相关疑难解决方法(0)

我试图在春季添加网络安全性,但我不希望过滤器适用于某些事情.怎么在java中完成？

也许还有更好的方法,因为我创建了一个自定义过滤器,但这是我认为实例化它的唯一方法,因为它的依赖性.

总的来说,我想做的是:

/resources/**不应该通过过滤器, /login(POST)不应该通过过滤器,其他一切都应该通过过滤器

通过我在春天发现的各种例子我能够想出一个开始,但它显然不起作用:

@Configuration
@EnableWebSecurity
@Import(MyAppConfig.class)
public class MySecurityConfig extends WebSecurityConfigurerAdapter
{
    @Override
    public void configure(WebSecurity webSecurity) throws Exception
    {
        webSecurity.ignoring().antMatchers("/resources/**");
    }

    @Override
    public void configure(HttpSecurity httpSecurity) throws Exception
    {
        httpSecurity
                .authorizeRequests()
                .antMatchers("/resources/**").permitAll()
                .antMatchers("/login").permitAll();

        httpSecurity.httpBasic();
        httpSecurity.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }

    @Bean
    @Autowired
    public TokenFilterSecurityInterceptor<TokenInfo> tokenInfoTokenFilterSecurityInterceptor(MyTokenUserInfoCache userInfoCache, ServerStatusService serverStatusService, HttpSecurity httpSecurity) throws Exception
    {
        TokenService<TokenInfo> tokenService = new TokenServiceImpl(userInfoCache);
        TokenFilterSecurityInterceptor<TokenInfo> tokenFilter = new TokenFilterSecurityInterceptor<TokenInfo>(tokenService, serverStatusService, "RUN_ROLE");
        httpSecurity.addFilter(tokenFilter);
        return tokenFilter;
    }
}

我想@Autowire用一个Filter.所以我在SecurityConfig下面定义我的过滤器:

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        http.addFilterBefore(getA(), BasicAuthenticationFilter.class);
        http.csrf().disable();
    }

    @Bean
    public A getA(){
        return new A();
    }

这个过滤器A扩展了Spring的GenericFilterBean.

当我调用控制器时,我得到低于输出,这显示过滤器命中两次.

filter A before
filter A before
mycontroller invoke
filter A after
filter A after

我的观察是,这个额外的调用使用Spring容器调用,因为如果filter没有注册为bean,它只会被命中一次.是什么原因,我该如何解决？

我正在使用Spring-Security 3.2.4和Spring Boot 1.1.0(以及相关的依赖版本4.X).我正在编写一个将在嵌入式tomcat中运行的Web应用程序.

我正在尝试添加两个额外的过滤器(与Spring安全无关),其中一个将在Spring-Security-FilterChainProxy之前调用,另一个将在Spring-Security-FilterChainProxy之后调用.

我的Spring-Security配置文件:

@Configuration
@EnableWebMvcSecurity
public class SecurityCtxConfig extends WebSecurityConfigurerAdapter {

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth
    .inMemoryAuthentication()
        .withUser("user").password("pass").roles("USER");
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.csrf()
            .disable()
            .authorizeRequests()
            .anyRequest()
            .authenticated()
            .and()
            .formLogin()
            .usernameParameter("user").passwordParameter("password");
}
}

和Main类(Application.class):

@Configuration
@ComponentScan
@EnableAutoConfiguration
public class Application {

    @Bean
RequestFilter beforeSpringSecurityFilter(){
    return new RequestFilter();
}

@Bean
RequestFilter afterSpringSecurityFilter(){
    return new RequestFilter();
}

    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }
}

和Filter实现:

public class RequestFilter …