Spring security 用于基本身份验证请求的SESSIONID注入

我有一个基于Spring云的微服务应用程序。在所有这些服务之前，我还有一个API网关

我需要支持两种类型的客户端

其中一个可以使用授权令牌调用我的应用程序（例如，通过调用/授权）。令牌基本上是会话ID。所有服务器都使用Spring会话Redis共享会话

第二个客户端只能向我发送http基本身份验证（用户：pass as authorization header）

对于第二个客户端，我需要检查用户是否已经通过身份验证，并且在redis中是否有活动会话。我在我的安全配置中的BasicAuthenticationFilter之前添加了filter来检查这一点

如果用户有一个活动会话，我将SESSIONID放入头中，并从请求中删除授权头（为此我使用了一个定制的HttpServletRequest包装器）。我的目的是，从那时起，Spring将在下游微服务中管理请求，就像它是通过SESSIONID发送的一样。这样做的原因是为了避免很长的登录时间（超过1秒）

我的问题是：当spring检查SESSIONID是否存在时，它会检查没有SESSIONID的原始请求

安全配置：

@Resource
    @Qualifier("sessions")
    private Map<String, String> sessions;

    @Autowired
    @Qualifier("httpSessionStrategy")
    HttpSessionStrategy sessionStrategy;

@Override
protected void configure(HttpSecurity http) throws Exception {
    //      // @formatter:off

    http
    .addFilterBefore(setSessionIdInHeader(), BasicAuthenticationFilter.class)
    .sessionManagement()
    .and()
    .exceptionHandling()
    .authenticationEntryPoint(restEntryPoint())
    .and()
    .headers().addHeaderWriter(new StaticHeadersWriter("Server",""))
    .and()
    .httpBasic()
    .authenticationEntryPoint(restEntryPoint())
    .and()  
    .logout().addLogoutHandler(clearTicketOnLogoutHandler())
    .logoutSuccessHandler(logoutSuccessHandler())
    .and()
    .authorizeRequests()
    .antMatchers("/index.html", "/login", "/").permitAll()
    .antMatchers(HttpMethod.OPTIONS).denyAll()
    .antMatchers(HttpMethod.HEAD).denyAll()  
    .anyRequest().authenticated()
    .and()
    .authenticationProvider(authenticationProvider)
    .csrf()
    .disable()
    .addFilterAfter(ticketValidationFilter(), SessionManagementFilter.class)
    .addFilterAfter(changePasswordFilter(), SessionManagementFilter.class)  
    .addFilterAfter(httpPolutionFilter(), SessionManagementFilter.class)
    .addFilterAfter(saveSessionId(), SessionManagementFilter.class);

    // @formatter:on
}

更改SESSIONID的标头名称：

@Bean
    public HeaderHttpSessionStrategy httpSessionStrategy(){
        HeaderHttpSessionStrategy headerHttpSessionStrategy = new HeaderHttpSessionStrategy();
        headerHttpSessionStrategy.setHeaderName("TOKEN");
        return headerHttpSessionStrategy;
    }



private Filter saveSessionId() {
        return new OncePerRequestFilter() {         
            @Override
            protected void doFilterInternal(HttpServletRequest request,
                    HttpServletResponse response, FilterChain filterChain)
                            throws ServletException, IOException {
                if(request.getHeader("authorization") != null){
                    sessions.put(request.getHeader("authorization"), request.getSession().getId());
                }else{
                    sessions.put(request.getHeader("mock_authorization"), request.getSession().getId());
                }

            }
        };
    }

@Bean
    public HeaderHttpSessionStrategy httpSessionStrategy(){
        HeaderHttpSessionStrategy headerHttpSessionStrategy = new HeaderHttpSessionStrategy();
        headerHttpSessionStrategy.setHeaderName("TOKEN");
        return headerHttpSessionStrategy;
    }



private Filter saveSessionId() {
        return new OncePerRequestFilter() {         
            @Override
            protected void doFilterInternal(HttpServletRequest request,
                    HttpServletResponse response, FilterChain filterChain)
                            throws ServletException, IOException {
                if(request.getHeader("authorization") != null){
                    sessions.put(request.getHeader("authorization"), request.getSession().getId());
                }else{
                    sessions.put(request.getHeader("mock_authorization"), request.getSession().getId());
                }

            }
        };
    }