Spring Boot Security中JWT过滤器针对特定URL模式的精准应用

import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
import org.springframework.security.web.util.matcher.RequestMatcher;

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;

public class CustomJwtAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

    // 假设您有一个JWT解析和验证的服务
    private final JwtTokenProvider jwtTokenProvider;

    public CustomJwtAuthenticationFilter(RequestMatcher requiresAuthenticationRequestMatcher, JwtTokenProvider jwtTokenProvider, AuthenticationManager authenticationManager) {
        super(requiresAuthenticationRequestMatcher); // 将RequestMatcher传递给父类
        this.jwtTokenProvider = jwtTokenProvider;
        setAuthenticationManager(authenticationManager); // 设置认证管理器
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
            throws AuthenticationException, IOException, ServletException {
        // 从请求头中获取JWT Token
        String token = jwtTokenProvider.resolveToken(request);

        if (token != null && jwtTokenProvider.validateToken(token)) {
            // 如果Token有效，则构建一个认证对象
            // 这里的AuthenticationToken需要根据您的JWT实现来定义
            // 例如，可以是一个包含用户信息的UsernamePasswordAuthenticationToken
            Authentication authentication = jwtTokenProvider.getAuthentication(token);
            return getAuthenticationManager().authenticate(authentication); // 交给AuthenticationManager进行认证
        }
        // 如果没有Token或Token无效，则抛出认证异常
        throw new AuthenticationException("JWT Token is missing or invalid") {};
    }

    @Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,
                                            Authentication authResult) throws IOException, ServletException {
        // 认证成功后，将认证信息设置到SecurityContext中，并继续过滤器链
        // SecurityContextHolder.getContext().setAuthentication(authResult); // AbstractAuthenticationProcessingFilter 内部会处理
        chain.doFilter(request, response);
    }

    @Override
    protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response,
                                              AuthenticationException failed) throws IOException, ServletException {
        // 认证失败处理，例如返回401 Unauthorized
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        response.getWriter().write("Authentication Failed: " + failed.getMessage());
    }
}

import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher;
import jakarta.servlet.http.HttpServletRequest;

public class ApiPathRequestMatcher implements RequestMatcher {

    private final AntPathRequestMatcher apiPathMatcher;

    public ApiPathRequestMatcher(String pattern) {
        this.apiPathMatcher = new AntPathRequestMatcher(pattern);
    }

    @Override
    public boolean matches(HttpServletRequest request) {
        // 如果请求路径匹配指定的模式，则返回true，表示需要进行认证处理
        return apiPathMatcher.matches(request);
    }
}

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint; // 或者其他认证入口点

@Configuration
@EnableWebSecurity
public class WebSecurityConfig {

    private final JwtTokenProvider jwtTokenProvider; // 您的JWT提供者服务
    private final BasicAuthenticationEntryPoint jwtAuthenticationEntryPoint; // 认证入口点，用于未认证访问时的处理

    public WebSecurityConfig(JwtTokenProvider jwtTokenProvider, BasicAuthenticationEntryPoint jwtAuthenticationEntryPoint) {
        this.jwtTokenProvider = jwtTokenProvider;
        this.jwtAuthenticationEntryPoint = jwtAuthenticationEntryPoint;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
        return authenticationConfiguration.getAuthenticationManager();
    }

    @Bean
    public CustomJwtAuthenticationFilter customJwtAuthenticationFilter(AuthenticationManager authenticationManager) {
        // 创建只匹配/api/**路径的请求匹配器
        ApiPathRequestMatcher apiMatcher = new ApiPathRequestMatcher("/api/**");
        return new CustomJwtAuthenticationFilter(apiMatcher, jwtTokenProvider, authenticationManager);
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http, CustomJwtAuthenticationFilter customJwtAuthenticationFilter) throws Exception {
        http.csrf().disable() // 禁用CSRF
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS) // JWT通常是无状态的
            .and()
            .exceptionHandling()
                .authenticationEntryPoint(jwtAuthenticationEntryPoint) // 未认证访问时的处理
                .accessDeniedPage("/403") // 访问被拒绝时的页面
            .and()
            .authorizeRequests()
                // /api/** 路径将由我们的CustomJwtAuthenticationFilter进行认证，
                // 但这里仍然需要配置其授权规则（例如，认证后才能访问）
                .antMatchers("/api/**").authenticated()
                // 其他路径允许所有访问
                .anyRequest().permitAll()
            .and()
            // 如果您的应用同时有表单登录，可以保留以下配置
            .formLogin()
                .loginPage("/login")
                .defaultSuccessUrl("/users")
                .failureUrl("/login?error=true")
                .permitAll()
            .and()
            .logout()
                .logoutSuccessUrl("/")
                .permitAll()
            .and()
            // 将我们的自定义JWT过滤器添加到UsernamePasswordAuthenticationFilter之前
            // 这样JWT认证会在Spring Security的默认表单认证之前执行
            .addFilterBefore(customJwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }
}