spring-boot - 春季启动安全自定义successHandler，其余不工作

问题描述

不知道我的问题是否好..

也许我在寻找有关spring security的信息时非常糟糕。总的来说，我希望您不会很难回答。

问题是，我在登录页面中使用了 Spring Security。登录页面位于公共模板文件夹中。我没有为它创建一个单独的控制器来返回视图页面（为它创建一个控制器来返回视图登录页面是否正确？）。无论如何，即使没有这个页面视图控制器，我的代码也能工作。但只有我的自定义 SuccessHandler 不起作用（登录后，按角色检查并重定向到另一个页面）。我应该使用不同的方法按角色重定向到适当的页面吗？（我的意思是如果登录后的 ADMIN_ROLE 被重定向到 admin-panel.html）

我的安全

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class CustomWebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserServiceImpl userServiceImpl;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors().and()
                .authorizeRequests()
                .antMatchers("/", "/templates/sign-up.html").permitAll()
                .antMatchers("/api/users", "/api/users/login").permitAll()
                .antMatchers("/templates/admin-panel.html").hasRole("ADMIN")
                .antMatchers("/all-users").hasRole("ADMIN")
                .antMatchers("/news").hasRole("USER")
        .anyRequest().authenticated()
            .and()
                .formLogin()
                .loginPage("/templates/login.html")
                .defaultSuccessUrl("/")
                .permitAll()
                .successHandler(myAuthenticationSuccessHandler())
                .and()
                .logout()
                .permitAll()
                .logoutSuccessUrl("/index.html");

        http.csrf().disable();
    }
    @Override
    public void configure(WebSecurity web) {
        web
                .ignoring()
                .antMatchers("/css/**")
                .antMatchers("/js/**")
                .antMatchers("/static/**")
                .antMatchers("/resources/**");
    }

    @Autowired
    protected void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userServiceImpl).passwordEncoder(bCryptPasswordEncoder());
    }

    @Bean
    public AuthenticationSuccessHandler myAuthenticationSuccessHandler(){
        return new CustomAuthenticationSuccessHandler();
    }
    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
    @Bean
    public BCryptPasswordEncoder bCryptPasswordEncoder() {
        return new BCryptPasswordEncoder();
    }

我的自定义成功处理程序

public class CustomAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
    protected final Log logger = LogFactory.getLog(this.getClass());

    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

    public CustomAuthenticationSuccessHandler() {
        super();
    }

    // API

    @Override
    public void onAuthenticationSuccess(final HttpServletRequest request, final HttpServletResponse response, final Authentication authentication) throws IOException {
        handle(request, response, authentication);
        clearAuthenticationAttributes(request);
    }

    // IMPL

    protected void handle(final HttpServletRequest request, final HttpServletResponse response, final Authentication authentication) throws IOException {
        final String targetUrl = determineTargetUrl(authentication);

        if (response.isCommitted()) {
            logger.debug("Response has already been committed. Unable to redirect to " + targetUrl);
            return;
        }

        redirectStrategy.sendRedirect(request, response, targetUrl);
    }

    protected String determineTargetUrl(final Authentication authentication) {

        Map<String, String> roleTargetUrlMap = new HashMap<>();
        roleTargetUrlMap.put("ROLE_USER", "/index.html");
        roleTargetUrlMap.put("ROLE_ADMIN", "/templates/admin-panel.html");

        final Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
        for (final GrantedAuthority grantedAuthority : authorities) {

            String authorityName = grantedAuthority.getAuthority();
            if(roleTargetUrlMap.containsKey(authorityName)) {
                return roleTargetUrlMap.get(authorityName);
            }
        }

        throw new IllegalStateException();
    }

    /**
     * Removes temporary authentication-related data which may have been stored in the session
     * during the authentication process.
     */
    protected final void clearAuthenticationAttributes(final HttpServletRequest request) {
        final HttpSession session = request.getSession(false);

        if (session == null) {
            return;
        }

        session.removeAttribute(WebAttributes.AUTHENTICATION_EXCEPTION);
    }
}

我的控制器

    @CrossOrigin
    @RestController
    @RequestMapping("/api/users")
    public class UserController {
    
        private final UserServiceImpl userService;
        private AuthenticationManager authenticationManager;
        public UserController(UserServiceImpl userService, AuthenticationManager authenticationManager) {
            this.userService = userService;
            this.authenticationManager = authenticationManager;
        }
    
        @PostMapping
        public ResponseEntity<?> register(@RequestBody UserDTO user) {
          try {
              userService.register(user);
              return new ResponseEntity<>("User added", HttpStatus.OK);
          } catch (Exception e) {
              return new ResponseEntity<>(e, HttpStatus.BAD_REQUEST);
          }
        }
    
        @PostMapping(value = "/login")
        public ResponseEntity<?> login(@RequestBody UserDTO user, HttpServletResponse response) {
            try {
                Authentication authentication = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.getUsername(), user.getPassword()));
                boolean isAuthenticated = isAuthenticated(authentication);
                if (isAuthenticated) {
                    SecurityContextHolder.getContext().setAuthentication(authentication);
    //                response.sendRedirect("/templates/admin-panel.html");
   //                my pathetic attempt to create a redirect to another page
                }
                return new ResponseEntity<>("user authenticated", HttpStatus.OK);
            } catch (Exception e) {
                return new ResponseEntity<>(e, HttpStatus.FORBIDDEN);
            }
        }
        private boolean isAuthenticated(Authentication authentication) {
            return authentication != null && !(authentication instanceof AnonymousAuthenticationToken) && authentication.isAuthenticated();
        }

我的静态文件 在此处输入图像描述

标签： spring-bootspring-security

spring-boot - 春季启动安全自定义successHandler，其余不工作

问题描述

解决方案

推荐阅读