Java Spring MVC+；跺脚+；WebSocket+；https不作为http工作

我有一个功能，可以在我的应用程序中显示即时通知，就像任何一个用户发送消息一样，我会向其他用户发送通知，就像您收到新消息一样。为此，我使用SpringMVC+Stomp+WebSocket

在我的本地/测试环境中，web套接字帧通过http接收并正常工作。Prod环境位于https上，帧不像http那样接收。因此，通知没有更新

我在websocket响应中观察到一件事：在本地服务器上显示电子邮件时的用户名。在Prod server中显示一些随机长值

Spring版本：4.3.5.发布
弹簧安全性：4.2.1.1释放

WebsocketConfig：

import org.springframework.context.annotation.Configuration;
import org.springframework.messaging.simp.config.MessageBrokerRegistry;
import org.springframework.web.socket.config.annotation.AbstractWebSocketMessageBrokerConfigurer;
import org.springframework.web.socket.config.annotation.EnableWebSocketMessageBroker;
import org.springframework.web.socket.config.annotation.StompEndpointRegistry;

@Configuration
@EnableWebSocketMessageBroker
public class WebSocketConfig extends AbstractWebSocketMessageBrokerConfigurer {

    @Override
    public void configureMessageBroker(MessageBrokerRegistry config) {
        config.enableSimpleBroker("/topic");
        config.setApplicationDestinationPrefixes("/app");
    }

    @Override
    public void registerStompEndpoints(StompEndpointRegistry registry) {
        registry.addEndpoint("/stomp/notify").withSockJS();
    }
}

Web安全配置：

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.encoding.ShaPasswordEncoder;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.session.HttpSessionEventPublisher;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;


@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    AuthenticationService authenticationService;

    @Value("${ssl.enabled:false}")
    private boolean sslEnabled;

    @Autowired
    public void configAuthentication(AuthenticationManagerBuilder auth) throws Exception {
        ShaPasswordEncoder encoder = new ShaPasswordEncoder();
        auth.userDetailsService(authenticationService).passwordEncoder(encoder);
    }

    @Bean
    public HttpSessionEventPublisher httpSessionEventPublisher() {
        return new HttpSessionEventPublisher();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        if (sslEnabled) {
            http.requiresChannel().antMatchers("/").requiresSecure();
        }

        /* authorize requests */
        http.authorizeRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/university-signup").permitAll()
                .antMatchers("/fb1clicksignup").permitAll()
                .antMatchers("/about").permitAll()
                .antMatchers("/media").permitAll()
                .antMatchers("/invite").permitAll()
                .antMatchers("/public").permitAll()
                .antMatchers("/reset-password").permitAll()
                .antMatchers("/email-unsubscribe").permitAll()
                .antMatchers("/email-subscribe").permitAll()
                .antMatchers("/member")
                .access("hasAnyAuthority('USER')")
                .antMatchers("/member/*")
                .access("hasAnyAuthority('USER')")
                .and().exceptionHandling().accessDeniedPage("/");   

        /* login form */
        http.formLogin().loginPage("/")
                .loginProcessingUrl("/login")
                .successHandler(customSuccessHandler())
                .usernameParameter("email").passwordParameter("password")
                .and().csrf();

        /* logout */
        http.logout().deleteCookies("remember_me_chk")
                .invalidateHttpSession(true)
                .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                .logoutSuccessUrl("/");

        /* remember me*/
        http.rememberMe().
                key("ec2Mm2458nestOU812lingpiaza2910").
                rememberMeParameter("remember-me-param").
                rememberMeCookieName("remember_me_chk").
                tokenValiditySeconds(31536000);


        http.sessionManagement().maximumSessions(2); //a user can only have 2 active sessions
        http.sessionManagement().sessionAuthenticationErrorUrl("/"); //kick the user to the homepage if session is not valid
        http.sessionManagement().sessionFixation().migrateSession();
        http.sessionManagement().invalidSessionUrl("/");

    }

    @Bean
    public CustomSuccessHandler customSuccessHandler() {
        return new CustomSuccessHandler();
    }
}

消息发送逻辑：

@Autowired
private SimpMessagingTemplate messageSender;

public void sendNotification() {
     messageSender.convertAndSend("/topic/messages", "Got New Message!");
}

本地/测试服务器请求url:

ws://mydomain.com/stomp/notify/879/z5qcek18/websocket

wss://mydomain.com/stomp/notify/879/z5qcek18/websocket

本地/测试服务器响应帧：

a["CONNECTED\nversion:1.1\nheart-beat:0,0\nuser-name:usertest@mydomain.com\n\n\u0000"]

a["CONNECTED\nversion:1.1\nheart-beat:0,0\nuser-name:110721669125112652938\n\n\u0000"]

产品服务器请求url:

ws://mydomain.com/stomp/notify/879/z5qcek18/websocket

wss://mydomain.com/stomp/notify/879/z5qcek18/websocket

Prod服务器响应帧：

a["CONNECTED\nversion:1.1\nheart-beat:0,0\nuser-name:usertest@mydomain.com\n\n\u0000"]

a["CONNECTED\nversion:1.1\nheart-beat:0,0\nuser-name:110721669125112652938\n\n\u0000"]

---

这是我的错，我的应用程序中有社交网络登录。如果我这样做直接登录电子邮件是可用的。如果我使用社交网络登录，我将无法使用电子邮件。因此，我将spring安全主体用户名设置为oauth令牌。这就是它将响应帧显示为不同的原因。现在，我将emailId设置为spring安全主体用户名，它正在按预期工作