自定义页面的 JWT 标记化跳过 URL [重复]

Question

我想跳过 /preImages 请求的 JWT Token 身份验证。

我已经在 J​​wtSecurityConfig 文件中尝试过，但没有成功。

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/api/preImages");
}

在我的ServerApplication中，我写了这个方法来实现它：

//JwtAuthenticationTokenFilter.java

import java.io.IOException;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;

public class JwtAuthenticationTokenFilter extends AbstractAuthenticationProcessingFilter {

public JwtAuthenticationTokenFilter() {
    super("/api/**");
}

@Override
public Authentication attemptAuthentication(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws AuthenticationException, IOException, ServletException {

    String header = httpServletRequest.getHeader("Authorisation");


    if (header == null || !header.startsWith("Token ")) {
        throw new RuntimeException("JWT Token is missing");
    }

    String authenticationToken = header.substring(6);

    JwtAuthenticationToken token = new JwtAuthenticationToken(authenticationToken);
    return getAuthenticationManager().authenticate(token);
}


@Override
protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
    super.successfulAuthentication(request, response, chain, authResult);
    chain.doFilter(request, response);
}
}

//JwtSecurityConfig.java

import java.util.Collections;

@EnableGlobalMethodSecurity(prePostEnabled = true)
@EnableWebSecurity
@Configuration
public class JwtSecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private JwtAuthenticationProvider authenticationProvider;
@Autowired
private JwtAuthenticationEntryPoint entryPoint;

@Bean
public AuthenticationManager authenticationManager() {
    return new ProviderManager(Collections.singletonList(authenticationProvider));
}

@Bean
public JwtAuthenticationTokenFilter authenticationTokenFilter() {
    JwtAuthenticationTokenFilter filter = new JwtAuthenticationTokenFilter();
    filter.setAuthenticationManager(authenticationManager());
    filter.setAuthenticationSuccessHandler(new JwtSuccessHandler());
    return filter;
}


@Override
protected void configure(HttpSecurity http) throws Exception {

    http.csrf().disable().authorizeRequests( ).antMatchers( "/api/preImages" ).permitAll();
    http.authorizeRequests().antMatchers("**/api/**").authenticated()
            .and()
            .exceptionHandling().authenticationEntryPoint(entryPoint)
            .and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

    http.addFilterBefore(authenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class);
    http.headers().cacheControl();

}

}

但是对于“/api/preImages”请求，它也会显示“JWT Token is missing”。

自定义页面的 JWT 标记化跳过 URL

Answer 1

要添加要从过滤/安全中排除的路径，您需要覆盖 WebSecurityConfigurerAdapter 的另一种方法：

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/api/preImages");
}

第二种方法可能是当在标头中找不到令牌时不要在过滤器中抛出异常，而是创建“访客”身份验证。