ServerHttpSecurityauthorizeExchangePermitAll不作業

我已經使用 spring cloud API 網關配置了 auth0 身份驗證，我的基本設定如下，

• POST - /user/api/user/registration - PermitAll

• 所有其他 API 端點都經過身份驗證。

因此將以下 SecurityConfiguration 與 spring boot 應用程式一起使用，

package com.app.source.configuration.security;

import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.method.configuration.EnableReactiveMethodSecurity;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.web.server.SecurityWebFilterChain;

@EnableWebFluxSecurity
@EnableReactiveMethodSecurity
public class SecurityConfiguration {
    @Bean
    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
        http
                .authorizeExchange()
                //ALLOW USER REGISTRATION API WITHOUT AUTHENTICATION
                .pathMatchers("/user/api/v1/user/registration").permitAll()
                //ALL OTHER APIS ARE AUTHENTICATED
                .anyExchange().authenticated()
                .and()
                .csrf().disable()
                .oauth2Login()
                .and()
                .oauth2ResourceServer()
                .jwt();
        return http.build();
    }
}

身份驗證層已應用于必要的 API 端點，它按我的需要作業，但是這個注冊端點發送空的 200 回應，但它沒有通過 API 網關。但是在發送帶有身份驗證標頭的 API 時，相同的 API 可以作業。我正在附加 API 網關的除錯日志。

需要具有身份驗證令牌的 API，該令牌可以正常作業并在未經授權的請求上發送 401。

配置為打開的 API 從 API 網關發送 200 而無需通過，

當我附加了身份驗證令牌時，相同的 API 運行良好，這是不可接受的行為。

Request with valid auth token

2022-05-14 02:26:29.918 DEBUG 9999 --- [ctor-http-nio-3] o.s.w.s.adapter.HttpWebHandlerAdapter    : [1f1cee98-10, L:/0:0:0:0:0:0:0:1:8082 - R:/0:0:0:0:0:0:0:1:61057] HTTP POST "/user/api/v1/user/registration"
2022-05-14 02:26:29.934 DEBUG 9999 --- [oundedElastic-3]
o.s.w.s.s.DefaultWebSessionManager       : Created new WebSession.
2022-05-14 02:26:32.497 DEBUG 9999 --- [ctor-http-nio-3] o.s.w.s.adapter.HttpWebHandlerAdapter    : [1f1cee98-10, L:/0:0:0:0:0:0:0:1:8082 - R:/0:0:0:0:0:0:0:1:61057] Completed 200 OK


-----------

Request without token which is returning 200 in the same second without processing it.

2022-05-14 02:26:45.950 DEBUG 9999 --- [ctor-http-nio-3] o.s.w.s.adapter.HttpWebHandlerAdapter    : [1f1cee98-11, L:/0:0:0:0:0:0:0:1:8082 - R:/0:0:0:0:0:0:0:1:61057] HTTP POST "/user/api/v1/user/registration"
2022-05-14 02:26:45.960 DEBUG 9999 --- [oundedElastic-3] o.s.w.s.s.DefaultWebSessionManager       : Created new WebSession.
2022-05-14 02:26:45.977 DEBUG 9999 --- [oundedElastic-3] o.s.w.s.adapter.HttpWebHandlerAdapter    : [1f1cee98-11, L:/0:0:0:0:0:0:0:1:8082 - R:/0:0:0:0:0:0:0:1:61057] Completed 200 OK

uj5u.com熱心網友回復：

問題出在過濾器上

 @Bean
public GlobalFilter customGlobalFilter() {

    return ((exchange, chain) -> exchange.getPrincipal().map(principal -> {
        String userName = "";

        if (principal instanceof JwtAuthenticationToken) {
            //Get username from Principal
            userName = principal.getName();
        }
        // adds header to proxied request
        exchange.getRequest().mutate()
                .header("X-Auth-Id", userName)
                .build();
        return exchange;
    }).flatMap(chain::filter).then(Mono.fromRunnable(() -> {

    })));
}

如果你洗掉作品就好了

uj5u.com熱心網友回復：

最初的問題是用于捕獲傳入請求主體用戶名的自定義過濾器，添加了 defaultIfEmpty 并允許未經授權的用戶請求。

package com.app.configuration;

import lombok.extern.slf4j.Slf4j;
import org.springframework.cloud.gateway.filter.GlobalFilter;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import reactor.core.publisher.Mono;

import java.security.Principal;

@Slf4j
@Configuration
public class GatewayConfiguration {

    private static final String HTTP_HEADER_AUTH_USER_ID = "X-Auth-Id";
    private static final String UNAUTHORIZED_USER_NAME = "SYSTEM USER";

    @Bean
    public GlobalFilter customGlobalFilter() {
        return (exchange, chain) -> exchange.getPrincipal().map(Principal::getName).defaultIfEmpty(UNAUTHORIZED_USER_NAME).map(principal -> {
            // adds header to proxied request
            exchange.getRequest().mutate()
                    .header(HTTP_HEADER_AUTH_USER_ID, principal)
                    .build();
            return exchange;
        }).flatMap(chain::filter).then(Mono.fromRunnable(() -> {

        }));
    }

}

標籤：弹簧靴 春云 spring-security-oauth2 授权0 春天云网关

上一篇：將自定義引數傳遞給ConstraintValidator

下一篇：使用win32api(Python)獲取行程的所有執行緒