<分区>
我是 spring boot 的新手，我正在尝试在我的 spring boot 应用程序中使用 spring security 实现身份验证过滤器，但我不明白为什么在 tokenService 属性中使用 @autowired 注释时它为空，有人可以解释一下吗对我来说为什么会这样？ java 代码中的正确配置是什么(我没有使用 xml 文件)，以便 spring tokenService 属性不为空。 接下来我将向您展示感兴趣的类:
public class JWTAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
public static final String TOKEN_PREFIX = "Bearer ";
public static final String HEADER_STRING = "Authorization";
private AuthenticationManager authenticationManager;
@Autowired
private TokenService tokenService;//this is null
public JWTAuthenticationFilter(AuthenticationManager authenticationManager) {
this.authenticationManager = authenticationManager;
}
@Override
public Authentication attemptAuthentication(HttpServletRequest req,
HttpServletResponse res) throws AuthenticationException {
try {
LoginDto creds = new ObjectMapper()
.readValue(req.getInputStream(), LoginDto.class);
return authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(
creds.getEmail(),
creds.getPassword(),
new ArrayList<>())
);
} catch (IOException e) {
throw new RuntimeException(e);
}
}
@Override
protected void successfulAuthentication(HttpServletRequest req,
HttpServletResponse res,
FilterChain chain,
Authentication auth) throws IOException, ServletException {
String token=tokenService.createAuthenticationToken(auth);//nullpointer exception here!
long expirationTime=tokenService.getExpirationTime(token);
res.addHeader("Access-Control-Expose-Headers", "Authorization");
res.addHeader(HEADER_STRING, TOKEN_PREFIX + token);
res.setHeader("Content-Type", "application/json");
res.getWriter().print("{\"expiresIn\": "+expirationTime+"}");}}
这是我的 TokenService 类:
@Component
public class TokenService implements Serializable {
private static final long serialVersionUID = 1L;
long expirationTime = new Long(86400000); // 1 day
public static final String SECRET = "SecretKeyToGenJWTs";
public static final long EXPIRATION_TIME = 86_400_000; // 1 day
public static final String TOKEN_PREFIX = "Bearer ";
public static final String HEADER_STRING = "Authorization";
@Autowired
private UserService userService;
@Autowired
private ProviderService providerService;
public TokenService() {
}
public String createAuthenticationToken(Authentication auth) {
String token = Jwts.builder().setSubject(((User) auth.getPrincipal()).getUsername()).setIssuedAt(new Date())
.setExpiration(new Date(System.currentTimeMillis() + expirationTime))
.signWith(SignatureAlgorithm.HS512, SECRET.getBytes()).compact();
return token;
}
public long getExpirationTime(String token) {
Claims claims = Jwts.parser().setSigningKey(SECRET.getBytes()).parseClaimsJws(token).getBody();
Integer intDate = (Integer) claims.get("exp");
long tokenDate = (intDate.longValue() * 1000);
return tokenDate;
}
public String getSubjectFromAuthorizationToken(String token) {
String subject = Jwts.parser().setSigningKey(SECRET.getBytes()).parseClaimsJws(token.replace(TOKEN_PREFIX, ""))
.getBody().getSubject();
return subject;
}
}
这是我的配置类:
@Configuration
@EnableWebSecurity
@ComponentScan({"com.espiritware.opusclick.security"})
public class WebSecurity extends WebSecurityConfigurerAdapter {
public static final String USER_REGISTRATION_URL = "/v1/users/registration";
public static final String PROVIDER_REGISTRATION_URL = "/v1/providers/registration";
public static final String CONFIRM_REGISTRATION_URL = "/v1/registrationConfirm";
public static final String SEND_RESET_PASSWORD_EMAIL = "/v1/sendResetPasswordEmail";
public static final String RESET_PASSWORD = "/v1/resetPassword";
public static final String LOGIN = "/v1/login";
private UserDetailsService userDetailsService;
private BCryptPasswordEncoder bCryptPasswordEncoder;
public WebSecurity(UserDetailsService userDetailsService, BCryptPasswordEncoder bCryptPasswordEncoder) {
this.userDetailsService = userDetailsService;
this.bCryptPasswordEncoder = bCryptPasswordEncoder;
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.cors().and().csrf().disable()
.authorizeRequests().antMatchers(HttpMethod.POST, USER_REGISTRATION_URL).permitAll()
.antMatchers(HttpMethod.POST, PROVIDER_REGISTRATION_URL).permitAll()
.antMatchers(HttpMethod.GET, CONFIRM_REGISTRATION_URL).permitAll()
.antMatchers(HttpMethod.POST, SEND_RESET_PASSWORD_EMAIL).permitAll()
.antMatchers(HttpMethod.POST, RESET_PASSWORD).permitAll()
.anyRequest().authenticated().and()
.addFilter(new JWTAuthenticationFilter(authenticationManager()))
.addFilter(new JWTAuthorizationFilter(authenticationManager()))
// this disables session creation on Spring Security
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
@Override
public void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder);
}
@Bean
CorsConfigurationSource corsConfigurationSource() {
final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", new CorsConfiguration().applyPermitDefaultValues());
return source;
}
谢谢!