json - 将 JSONObject 映射到 Rest Template 以获得 Spring Security 中的身份验证
问题描述
我需要使用“用户名”和“密码”json 主体向 /user/auth 发出 POST 请求，以从 Spring 安全端点检索用户身份验证。
我有一个百里香登录表单。它将“用户名”和“密码”发送到我的自定义身份验证过滤器端点。
端点正在被触发，但它接收到的对象为空。
我可以使用邮递员将 json 正文发送到端点，并且可以成功登录，但是当使用 thymeleaf 表单时，我发送的对象为空。
我试过的东西：使用预授权端点来拦截请求并将百里香对象处理成 json。不过，我想我错过了如何使用 RestTemplate 的标记。
@PostMapping(value = "/preauth", produces = "application/json")
@ResponseBody
public UserDto preAuth(@ModelAttribute LoginRequestModel loginRequestModel) {
log.info("username to test: {}", loginRequestModel.getUsername());
log.info("password to test: {}", loginRequestModel.getPassword());
// ^^ these are coming back correct ^^
JSONObject jsonObject = new JSONObject();
jsonObject.put("username", loginRequestModel.getUsername());
jsonObject.put("password", loginRequestModel.getPassword());
jsonObject.toMap().forEach((s, o) -> System.out.println(s + " : " + o));
// ^^ this also comes back correct ^^
// dont understand how to get this JSONObject inserted into the Rest Template
RestTemplate restTemplate = new RestTemplate(jsonObject);
restTemplate.exchange("http://localhost:8080/user/auth", loginRequestModel, LoginRequestModel.class);
return userInfo;
}
<form action="#" method="POST" th:action="@{/user/auth/preauth}" th:object="${loginRequestModel}">
<p>Username: <input th:field="*{username}" type="text"/></p>
<p>Password: <input th:field="*{password}" type="text"/></p>
<p><input type="submit" value="Submit"/> <input type="reset" value="Reset"/></p>
public class AuthenticationFilter extends UsernamePasswordAuthenticationFilter {
@Override
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
log.info("attempting to authenticate user");
try {
log.info("trying to map object");
LoginRequestModel creds = new ObjectMapper()
.readValue(request.getInputStream(), LoginRequestModel.class);
return getAuthenticationManager().authenticate(
new UsernamePasswordAuthenticationToken(
creds.getUsername(),
creds.getPassword(),
new ArrayList<>()
)
);
} catch (IOException e) {
throw new RuntimeException(e);
}
}
无论出于何种原因，当我尝试直接从浏览器中的 thymeleaf 表单调用 request.getInputStream() 时，它都会返回 null 。
[http-nio-8080-exec-3] DEBUG o.s.s.w.FilterChainProxy - /user/auth?username=admin&password=admin at position 5 of 12 in additional filter chain; firing Filter: 'AuthenticationFilter'
[http-nio-8080-exec-3] DEBUG o.s.s.w.u.m.AntPathRequestMatcher - Checking match of request : '/user/auth'; against '/user/auth'
[http-nio-8080-exec-3] DEBUG t.j.w.j.a.s.AuthenticationFilter - Request is to process authentication
[http-nio-8080-exec-3] INFO t.j.w.j.a.s.AuthenticationFilter - attempting to authenticate user
[http-nio-8080-exec-3] INFO t.j.w.j.a.s.AuthenticationFilter - trying to map object
[http-nio-8080-exec-3] INFO t.j.w.j.a.s.AuthenticationFilter - the exception was caught!
[http-nio-8080-exec-3] INFO t.j.w.j.a.s.AuthenticationFilter - the headers::
[http-nio-8080-exec-3] INFO t.j.w.j.a.s.AuthenticationFilter - null
[http-nio-8080-exec-3] INFO t.j.w.j.a.s.AuthenticationFilter - null
[http-nio-8080-exec-3] DEBUG o.s.s.w.h.w.HstsHeaderWriter - Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@46b257b6
[http-nio-8080-exec-3] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository - SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
[http-nio-8080-exec-3] DEBUG o.s.s.w.c.SecurityContextPersistenceFilter - SecurityContextHolder now cleared, as request processing completed
[http-nio-8080-exec-3] ERROR o.a.c.c.C.[.[.[.[dispatcherServlet] - Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception
java.lang.RuntimeException: com.fasterxml.jackson.databind.exc.MismatchedInputException: No content to map due to end-of-input
at [Source: (org.apache.catalina.connector.CoyoteInputStream); line: 1, column: 0]
at tech.jdevmin.web.jdevminweb.app.security.AuthenticationFilter.attemptAuthentication(AuthenticationFilter.java:72)
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:92)
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:77)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358)
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:94)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:526)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:860)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1589)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.base/java.lang.Thread.run(Thread.java:834)
Caused by: com.fasterxml.jackson.databind.exc.MismatchedInputException: No content to map due to end-of-input
at [Source: (org.apache.catalina.connector.CoyoteInputStream); line: 1, column: 0]
at com.fasterxml.jackson.databind.exc.MismatchedInputException.from(MismatchedInputException.java:59)
at com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:4146)
at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:4001)
at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:3071)
at tech.jdevmin.web.jdevminweb.app.security.AuthenticationFilter.attemptAuthentication(AuthenticationFilter.java:49)
... 51 common frames omitted
解决方案
我修好了它！只需将 thymeleaf 对象发送到 preauth 端点并使用 HttpServletRequest 直接从 html 中使用用户名和密码来 request.login()。不需要映射到 json。
@PostMapping(value = "/preauth", produces = "application/json")
public String preAuth(@ModelAttribute LoginRequestModel loginRequestModel, HttpServletRequest request) throws IOException, ServletException {
request.login(loginRequestModel.getUsername(),loginRequestModel.getPassword());
return "index";
}
推荐阅读
- python - 具有常数矩阵的点流水线数据
- oracle - 在 Oracle 中以非日期格式比较时间
- amazon-elastic-transcoder - 在产生多个输出时提高 AWS Elastic Transcoder 中转码过程的速度？
- android-studio - 无法将文本换行设置到右边距线android studio
- html - 有没有办法从谷歌字体中获取所有字体字符？
- java - 仅 Android 中的错误版本的密钥库异常。在独立 Java 中运行良好
- javascript - 如何处理复杂的树数组和遍历新数组？
- css - angular-6-datatable 的自定义 CSS
- php - 如何从会话 Laravel 中删除项目
- python - 从字符串中去除 \x00 和 \x02