我正在使用 postman 将用户名和密码没有值(value)发送到我的服务器;这就像 username=null
和 password=null
。
为了控制我的服务器的安全性,我使用 spring security 3.2。当它收到这些凭据时,spring-security 会响应此错误。
Estado HTTP 500 - Fields must not be empty
java.lang.IllegalArgumentException: Cannot pass null or empty values to constructor
org.springframework.security.core.userdetails.User.<init>(User.java:99)
org.springframework.security.core.userdetails.User.<init>(User.java:69)
com.equifax.product.fraud.applicationprocessing.web.rest.interceptors.security.SecurityAuthenticationProvider.retrieveUser(SecurityAuthenticationProvider.java:59)
org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:132)
org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:156)
org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:177)
org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilter(BasicAuthenticationFilter.java:168)
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:344)
org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:261)
我想输出带有错误消息的自定义 JSON,我该怎么做?
这是我的 security.xml:
<security:http create-session="never" use-expressions="true"
auto-config="false">
<security:intercept-url pattern="/application/**"
access="isFullyAuthenticated()" />
<security:anonymous />
<security:http-basic entry-point-ref="securityAccessDeniedEntryPoint" />
<security:access-denied-handler ref="securityAccessDeniedHandler" />
</security:http>
<security:authentication-manager alias="authenticationManager"
erase-credentials="false">
<security:authentication-provider
ref="genericSecurityAuthenticationProvider" />
</security:authentication-manager>
我正在使用 Spring 3.2
最佳答案
您正在传递基本身份验证字符串“:”(在 base64 解码之后),所以正如您所说,这会导致空密码和用户名。 BasicAuthenticationFilter
将这些传递给身份验证提供程序,即 您的自定义代码 ( SecurityAuthenticationProvider
),因此无法准确说出它的作用。在某处,您正在创建 User
具有这些值的实例,这会引发您看到的异常。相反,您应该检查 AuthenticationProvider
中的空值。并抛出 Authenticationexception
.
您还需要覆盖 onUnsuccessfulAuthentication
BasicAuthenticationFilter
中的函数编写您想要的错误响应。您必须将其配置为 custom filter ,而不是使用 <security:http-basic />
元素。
关于spring - spring-security 收到空凭据(用户名和密码)时如何创建自定义响应?,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/30734750/