spring - 使 Custom Filter 和 WebSecurityConfig 在 Actuator 之后运行

Question

我正在尝试使用扩展的自定义过滤器来实现无状态身份验证AbstractPreAuthenticatedProcessingFilter。过滤器在本地工作正常。

我们定义了在部署期间触发的执行器。由于自定义过滤器依赖于 REST API，它失败了，因为执行器只是调用/health端点。

有没有办法在执行器调用之后推迟WebSecurityConfig及其关联。CustomFilter换句话说，在 Spring Security 过滤器链之前调用执行器？

WebSecurityConfig.java

@Configuration
@EnableWebSecurity
@Slf4j
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/actuator/**", "/healthcheck/**", "/health/**", "/actuator/health");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .antMatcher("/**")
                .authorizeRequests().anyRequest().authenticated()
                .and()
                .csrf().disable()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .httpBasic();
        http.addFilterAfter(customAuthFilter(), BasicAuthenticationFilter.class);
    }

    @Bean
    public CustomAuthFilter customAuthFilter() throws Exception {
        CustomAuthFilter customAuthFilter = new CustomAuthFilter();
        customAuthFilter.setAuthenticationManager(authenticationManagerBean());
        return customAuthFilter;
    }

}

注意：CustomFilter是验证标头值的验证过滤器。

CustomFilter.java：

@Component
public class CustomFilter extends AbstractPreAuthenticatedProcessingFilter {

... business logic
} 

春季启动版本：2.2

标签： springspring-bootfilterspring-securityspring-boot-actuator