HttpServletRequest为JWT使用null时，标头适用于邮递员，但不适用于本地主机

Question

我在前端使用React，在后端使用Java spring boot。在使用Bcrypt编码密码之前，我的api工作正常，但是现在似乎每个响应调用为null的api调用之前内部过滤器都有问题...

这是我的WebSecurityConfig.java

@EnableWebSecurity
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
        @Autowired
        private UserDetailsService myUserDetailsService;
        @Autowired
        private JwtRequestFilter jwtRequestFilter;

        @Autowired
        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            auth.userDetailsService(myUserDetailsService).passwordEncoder(passwordEncode());
        }

        @Bean
        public PasswordEncoder passwordEncode(){
            return new BCryptPasswordEncoder();
        }

        @Override
        @Bean
        public AuthenticationManager authenticationManagerBean() throws Exception {
            return super.authenticationManagerBean();
        }

        @Override
        protected void configure(HttpSecurity httpSecurity) throws Exception {
            httpSecurity.csrf().disable()
                    .authorizeRequests().antMatchers("/authenticate").permitAll()
                    .antMatchers("/personInfo").permitAll()
                    .antMatchers("/signup").permitAll().
                            anyRequest().authenticated().and().
            addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class).exceptionHandling();

        }

    }

这是我的JWTRequestFilter.java

我以为这可能与passwordEncoder（）有关，因为当我不使用BcryptPasswordEncoder（）时，我的电话正在工作...

@Component
public class JwtRequestFilter extends OncePerRequestFilter {

    @Autowired
    private MyUserDetailsService userDetailsService;

    @Autowired
    private JwtUtil jwtUtil;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException {

        if(request == null){
            System.out.println("request is null");
        }

        final String authorizationHeader = request.getHeader("Authorization");

        String username = null;
        String jwt = null;

        if (authorizationHeader != null && authorizationHeader.startsWith("Bearer ")) {
            jwt = authorizationHeader.substring(7);
            username = jwtUtil.extractUsername(jwt);
        }

        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {

            UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);

            if (jwtUtil.validateToken(jwt, userDetails)) {

                UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(
                        userDetails, null, userDetails.getAuthorities());
                usernamePasswordAuthenticationToken
                        .setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
            }
        }
        chain.doFilter(request, response);
    }

}

我在前端使用React并在用axios打电话

async totals(){
        console.log('Bearer ', localStorage.getItem('id_token'));
        let data = await axios.get("http://localhost:8080/totals", {
            headers: {
                'Content-Type': 'application/json',
                'Authorization': 'Bearer ' + localStorage.getItem('id_token')
            }
        })
            .then(this._checkStatus);

        return data.request.response;
    }

当我在邮递员中使用令牌时，api起作用，因此问题出在初始请求和过滤器之间...

我得到的错误是-从起点“ http://localhost:8080/totals”开始在“ http://localhost:3000”对XMLHttpRequest的访问已被CORS策略阻止：对预检请求的响应未通过访问控制检查：它没有HTTP正常状态。

感谢您的时间：）

Answer 1

[如果有人遇到相同的问题，我可以通过在WebSecurityConfig.java中的configure（HttpSecurity httpSecurity）方法的末尾添加此行来解决此问题

httpSecurity.cors（）;

：）