如果具有不同的 Authorization 标头，则 Spring 安全绕过

Question

我已经用 jwt 实现了 spring security 并且工作正常。

@Configuration
@Component
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomJWTProvider jwtTokenProvider;

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .httpBasic().disable()
                .csrf().disable()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .authorizeRequests()
                .antMatchers("/health").permitAll()
                .anyRequest().authenticated()
                .and()
                .apply(new CustomJwtConfigurer(jwtTokenProvider));

    }

    @Override
    public void configure(WebSecurity web) {
        web.ignoring().antMatchers(HttpMethod.OPTIONS, "/**");
    }
}

但我有一个典型的用例，我在授权标头中获得 jwt 令牌或 64 位固定长度令牌。

如果是 JWT 令牌，spring security 应该按原样工作，如果不是，控制权应该传递给某个方法（我有我的逻辑来验证那个令牌）

我的过滤器看起来像

@Component
public class CustomFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterchain) throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        String authToken = httpRequest.getHeader("Authorization");
        if(myCustomValidator(authToken)){
            //if this is true it should skip spring security jwt token verification
            //which is in configure phase
        }else{
            HttpServletResponse httpResponse = (HttpServletResponse) response;
            httpResponse.sendError(403, "Access denied");
        }
        System.out.println("authToken="+authToken);
        filterchain.doFilter(request, response);
    }
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {}

    @Override
    public void destroy() {}
}

我如何/在哪里可以添加此过滤器以绕过弹簧安全性，或任何其他基于授权标头跳过弹簧安全性的机制？

Answer 1

您可以使用 OncePerRequestFilter。您需要创建一个类并扩展该类，并在其中覆盖其方法（doFilterInternal）并将您的逻辑放在那里。

您可以像下面这样配置该过滤器。

    @Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    public class YourClass extends WebSecurityConfigurerAdapter {
        @Autowired
        private YourFilter authFilter;
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.addFilterAt(authFilter, UsernamePasswordAuthenticationFilter.class);
        }
    }