是否存在被春天的OAuth2，做一个cookie的创建与不透明或JWT令牌所提供的任何配置？我已经在互联网上找到的配置到目前为止描述授权服务器的创建和它的客户端。在我的情况下，客户是与角4应用坐在它上面在同部署的网关。前端发出请求到网关的路由他们通过Zuul。配置使用@EnableOAuth2Sso，一个application.yml客户端和WebSecurityConfigurerAdapter使所有必要的请求和重定向，将信息添加到SecurityContext中，但存储的会话的信息，发回一个JSESSIONID cookie发送到UI。
是否有创建令牌信息的cookie，然后用那些我可以使用无状态会话所需的任何配置或过滤器？还是我来创建它自己，然后创建一个过滤器，以查找令牌？
@SpringBootApplication
@EnableOAuth2Sso
@RestController
public class ClientApplication extends WebSecurityConfigurerAdapter{
@RequestMapping("/user")
public String home(Principal user) {
return "Hello " + user.getName();
}
public static void main(String[] args) {
new SpringApplicationBuilder(ClientApplication.class).run(args);
}
@Override
public void configure(HttpSecurity http) throws Exception {
http
.antMatcher("/**").authorizeRequests()
.antMatchers("/", "/login**", "/webjars/**").permitAll()
.anyRequest()
.authenticated()
.and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
}
server:
port: 9999
context-path: /client
security:
oauth2:
client:
clientId: acme
clientSecret: acmesecret
accessTokenUri: http://localhost:9080/uaa/oauth/token
userAuthorizationUri: http://localhost:9080/uaa/oauth/authorize
tokenName: access_token
authenticationScheme: query
clientAuthenticationScheme: form
resource:
userInfoUri: http://localhost:9080/uaa/me
我相信，在这个春天的默认立场是，我们都应该使用HTTP会话存储，如果需要使用Redis的（或同等）进行复制。对于完全无状态的环境，显然不靠谱。
当你发现，我的解决办法是添加后的预过滤器剥离并在必要时添加的Cookie。你也应该看看OAuth2ClientConfiguration ..这定义了会话范围的bean OAuth2ClientContext。为了简单起见，我改变了自动配置，并作出豆请求范围。只需拨打setAccessToken在预筛选器来除去该cookie。
我结束了通过创建与令牌创建的cookie的过滤器，并加入两种配置Spring Security的，一个是当cookie是在请求中，一个用于当它不是解决问题。我有点觉得这是一件应该是比较简单，所以我可能丢失在整个事情是如何工作的东西太多的工作。
public class TokenCookieCreationFilter extends OncePerRequestFilter {
public static final String ACCESS_TOKEN_COOKIE_NAME = "token";
private final UserInfoRestTemplateFactory userInfoRestTemplateFactory;
@Override
protected void doFilterInternal(final HttpServletRequest request, final HttpServletResponse response, final FilterChain filterChain) throws ServletException, IOException {
try {
final OAuth2ClientContext oAuth2ClientContext = userInfoRestTemplateFactory.getUserInfoRestTemplate().getOAuth2ClientContext();
final OAuth2AccessToken authentication = oAuth2ClientContext.getAccessToken();
if (authentication != null && authentication.getExpiresIn() > 0) {
log.debug("Authentication is not expired: expiresIn={}", authentication.getExpiresIn());
final Cookie cookieToken = createCookie(authentication.getValue(), authentication.getExpiresIn());
response.addCookie(cookieToken);
log.debug("Cookied added: name={}", cookieToken.getName());
}
} catch (final Exception e) {
log.error("Error while extracting token for cookie creation", e);
}
filterChain.doFilter(request, response);
}
private Cookie createCookie(final String content, final int expirationTimeSeconds) {
final Cookie cookie = new Cookie(ACCESS_TOKEN_COOKIE_NAME, content);
cookie.setMaxAge(expirationTimeSeconds);
cookie.setHttpOnly(true);
cookie.setPath("/");
return cookie;
}
}
/**
* Adds the authentication information to the SecurityContext. Needed to allow access to restricted paths after a
* successful authentication redirects back to the application. Without it, the filter
* {@link org.springframework.security.web.authentication.AnonymousAuthenticationFilter} cannot find a user
* and rejects access, redirecting to the login page again.
*/
public class SecurityContextRestorerFilter extends OncePerRequestFilter {
private final UserInfoRestTemplateFactory userInfoRestTemplateFactory;
private final ResourceServerTokenServices userInfoTokenServices;
@Override
public void doFilterInternal(final HttpServletRequest request, final HttpServletResponse response, final FilterChain chain) throws IOException, ServletException {
try {
final OAuth2AccessToken authentication = userInfoRestTemplateFactory.getUserInfoRestTemplate().getOAuth2ClientContext().getAccessToken();
if (authentication != null && authentication.getExpiresIn() > 0) {
OAuth2Authentication oAuth2Authentication = userInfoTokenServices.loadAuthentication(authentication.getValue());
SecurityContextHolder.getContext().setAuthentication(oAuth2Authentication);
log.debug("Added token authentication to security context");
} else {
log.debug("Authentication not found.");
}
chain.doFilter(request, response);
} finally {
SecurityContextHolder.clearContext();
}
}
}
这是用于当cookie是在请求的配置。
@RequiredArgsConstructor
@EnableOAuth2Sso
@Configuration
public static class WebSecurityConfig extends WebSecurityConfigurerAdapter {
private final UserInfoRestTemplateFactory userInfoRestTemplateFactory;
private final ResourceServerTokenServices userInfoTokenServices;
/**
* Filters are created directly here instead of creating them as Spring beans to avoid them being added as filters * by ResourceServerConfiguration security configuration. This way, they are only executed when the api gateway * behaves as a SSO client.
