Java MemberMeAuthenticationFilter的Spring Security authenticationSuccessHandler
我想为我的登录过滤器实现一个自定义的Java MemberMeAuthenticationFilter的Spring Security authenticationSuccessHandler,java,spring,spring-mvc,spring-security,Java,Spring,Spring Mvc,Spring Security,我想为我的登录过滤器实现一个自定义的AuthenticationSuccessHandler,它是org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter 这是我的spring安全配置 <?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.or
AuthenticationSuccessHandler
,它是org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter
这是我的spring安全配置
<?xml version="1.0" encoding="UTF-8"?>
<beans
xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:security="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd">
<security:http entry-point-ref="restAuthenticationEntryPoint" disable-url-rewriting = "true" auto-config="true" use-expressions="true">
<security:intercept-url pattern="/api/*" access="hasRole('AUTHENTICATED_USER')"/>
<security:remember-me key="spring_login_detail" services-ref="rememberMeServices"/>
<security:form-login login-processing-url="/login"/>
<security:logout
invalidate-session="true"
delete-cookies="JSESSIONID,SPRING_SECURITY_REMEMBER_ME_COOKIE"
logout-url="/logout"
/>
</security:http>
<security:global-method-security secured-annotations="enabled" pre-post-annotations="enabled"/>
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider ref="rememberMeAuthenticationProvider"/>
<security:authentication-provider user-service-ref="customUserDetailsService">
<security:password-encoder ref="passwordEncoder"/>
</security:authentication-provider>
</security:authentication-manager>
<bean class="org.springframework.security.authentication.encoding.Md5PasswordEncoder" id="passwordEncoder"/>
<bean id="mySuccessHandler" class="com.projectname.security.CustomSavedRequestAwareAuthenticationSuccessHandler"/>
<bean id="customUserDetailsService" class="com.projectname.security.CustomUserDetailsService"/>
<bean id="rememberMeServices" class="org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices">
<property name="key" value="jsfspring-sec" />
<property name="userDetailsService" ref="customUserDetailsService" />
<property name="alwaysRemember" value="false" />
<property name="tokenValiditySeconds" value="1209600" />
<property name="parameter" value="_spring_security_remember_me_input"/>
</bean>
<bean id="rememberMeAuthenticationProvider" class="org.springframework.security.authentication.RememberMeAuthenticationProvider">
<property name="key" value="spring_login_detail"/>
</bean>
<bean id="rememberMeFilter" class="org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter">
<property name="rememberMeServices" ref="rememberMeServices"/>
<property name="authenticationManager" ref="authenticationManager" />
<property name="authenticationSuccessHandler" ref="mySuccessHandler"/>
</bean>
</beans>
问题是在成功的身份验证之后,根本不会调用
onAuthenticationSuccess
。我读过一篇关于StackOverflow的回答,其中说我需要在AuthenticationSuccess上实现,而不是SimpleRuThenticationSuccessHandler
。我试过了,但还是没用。其他一切都很好,唯一的问题是每次我登录时,spring都会将我重定向到“/”
。这不是我想要的,我只想让它返回'200 OK'
假设我理解正确,您希望在身份验证成功时断开筛选器链并发送HTTP响应代码,无论身份验证如何发生;i、 它可以是登录表单或记忆我身份验证
因此,首先,将以下逻辑添加到您的CustomSavedRequestAwareAuthenticationSuccessHandler
:
// place where applicable
if (authentication != null) {
response.setStatus(HttpServletResponse.SC_OK);
}
其次,定义一个新过滤器,例如:
class HttpResponseAuthenticationFilter extends RememberMeAuthenticationFilter {
protected void onSuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, Authentication authResult) {
super.onSuccessfulAuthentication(request, response, authResult);
if (authResult != null) {
response.setStatus(HttpServletResponse.SC_OK);
}
}
}
第三,将security:http
部分中的客户文件管理器定义为:
<custom-filter position="LAST" ref="myHttpResponseAuthFilter" />
因为表单身份验证中缺少此项
此外,根据有关过滤器位置的文档,建议不要对自定义过滤器使用auto-config
注意:
您看到这种行为的原因是,当您看到登录表单时,它与“记住我”服务无关。表单处理决定了最终的目标URL
在第一次之后,将是memberme过滤器进行身份验证,并且再次需要发送HTTP响应代码
我还建议您阅读,因为它可以让您更深入地了解Spring Security中表单登录、http基本身份验证和记住我服务之间的区别。谢谢您的回答。现在它不再重定向页面。“response.setStatus(HttpServletResponse.SC_OK);”每次登录时都会执行,但之后没有响应。而HttpResponseAuthenticationFilter上的成功身份验证方法从未调用。你知道问题是什么吗?试着使用,看看它是如何给出HTTP响应的。基本上,尝试类似cURL的方法,观察HTTP响应头和内容。它返回200,这正是我想要的。但当我把它改成其他代码时,它仍然返回200。这是怎么回事?我猜可能HttpAuthenticationFilter
应该扩展UsernamePasswordAuthenticationFilter
而不是rememberauthenticationfilter
,因为第二个应该在请求中找到身份验证后立即更改响应代码。还要注意,successfulAuthentication
有两种风格,其中一种允许您修改FilterChain
。好的,我将删除将HttpServletResponse.SC\u OK放入响应中的条件。因为它什么都不做。再次感谢你的回答。
<custom-filter position="LAST" ref="myHttpResponseAuthFilter" />
<form-login ... authentication-success-handler-ref="mySuccessHandler" ... />