Spring OncePerRequestFilter 阻止向路由发送 POST 请求答案

【问题标题】：Spring OncePerRequestFilter prevents sending POST requset to a routeSpring OncePerRequestFilter 阻止向路由发送 POST 请求
【发布时间】：2020-10-30 00:33:31
【问题描述】：

我是 Spring Boot 的新手。
我想发出登录请求以从服务器获取 jwt 令牌。以简单的方式没有问题，但是当我在 securityConfiguration 类中配置 addFilterBefore 方法时，即使我使用 antmatchers 方法，我也没有收到来自服务器的令牌。
WebSecurityConfig 类

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;
    

    @Bean
    public JwtAuthenticationFilter jwtAuthenticationFilter() {
        return new JwtAuthenticationFilter();
    }

    @Bean(BeanIds.AUTHENTICATION_MANAGER)
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().authorizeRequests().antMatchers("/api/auth/**").permitAll().anyRequest().authenticated();
        http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
        authenticationManagerBuilder.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

OncePerRequest 类

public class JwtAuthenticationFilter extends OncePerRequestFilter {

@Autowired
private JwtProvider jwtProvider;
@Autowired
private UserDetailsService userDetailsService;


@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
    String jwt = getJwtFromRequest(request);

    if (StringUtils.hasText(jwt) && jwtProvider.validateToken(jwt)) {
        String username = jwtProvider.getUsernameFromJwt(jwt);
        UserDetails userDetails = userDetailsService.loadUserByUsername(username);
        UsernamePasswordAuthenticationToken authentication =
                new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
        authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
        SecurityContextHolder.getContext().setAuthentication(authentication);
        filterChain.doFilter(request,response);
    }
}

private String getJwtFromRequest(HttpServletRequest httpServletRequest) {
    String bearerToken = httpServletRequest.getHeader("Authorization");
    if (StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")) {
        return bearerToken.substring(7);
    }
    return bearerToken;
}

}
当我请求登录服务器但没有返回令牌时邮递员的屏幕截图。

当我请求登录服务器但未在 securityc 配置类中配置 OncePerRequestFilter 对象 (jwtAuthenticationFilter) 时邮递员的屏幕截图。我的意思是我从 websecurityconfigureradapter 类中删除这些行。
@豆角，扁豆公共 JwtAuthenticationFilter jwtAuthenticationFilter() { 返回新的 JwtAuthenticationFilter(); }

http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);

我感谢所有可以帮助我的人。

【问题讨论】：

标签： java spring

【解决方案1】：

我解决了。我不得不搬家

filterChain.doFilter(request,response);

在过滤器类的 doFilterInternal 中的 if 块之外。

【讨论】：