在自定义AuthenticationProvider中访问HttpServletRequest

Question

如何在自定义AuthenticationProvider中访问HttpServletRequest.我试过这样做

RequestAttributes requestAttributes = RequestContextHolder.getRequestAttributes();

HttpServletRequest request = ((ServletRequestAttributes) requestAttributes).getRequest();
String username = (String) httpReq.getAttribute("j_username");

要么

RequestAttributes requestAttributes = RequestContextHolder.getRequestAttributes();
HttpServletRequest httpReq = ((ServletRequestAttributes)RequestContextHolder.currentRequestAttributes()).getRequest();

String username = (String) httpReq.getAttribute("j_username");

我得到的用户名为null

但是RequestContextHolder.getRequestAttributes(); 返回null.

我想引用requestcontext,传入它,或让Spring做它的魔术,所以我可以引用它.

我也在我的web.xml中提供RequestContextListener

  <listener>
    <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
  </listener>

我搜索过安全论坛,但还没找到任何东西.

提前致谢.

Answer 1

我刚刚将监听器添加到我的web.xml中,RequestContextHolder.getRequestAttributes()返回RequestAttributes而不是null.

<listener>
  <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
</listener>

如果要自定义登录表单,为什么不扩展此过滤器:org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter