loginInfo == null)
return Response.ok("Test").build();
if (validateCredentials(loginInfo))
return Response.status(Response.Status.NOT_ACCEPTABLE).entity("Invalid username or password").build();
try { // Try to login into administrator
facade = ClientType.ADMIN.login(loginInfo.getUsername(), loginInfo.getPassword());
} catch (Exception E) { // Couldn't login into administrator
try {
if (loginInfo.isCustomer()) // Try to login into CUSTOMER account
facade = ClientType.CUSTOMER.login(loginInfo.getUsername(), loginInfo.getPassword());
else // Try to login into COMPANY account
facade = ClientType.COMPANY.login(loginInfo.getUsername(), loginInfo.getPassword());
} catch (BadUsernamePassword e) {
return Response.status(Response.Status.FORBIDDEN).entity(error=e.getMessage()).build();
} catch (UnexpectedError e) {
return Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity(error=e.getMessage()).build();
}
}
if (facade != null) {
token = SessionManager.generateToken(req.getSession().getId(), facade);
return Response.ok(token).build();
} else return Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity(error="111").build();
}
編輯:
在“授權”標題中傳遞令牌
盡管不是很安全,但是基本身份驗證為該問題提供了解決方案。 借助基本身份驗證,客戶端將使用HTTP [Authorization]標頭隨每個請求發送其Base64編碼的憑據。 這意味着每個請求都獨立於其他請求,並且服務器可能/不為客戶端維護任何狀態信息,這從可伸縮性的角度來看是有益的。
HTTPS簡介:從基本身份驗證到成熟的OAuth2實現,對於任何類型的安全性實現,HTTPS都是必須具備的。 沒有HTTPS,無論您的實現是什么,安全性都容易受到損害。
String plainClientCredentials="myusername:mypassword";
String base64ClientCredentials = new String(Base64.encodeBase64(plainClientCredentials.getBytes()));
HttpHeaders headers = getHeaders();
headers.add("Authorization", "Basic " + base64ClientCredentials);
反過來可能會產生類似以下內容:
Authorization : Basic bXktdHJ1c3FOO1jbGllbnQ6c2VjcmV0...
基本身份驗證和Spring Security通過兩個步驟,您可以在Spring Security Configuration中啟用基本身份驗證。 1.配置httpBasic:配置HTTP基本身份驗證。 [XML中的http-basic] 2.使用BasicAuthenticationEntryPoint配置身份驗證入口點:如果身份驗證失敗[無效/缺少憑據],將觸發此入口點。 這非常重要,因為我們不希望[Spring Security默認行為]在身份驗證失敗時重定向到登錄頁面[我們沒有登錄頁面]。
下面顯示的是帶有httpBasic和入口點設置的完整Spring Security配置。
package com.websystique.springmvc.security;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
private static String REALM="MY_TEST_REALM";
@Autowired
public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication().withUser("bill").password("abc123").roles("ADMIN");
auth.inMemoryAuthentication().withUser("tom").password("abc123").roles("USER");
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers("/user/**").hasRole("ADMIN")
.and().httpBasic().realmName(REALM).authenticationEntryPoint(getBasicAuthEntryPoint())
.and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);//We don't need sessions to be created.
}
@Bean
public CustomBasicAuthenticationEntryPoint getBasicAuthEntryPoint(){
return new CustomBasicAuthenticationEntryPoint();
}
/* To allow Pre-flight [OPTIONS] request from browser */
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers(HttpMethod.OPTIONS, "/**");
}
}
以及實際的入口點,如果身份驗證失敗,它將被觸發。 您可以對其進行自定義以發送自定義內容作為響應。
package com.websystique.springmvc.security;
import java.io.IOException;
import java.io.PrintWriter;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint;
public class CustomBasicAuthenticationEntryPoint extends BasicAuthenticationEntryPoint {
@Override
public void commence(final HttpServletRequest request,
final HttpServletResponse response,
final AuthenticationException authException) throws IOException, ServletException {
//Authentication failed, send error response.
