在我的 Spring 应用程序中,我想将一些信息返回给我的 Angular 客户端。首先,我向“/login”发送请求,效果很好。 然后我将 HTTP-post 请求发送到“/user”,它也工作得很好。但第二次调用“/user”会返回 401 异常。
我在 app.module.ts 中也有一个 XhrInterceptor
这是我的安全配置:
@Configuration
@EnableWebSecurity
public class BasicAuthConfiguration extends WebSecurityConfigurerAdapter {
@Bean("authenticationManager")
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Override
public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) {
authenticationManagerBuilder
.authenticationProvider(authenticationProvider());
}
@Bean
public DaoAuthenticationProvider authenticationProvider() {
DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
authProvider.setUserDetailsService(userService);
authProvider.setPasswordEncoder(getPasswordEncoder());
return authProvider;
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
.antMatchers("/login").permitAll()
.anyRequest()
.authenticated()
.and()
.httpBasic();
http.cors();
}
Controller .java
@RestController
@Api(tags = "user")
@CrossOrigin(value = "*", allowedHeaders = {"*"})
public class UserController {
@Resource(name = "authenticationManager")
private AuthenticationManager authManager;
@RequestMapping("/login")
public boolean login(@RequestParam("username") final String username, @RequestParam("password") final String password, final HttpServletRequest request) {
UsernamePasswordAuthenticationToken authReq =
new UsernamePasswordAuthenticationToken(username, password);
Authentication auth = authManager.authenticate(authReq);
SecurityContext sc = SecurityContextHolder.getContext();
sc.setAuthentication(auth);
HttpSession session = request.getSession(true);
session.setAttribute("SPRING_SECURITY_CONTEXT", sc);
return
username.equals("john.doe") && password.equals("passwd");
}
@RequestMapping(value = "/user")
public Principal user(HttpServletRequest request) {
String authToken = request.getHeader("Authorization")
.substring("Basic".length()).trim();
return () -> new String(Base64.getDecoder()
.decode(authToken)).split(":")[0];
}
}
AuthService.ts
@Injectable({
providedIn: 'root'
})
export class AuthService {
constructor(private http: HttpClient, private router: Router) { }
userName: string;
auth() {
const headers = new HttpHeaders({
authorization: 'Basic ' + btoa('john.doe:passwd')
});
let url = 'http://localhost:8080/login';
const formData = new FormData();
formData.append("username", "john.doe")
formData.append("password", "passwd")
this.http.post(url, formData, { headers: headers }).subscribe(isValid => {
if (isValid) {
console.log("isValid", isValid);
sessionStorage.setItem('token', btoa('john.doe:passwd'));
this.router.navigate(['']);
} else {
alert("Authentication failed.")
}
});
}
getUser() {
let url = 'http://localhost:8080/user';
let headers: HttpHeaders = new HttpHeaders({
'Authorization': 'Basic ' + sessionStorage.getItem('token')
});
let options = { headers: headers };
// this.http.post(url, "johndoe").
this.http.get(url, options).
subscribe(principal => {
console.log(principal);
this.userName = principal['name'];
},
error => {
if (error.status == 401)
alert('Unauthorized');
}
);
}
LoginComponent.ts
@Component({
selector: 'app-login',
templateUrl: './login.component.html',
styleUrls: ['./login.component.scss']
})
export class LoginComponent implements OnInit {
constructor(private authService: AuthService, private http: HttpClient,
private router: Router) {}
ngOnInit() {
sessionStorage.setItem('token', '');
this.authService.auth()
}
}
最佳答案
更新 您可以将其添加到您的配置方法中:
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
.antMatchers("/login").permitAll()
.antMatchers("/users").permitAll()
.anyRequest()
.authenticated()
.and()
.httpBasic();
http.cors();
}
您希望 Angular 拦截“/user”URL 吗?如果是这样,你可以配置一个 ViewController 将任何你想要的 URL 重定向到 index.html,这就是 Angular 读取的内容
public void addViewControllers(ViewControllerRegistry registry) {
String forward = "forward:/index.html";
registry.addViewController("/").setViewName(forward);
registry.addViewController("/login").setViewName(forward);
registry.addViewController("/user").setViewName(forward);
}
关于java - 第二个 Controller 方法调用时出现 401 错误,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/55641814/