java - Spring 安全 : AuthenticationProcessingFilter is called twice

Question

我尝试在 RESTful 应用程序中通过 token 授权配置 Spring Security。

我的 AuthenticationFilter 看起来像:

@Configurable

public class CustomTokenAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

    private static final Logger logger = LoggerFactory.getLogger(CustomTokenAuthenticationFilter.class);

    private final static String SECRET_KEY = "ThisIsASecretKey";
    public final String HEADER_SECURITY_TOKEN = "X-Token";

    @Inject
    private Users usres;

    public CustomTokenAuthenticationFilter(String defaultFilterProcessesUrl) {
        super(defaultFilterProcessesUrl);
        super.setRequiresAuthenticationRequestMatcher(new AntPathRequestMatcher(defaultFilterProcessesUrl));
        setAuthenticationManager(new NoOpAuthenticationManager());
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws IOException,
            ServletException {
        String token = request.getHeader(HEADER_SECURITY_TOKEN);

        logger.info("token found:" + token);
        TokenInfo tokenInfo = new TokenInfo(token, SECRET_KEY);

        AbstractAuthenticationToken userAuthenticationToken;
        try {
            userAuthenticationToken = authUserByToken(tokenInfo);
            if (userAuthenticationToken == null)
                throw new AuthenticationServiceException(MessageFormat.format("Error | {0}", "Bad Token"));

            return userAuthenticationToken;
        } catch (ParseException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
        return null;
    }

    private AbstractAuthenticationToken authUserByToken(TokenInfo token) throws ParseException {
        if (token == null) {
            return null;
        }
        UserInfo userInfo = usres.findUser(token.getUsername());
        ModelMapper mapper = new ModelMapper();
        mapper.getConfiguration().setProvider(new UserProvider());

        User userDetails = mapper.map(userInfo, User.class);
        AbstractAuthenticationToken authToken = new AuthenticationToken(userDetails);

        try {
            return authToken;
        } catch (Exception e) {
            logger.error("Authenticate user by token error: ", e);
        }
        return authToken;
    }

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {

        setAuthenticationSuccessHandler(new SimpleUrlAuthenticationSuccessHandler() {
            @Override
            public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication)
                    throws IOException, ServletException {
                chain.doFilter(request, response);
            }
        });
        super.doFilter(req, res, chain);
    }

}

和 Spring Security 配置:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Inject
    AuthenticationManager authenticationManager;

    @Bean
    protected AbstractAuthenticationProcessingFilter getTokenAuthFilter() throws Exception {
        CustomTokenAuthenticationFilter tapf = new CustomTokenAuthenticationFilter("/api/secure-module/admin/**");
        tapf.setAuthenticationManager(authenticationManager);
        return tapf;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);

        http.csrf().disable().addFilterBefore(getTokenAuthFilter(), AnonymousAuthenticationFilter.class).exceptionHandling()
                .authenticationEntryPoint(new RestAuthenticationEntryPoint());

    }

}

它工作正常，但 CustomTokenAuthenticationFilter 被调用了两次，我不知道为什么。有什么想法吗？

Answer 1

我发现了问题，是 getTokenAuthFilter 方法中的 @Bean 注解。然后我在链中有 2 个注册过滤器(additionalFilters，originalChain)。