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
response.addHeader("WWW-Authenticate", "Basic realm=" + getRealmName() + "");
PrintWriter writer = response.getWriter();
writer.println("HTTP Status 401 : " + authException.getMessage());
}
@Override
public void afterPropertiesSet() throws Exception {
setRealmName("MY_TEST_REALM");
super.afterPropertiesSet();
}
}
這就是配置基本安全性所需的全部。 現在,讓我們通過良好的舊REST API來了解一切
REST API簡單的Spring REST API,可為用戶提供服務。 客戶端可以使用符合REST風格的標准HTML動詞執行CRUD操作。
package com.websystique.springmvc.controller;
import java.util.List;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.util.UriComponentsBuilder;
import com.websystique.springmvc.model.User;
import com.websystique.springmvc.service.UserService;
@RestController
public class HelloWorldRestController {
@Autowired
UserService userService; //Service which will do all data retrieval/manipulation work
//-------------------Retrieve All Users--------------------------------------------------------
@RequestMapping(value = "/user/", method = RequestMethod.GET)
public ResponseEntity<List<User>> listAllUsers() {
List<User> users = userService.findAllUsers();
if(users.isEmpty()){
return new ResponseEntity<List<User>>(HttpStatus.NO_CONTENT);//You many decide to return HttpStatus.NOT_FOUND
}
return new ResponseEntity<List<User>>(users, HttpStatus.OK);
}
//-------------------Retrieve Single User--------------------------------------------------------
@RequestMapping(value = "/user/{id}", method = RequestMethod.GET, produces = {MediaType.APPLICATION_JSON_VALUE,MediaType.APPLICATION_XML_VALUE})
public ResponseEntity<User> getUser(@PathVariable("id") long id) {
System.out.println("Fetching User with id " + id);
User user = userService.findById(id);
if (user == null) {
System.out.println("User with id " + id + " not found");
return new ResponseEntity<User>(HttpStatus.NOT_FOUND);
}
return new ResponseEntity<User>(user, HttpStatus.OK);
}
//-------------------Create a User--------------------------------------------------------
@RequestMapping(value = "/user/", method = RequestMethod.POST)
public ResponseEntity<Void> createUser(@RequestBody User user, UriComponentsBuilder ucBuilder) {
System.out.println("Creating User " + user.getName());
if (userService.isUserExist(user)) {
System.out.println("A User with name " + user.getName() + " already exist");
return new ResponseEntity<Void>(HttpStatus.CONFLICT);
}
userService.saveUser(user);
HttpHeaders headers = new HttpHeaders();
headers.setLocation(ucBuilder.path("/user/{id}").buildAndExpand(user.getId()).toUri());
return new ResponseEntity<Void>(headers, HttpStatus.CREATED);
}
//------------------- Update a User --------------------------------------------------------
@RequestMapping(value = "/user/{id}", method = RequestMethod.PUT)
public ResponseEntity<User> updateUser(@PathVariable("id") long id, @RequestBody User user) {
System.out.println("Updating User " + id);
User currentUser = userService.findById(id);
if (currentUser==null) {
System.out.println("User with id " + id + " not found");
return new ResponseEntity<User>(HttpStatus.NOT_FOUND);
}
currentUser.setName(user.getName());
currentUser.setAge(user.getAge());
currentUser.setSalary(user.getSalary());
userService.updateUser(currentUser);
return new ResponseEntity<User>(currentUser, HttpStatus.OK);
}
//------------------- Delete a User --------------------------------------------------------
@RequestMapping(value = "/user/{id}", method = RequestMethod.DELETE)
public ResponseEntity<User> deleteUser(@PathVariable("id") long id) {
System.out.println("Fetching & Deleting User with id " + id);
User user = userService.findById(id);
if (user == null) {
System.out.println("Unable to delete. User with id " + id + " not found");
return new ResponseEntity<User>(HttpStatus.NOT_FOUND);
}
userService.deleteUserById(id);
return new ResponseEntity<User>(HttpStatus.NO_CONTENT);
}
//------------------- Delete All Users --------------------------------------------------------
@RequestMapping(value = "/user/", method = RequestMethod.DELETE)
public ResponseEntity<User> deleteAllUsers() {
System.out.println("Deleting All Users");
userService.deleteAllUsers();
return new ResponseEntity<User>(HttpStatus.NO_CONTENT);
}
}
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.