Spring Security WebFlux IP 白名单 [英] Spring Security WebFlux IP Whitelist

问题描述

在利用 WebFlux 的最新 Spring Security 中，安全配置的工作方式如下，

In the latest Spring Security which leverages WebFlux, the security config works like below,

SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
http.authorizeExchange().pathMatchers("/**") ....

之前有个方法hasIpAddress("xxx.xxx.xxx.xxx")可以用来配置IP白名单，现在没有了.

Before there is a method hasIpAddress("xxx.xxx.xxx.xxx") we can use to config IP whitelist, now it's gone.

如何为新的 Spring Security Webflux 指定 IP 白名单?

How to specify IP whitelist for new Spring Security Webflux?

基于下面@özkan pakdil 的想法，这是我的代码，但 IP 过滤器不起作用 - 来自不在白名单中的 IP 的请求仍然可以通过.

Based on idea from @özkan pakdil below, here is my code, but IP filter does not work - The request from IP which is not on whitelist still can go through.

private Mono<AuthorizationDecision> isAuthorizedIP(Mono<Authentication> authentication, AuthorizationContext context) {
    String ip = context.getExchange().getRequest().getRemoteAddress().getAddress().toString().replace("/", "");

    return authentication.map((a) -> new AuthorizationDecision(
                                        ipWhiteList.contains(ip)));     
}

SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) 抛出异常 {

SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) throws Exception {

http.authorizeExchange().anyExchange().access(this::isAuthorizedIP).and().oauth2Login();

http.authorizeExchange().anyExchange().access(this::isAuthorizedIP).and().oauth2Login();

返回http.build();

return http.build();

}

推荐答案

我花了一段时间才弄明白，但最终我找到了它的工作方式.请检查 https://github.com/ozkanpakdil/spring-examples/tree/master/webflux-ip-whitelist 并告诉我这是否有帮助.

Took me a while to figure out but finally I found a way it works. please check https://github.com/ozkanpakdil/spring-examples/tree/master/webflux-ip-whitelist and tell me if that not helps.

你可以像这样定义 WebSecurityConfig

simply you can define WebSecurityConfig like this

import org.springframework.context.annotation.Bean;
import org.springframework.security.authorization.AuthorizationDecision;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.server.SecurityWebFilterChain;
import org.springframework.security.web.server.authorization.AuthorizationContext;
import reactor.core.publisher.Mono;

import java.util.ArrayList;

@EnableWebFluxSecurity
public class WebSecurityConfig {

    ArrayList<String> whiteListIp = new ArrayList();

    public WebSecurityConfig() {
        whiteListIp.add("0:0:0:0:0:0:0:1");
        whiteListIp.add("192.168.1.1");
        whiteListIp.add("127.0.0.1");
    }

    @Bean
    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        http
                .authorizeExchange()
                .anyExchange()
                .access(this::whiteListIp)
                .and()
                .httpBasic();

        return http.build();
    }

    private Mono<AuthorizationDecision> whiteListIp(Mono<Authentication> authentication, AuthorizationContext context) {
        String ip = context.getExchange().getRequest().getRemoteAddress().getAddress().toString().replace("/", "");
        return authentication.map((a) -> new AuthorizationDecision(a.isAuthenticated()))
                .defaultIfEmpty(new AuthorizationDecision(
                        (whiteListIp.contains(ip)) ? true : false
                ));
    }

}

并将您的 IP 列入白名单.

and have your ip white listed.

这篇关于Spring Security WebFlux IP 白名单的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！