JWT跳过登录页面的URL [英] JWT skip URL for Login Page

问题描述

我想跳过针对/preLogin请求的JWT令牌身份验证.

I want to skip the JWT Token authentication for the /preLogin request.

我已经在JwtSecurityConfig文件中尝试过此操作，但是没有用.

I already tried this in JwtSecurityConfig File but it didn't work.

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/api/preLogin");
}

在我的ServerApplication中，我编写了此方法来实现它:

In my ServerApplication, I wrote this method to achieve it:

//JwtAuthenticationTokenFilter.java

import java.io.IOException;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;

public class JwtAuthenticationTokenFilter extends AbstractAuthenticationProcessingFilter {

public JwtAuthenticationTokenFilter() {
    super("/api/**");
}

@Override
public Authentication attemptAuthentication(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws AuthenticationException, IOException, ServletException {

    String header = httpServletRequest.getHeader("Authorisation");


    if (header == null || !header.startsWith("Token ")) {
        throw new RuntimeException("JWT Token is missing");
    }

    String authenticationToken = header.substring(6);

    JwtAuthenticationToken token = new JwtAuthenticationToken(authenticationToken);
    return getAuthenticationManager().authenticate(token);
}


@Override
protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
    super.successfulAuthentication(request, response, chain, authResult);
    chain.doFilter(request, response);
}
}

//JwtSecurityConfig.java

import java.util.Collections;

@EnableGlobalMethodSecurity(prePostEnabled = true)
@EnableWebSecurity
@Configuration
public class JwtSecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private JwtAuthenticationProvider authenticationProvider;
@Autowired
private JwtAuthenticationEntryPoint entryPoint;

@Bean
public AuthenticationManager authenticationManager() {
    return new ProviderManager(Collections.singletonList(authenticationProvider));
}

@Bean
public JwtAuthenticationTokenFilter authenticationTokenFilter() {
    JwtAuthenticationTokenFilter filter = new JwtAuthenticationTokenFilter();
    filter.setAuthenticationManager(authenticationManager());
    filter.setAuthenticationSuccessHandler(new JwtSuccessHandler());
    return filter;
}


@Override
protected void configure(HttpSecurity http) throws Exception {

    http.csrf().disable().authorizeRequests( ).antMatchers( "/api/preLogin" ).permitAll();
    http.authorizeRequests().antMatchers("**/api/**").authenticated()
            .and()
            .exceptionHandling().authenticationEntryPoint(entryPoint)
            .and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

    http.addFilterBefore(authenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class);
    http.headers().cacheControl();

}

}

但是对于"/api/preLogin"请求，它也显示"JWT令牌丢失".

But for "/api/preLogin" request also it says "JWT Token is missing".

任何帮助将不胜感激，谢谢.

Any help will be appreciated,Thanks in advance..

推荐答案

要从身份验证中跳过某些URL，然后使用第二个安全配置器:

To skip some URLs from authentication then use a second Security Configurer:

@Configuration
@EnableWebSecurity
@Order(1)
public class SecondSecurityConfigurer extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
         http
                .antMatcher("/api/preLogin")
                .antMatcher("/api/otherEndpoint")
                .authorizeRequests()
                .anyRequest().permitAll()
                .and()
                .csrf().disable();
    }
}

这篇关于JWT跳过登录页面的URL的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！