Spring安全休息令牌身份驗證 - 篩選器不運行

Question

我正在構建一個使用Spring 4和java configs（沒有任何xml文件）的REST應用程序。

這裏是一些實際的代碼：

public class WebAppInitializer extends AbstractAnnotationConfigDispatcherServletInitializer { 

    @Override 
    protected String[] getServletMappings() { 
     return new String[]{"/"}; 
    } 

    @Override 
    protected Class<?>[] getRootConfigClasses() { 
     return new Class<?>[] {ApplicationConfig.class}; 
    } 

    @Override 
    protected Class<?>[] getServletConfigClasses() { 
     return null; 
    } 
} 

除此之外，我保證與令牌認證WebService的，所以我有一個過濾器來處理令牌，妥善他的令牌獲取用戶，並把用戶對象進入SecuriryContext。這裏是Filter的一些代碼：

@Component 
public class AuthenticationTokenFilter extends UsernamePasswordAuthenticationFilter { 

private String tokenHeader = "X-Auth-Token"; 

@Autowired 
private TokenUtils tokenUtils; 

@Autowired 
private UserDetailsService userDetailsService; 

@Override 
@Autowired 
public void setAuthenticationManager(AuthenticationManager authenticationManager) { 
    super.setAuthenticationManager(authenticationManager); 
} 

@Override 
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { 

    HttpServletRequest httpRequest = (HttpServletRequest) request; 
    String authToken = httpRequest.getHeader(this.tokenHeader); 
    String username = this.tokenUtils.getUsernameFromToken(authToken); 

    if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) { 
     UserDetails userDetails = this.userDetailsService.loadUserByUsername(username); 
     if (this.tokenUtils.validateToken(authToken, userDetails)) { 
      UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities()); 
      authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(httpRequest)); 
      SecurityContextHolder.getContext().setAuthentication(authentication); 
     } 
    } 

    chain.doFilter(request, response); 
} 

} 

我使用Spring Security的，這裏是我WebSecurityConfigurerAdapter

@Configuration 
@EnableWebSecurity 
@EnableGlobalMethodSecurity(prePostEnabled = true) 
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter { 

    @Autowired 
    private EntryPointUnauthorizedHandler unauthorizedHandler; 

    @Autowired 
    private AuthenticationTokenFilter authTokenFilter; 


    @Bean 
    public PasswordEncoder passwordEncoder() { 
    return new BCryptPasswordEncoder(); 
    } 

    @Bean 
    @Override 
    public AuthenticationManager authenticationManagerBean() throws Exception { 
    return super.authenticationManagerBean(); 
    } 


    @Override 
    protected void configure(HttpSecurity httpSecurity) throws Exception { 
    httpSecurity 
     .csrf() 
     .disable() 
     .exceptionHandling() 
     .authenticationEntryPoint(this.unauthorizedHandler) 
     .and() 
     .sessionManagement() 
     .sessionCreationPolicy(SessionCreationPolicy.STATELESS) 
     .and() 
     .authorizeRequests() 
     .antMatchers(HttpMethod.OPTIONS, "/**").permitAll() 
     .antMatchers("/auth/**").permitAll()  
     .anyRequest().authenticated(); 

     httpSecurity 
     .addFilterBefore(authTokenFilter, UsernamePasswordAuthenticationFilter.class); 
    } 

} 

我的問題是，過濾器的doFilter()不運行。任何幫助？注意：使用SpringBoot不是一個選項。我想這樣做，而不使用彈簧引導自動配置。

Answer 1

您不是將組件添加到篩選器中，而是將其作爲一個簡單的對象進行創建，該對象是通過ServletContext中某處的反射創建的，該對象對Spring一無所知。 您可以添加過濾器，安全配置SpringSecurityFilterChain如果你使用Spring Security

@EnableWebSecurity 
@Configuration 
public class SecurityConfig extends WebSecurityConfigurerAdapter { 

    @Autowired 
    private YourFilter yourFilter; 

    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http 
      .addFilterBefore(yourFilter, UsernamePasswordAuthenticationFilter.class); 
    } 
}