*/
@Override
protected void configure(final HttpSecurity http) throws Exception {
http
.requestMatcher(withoutCookieToken())
.authorizeRequests()
.antMatchers("/login**", "/oauth/**")
.permitAll()
.anyRequest()
.authenticated()
.and()
.exceptionHandling().authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/login"))
.and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.csrf().requireCsrfProtectionMatcher(csrfRequestMatcher()).csrfTokenRepository(csrfTokenRepository())
.and()
.addFilterAfter(new TokenCookieCreationFilter(userInfoRestTemplateFactory), AbstractPreAuthenticatedProcessingFilter.class)
.addFilterAfter(new CsrfHeaderFilter(), CsrfFilter.class)
.addFilterBefore(new SecurityContextRestorerFilter(userInfoRestTemplateFactory, userInfoTokenServices), AnonymousAuthenticationFilter.class);
}
private RequestMatcher withoutCookieToken() {
return request -> request.getCookies() == null || Arrays.stream(request.getCookies()).noneMatch(cookie -> cookie.getName().equals(ACCESS_TOKEN_COOKIE_NAME));
}
这是在没有与令牌一个cookie的配置。有从BearerTokenExtractor扩展Spring功能来搜索cookie中的令牌当认证失败时到期的cookie身份验证入口点饼干提取。
@EnableResourceServer
@Configuration
public static class ResourceSecurityServerConfig extends ResourceServerConfigurerAdapter {
@Override
public void configure(final ResourceServerSecurityConfigurer resources) {
resources.tokenExtractor(new BearerCookiesTokenExtractor());
resources.authenticationEntryPoint(new InvalidTokenEntryPoint());
}
@Override
public void configure(final HttpSecurity http) throws Exception {
http.requestMatcher(withCookieToken())
.authorizeRequests()
.... security config
.and()
.exceptionHandling().authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/"))
.and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.logout().logoutSuccessUrl("/your-logging-out-endpoint").permitAll();
}
private RequestMatcher withCookieToken() {
return request -> request.getCookies() != null && Arrays.stream(request.getCookies()).anyMatch(cookie -> cookie.getName().equals(ACCESS_TOKEN_COOKIE_NAME));
}
}
/**
* {@link TokenExtractor} created to check whether there is a token stored in a cookie if there wasn't any in a header
* or a parameter. In that case, it returns a {@link PreAuthenticatedAuthenticationToken} containing its value.
*/
@Slf4j
public class BearerCookiesTokenExtractor implements TokenExtractor {
private final BearerTokenExtractor tokenExtractor = new BearerTokenExtractor();
@Override
public Authentication extract(final HttpServletRequest request) {
Authentication authentication = tokenExtractor.extract(request);
if (authentication == null) {
authentication = Arrays.stream(request.getCookies())
.filter(isValidTokenCookie())
.findFirst()
.map(cookie -> new PreAuthenticatedAuthenticationToken(cookie.getValue(), EMPTY))
.orElseGet(null);
}
return authentication;
}
private Predicate<Cookie> isValidTokenCookie() {
return cookie -> cookie.getName().equals(ACCESS_TOKEN_COOKIE_NAME);
}
}
/**
* Custom entry point used by {@link org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter}
* to remove the current cookie with the access token, redirect the browser to the home page and invalidate the
* OAuth2 session. Related to the session, it is invalidated to destroy the {@link org.springframework.security.oauth2.client.DefaultOAuth2ClientContext}
* that keeps the token in session for when the gateway behaves as an OAuth2 client.
* For further details, {@link org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2RestOperationsConfiguration.SessionScopedConfiguration.ClientContextConfiguration}
*/
@Slf4j
public class InvalidTokenEntryPoint implements AuthenticationEntryPoint {
public static final String CONTEXT_PATH = "/";
@Override
public void commence(final HttpServletRequest request, final HttpServletResponse response, final AuthenticationException authException) throws IOException, ServletException {
log.info("Invalid token used. Destroying cookie and session and redirecting to home page");
request.getSession().invalidate(); //Destroys the DefaultOAuth2ClientContext that keeps the invalid token
response.addCookie(createEmptyCookie());
response.sendRedirect(CONTEXT_PATH);
}
private Cookie createEmptyCookie() {
final Cookie cookie = new Cookie(TokenCookieCreationFilter.ACCESS_TOKEN_COOKIE_NAME, EMPTY);
cookie.setMaxAge(0);
cookie.setHttpOnly(true);
cookie.setPath(CONTEXT_PATH);
return cookie;
}
}
请确保您已在进口的javax.servlet目前这些类：
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletResponse;
初始化这样的cookie：
Cookie cookie = new Cookie(APP_COOKIE_TOKEN,token.getToken());
jwtCookie.setPath("/");
jwtCookie.setMaxAge(20*60);
//Cookie cannot be accessed via JavaScript
jwtCookie.setHttpOnly(true);
添加饼干在HttpServletResponse的：
response.addCookie(jwtCookie);
如果您使用的角度4，春季安全+启动，那么这个GitHub库可以成为一个很大的帮助：
https://github.com/RedFroggy/angular-spring-hmac
此回购参考博客是：
https://www.redfroggy.fr/securisez-vos-applications-angular-avec-spring-security-et-hmac/