在Spring Security中更改登录服务URL

  • Z时代
  • 2024-01-10
  • 分类：问答

嗨，我已经在我的Spring Boot Web应用程序中使用JWT过滤器实现了Spring安全性。但是默认身份验证发生在url

http://localhost:8080/login。如何更改/login为我需要的某些网址/rest/auth/login？

我的WebSecurity课是

@EnableWebSecurity
public class WebSecurity extends WebSecurityConfigurerAdapter {
@Autowired
private UserDetailsService userDetailsService;
@Autowired
private BCryptPasswordEncoder bCryptPasswordEncoder;
public WebSecurity( UserDetailsService userDetailsService, BCryptPasswordEncoder bCryptPasswordEncoder )
{
    this.userDetailsService = userDetailsService;
    this.bCryptPasswordEncoder = bCryptPasswordEncoder;
}
@Override
protected void configure( HttpSecurity http ) throws Exception
{
    http.cors().and().csrf().disable().authorizeRequests().antMatchers(HttpMethod.POST, "/rest/auth/**").permitAll()
            .antMatchers("/static/*").permitAll().antMatchers("/").permitAll()
            /* .anyRequest().authenticated() */.and()
            .addFilter(new JWTAuthenticationFilter(authenticationManager()))
            .addFilter(new JWTAuthorizationFilter(authenticationManager()));
}
@Override
public void configure( AuthenticationManagerBuilder auth ) throws Exception
{
    auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder);
}
@Override
public void configure( org.springframework.security.config.annotation.web.builders.WebSecurity web )
        throws Exception
{
    web.ignoring().antMatchers("/static/**");
}
@Bean
CorsConfigurationSource corsConfigurationSource()
{
    final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", new CorsConfiguration().applyPermitDefaultValues());
    return source;
}
}

我在静态目录下的资源文件夹中有一个登录页面。Spring安全性的工作方式是，当用户从表单发送userName和password从表单发送时，客户端必须将这些凭据发送到/login服务器中的路径，以便Spring

Security验证那些凭据并创建令牌。但是我想将默认路径更改/login为/rest/auth/login

回答：

您需要调整WebSecurityConfig.java和JWTAuthenticationFilter。

@Override
protected void configure( HttpSecurity http ) throws Exception
{
    http.csrf().disable()
            .authorizeRequests()
            .antMatchers("/rest/noauth/**").permitAll()
            .antMatchers("/rest/login").permitAll()
            .antMatchers("/rest/logout").permitAll()
            .antMatchers("/src/**").permitAll()
            .antMatchers("/v2/api-docs/**", "/configuration/ui/**", "/swagger-resources/**",
                    "/configuration/security/**", "/swagger-ui.html/**", "/webjars/**")
            .permitAll()
            .anyRequest().authenticated()
            .and()
            .logout().addLogoutHandler(logoutHandler).logoutSuccessHandler(logoutSuccessHandler)
            .logoutUrl("/rest/logout")
            .and()
            .addFilterBefore(
                    new JWTAuthenticationFilter("/rest/login",
                    UsernamePasswordAuthenticationFilter.class)
            .addFilterBefore(new JWTAuthorizationFilter(authenticationManager(), authTokenModelRepository),
                    UsernamePasswordAuthenticationFilter.class);
    http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}

并进行JWTAuthenticationFilter扩展AbstractAuthenticationProcessingFilter，使其具有一个构造函数，该构造函数采用filterProcessingURl和我/rest/login作为参数传递。

public class JWTAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
private static final Logger LOGGER = LoggerFactory.getLogger(JWTAuthenticationFilter.class);
private AuthenticationManager authenticationManager;
private TokenService tokenService;
private UserModel credentials;
private RefreshTokenService refreshTokenService;
private AuthTokenModelRepository authTokenModelRepository;
private UserModelRepository userModelRepository;
public JWTAuthenticationFilter( String loginUrl, AuthenticationManager authenticationManager,
        TokenService tokenService, RefreshTokenService refreshTokenService,
        AuthTokenModelRepository authTokenModelRepository, UserModelRepository userModelRepository )
{
    super(new AntPathRequestMatcher(loginUrl));
}

完成上述配置后，JWTAuthenticationFilter将对request执行/rest/login。

以上是 在Spring Security中更改登录服务URL 的全部内容， 来源链接： utcz.com/qa/435537.html

回到顶部