Spring Boot Security：为特定URL模式定制JWT认证过滤器

import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
import org.springframework.security.web.util.matcher.RequestMatcher;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class CustomJwtAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

    // 构造函数，接收一个RequestMatcher，该匹配器定义了哪些请求需要此过滤器处理
    public CustomJwtAuthenticationFilter(RequestMatcher requiresAuthenticationRequestMatcher) {
        super(requiresAuthenticationRequestMatcher);
    }

    // 实际的认证逻辑
    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
            throws AuthenticationException, IOException, ServletException {
        // 从请求中提取JWT令牌的逻辑
        String token = extractJwtFromRequest(request);

        if (token == null) {
            // 如果没有令牌，则抛出认证异常，由AuthenticationEntryPoint处理
            throw new BadCredentialsException("No JWT token found in request.");
        }

        // 假设JwtAuthenticationToken是一个自定义的Authentication实现，
        // 包含了JWT令牌信息，等待AuthenticationManager处理
        JwtAuthenticationToken authenticationToken = new JwtAuthenticationToken(token);

        // 将令牌提交给AuthenticationManager进行认证
        // AuthenticationManager会找到对应的AuthenticationProvider来验证令牌
        return this.getAuthenticationManager().authenticate(authenticationToken);
    }

    // 辅助方法：从请求中提取JWT令牌
    private String extractJwtFromRequest(HttpServletRequest request) {
        // 示例：从Authorization头中提取Bearer Token
        String bearerToken = request.getHeader("Authorization");
        if (bearerToken != null && bearerToken.startsWith("Bearer ")) {
            return bearerToken.substring(7); // 移除"Bearer "前缀
        }
        return null;
    }

    // 可以选择性地覆盖successfulAuthentication和unsuccessfulAuthentication方法
    // 来处理认证成功或失败后的逻辑，例如设置安全上下文或记录日志。
}

import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher;

// ...
// 在您的Security配置类中或单独定义
RequestMatcher apiPathsMatcher = new AntPathRequestMatcher("/api/**");

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.AuthenticationEntryPoint; // 假设您有自定义的认证入口点

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private final UserDetailsService userDetailsService; // 假设您有UserDetailsService
    private final AuthenticationEntryPoint jwtAuthenticationEntryPoint; // 假设您有JWT认证入口点

    public SecurityConfig(UserDetailsService userDetailsService, AuthenticationEntryPoint jwtAuthenticationEntryPoint) {
        this.userDetailsService = userDetailsService;
        this.jwtAuthenticationEntryPoint = jwtAuthenticationEntryPoint;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        // 配置您的AuthenticationManager，例如使用UserDetailsService和密码编码器
        auth.userDetailsService(userDetailsService);
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        // 暴露AuthenticationManager为Bean，供CustomJwtAuthenticationFilter使用
        return super.authenticationManagerBean();
    }

    // 定义CustomJwtAuthenticationFilter为Bean
    @Bean
    public CustomJwtAuthenticationFilter customJwtAuthenticationFilter() throws Exception {
        // 创建一个匹配器，指定只有/api/**路径的请求才会被此JWT过滤器处理
        AntPathRequestMatcher apiMatcher = new AntPathRequestMatcher("/api/**");
        CustomJwtAuthenticationFilter filter = new CustomJwtAuthenticationFilter(apiMatcher);
        // 必须设置AuthenticationManager，因为AbstractAuthenticationProcessingFilter需要它来执行认证
        filter.setAuthenticationManager(authenticationManagerBean());
        // 可以选择性设置认证成功/失败处理器
        // filter.setAuthenticationSuccessHandler(...)
        // filter.setAuthenticationFailureHandler(...)
        return filter;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable() // 禁用CSRF，因为JWT通常是无状态的
            .authorizeRequests()
                // 确保/api/**路径需要认证。当请求到达这些路径时，如果尚未认证，
                // customJwtAuthenticationFilter会尝试处理
                .antMatchers("/api/**").authenticated()
                // 其他路径可以设置为permitAll()或根据需求配置
                .antMatchers("/users", "/login", "/").permitAll()
                .anyRequest().authenticated() // 任何其他未匹配的请求也需要认证
            .and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS) // JWT是无状态的
            .and()
            .exceptionHandling()
                .authenticationEntryPoint(jwtAuthenticationEntryPoint) // 未认证或认证失败的入口点
                .accessDeniedPage("/403") // 访问被拒绝的页面
            .and()
            // 将自定义的JWT过滤器添加到UsernamePasswordAuthenticationFilter之前
            // CustomJwtAuthenticationFilter现在只处理/api/**路径
            .addFilterBefore(customJwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
    }
}