分类导航

程序问答发布时间：2022-06-02 发布网站：大佬教程 code.js-code.com

大佬教程收集整理的这篇文章主要介绍了Spring Boot / Spring Security正在忽略来自JavaScript的/ login调用，大佬教程大佬觉得挺不错的，现在分享给大家，也给大家做个参考。

如何解决Spring Boot / Spring Security正在忽略来自JavaScript的/ login调用？

开发过程中遇到Spring Boot / Spring Security正在忽略来自JavaScript的/ login调用的问题如何解决？下面主要结合日常开发的经验，给出你关于Spring Boot / Spring Security正在忽略来自JavaScript的/ login调用的解决方法建议，希望对你解决Spring Boot / Spring Security正在忽略来自JavaScript的/ login调用有所启发或帮助；

这是对我有用的答案/解决方案。根据本文（http://patrickgrimard.com/2014/01/03/spring-security- csrf-protection-in-a-BACkbone-single-page- app/），添加CSrftokenGeneratorFilter extends OncePerrequestFilter 并连接至我的安全性配置，允许使用我的JavaScript提供的参数。

public final class CSrftokenGeneratorFilter extends OncePerrequestFilter {
    @OverrIDe
    protected voID doFilterInternal(httpServletrequest request, httpServletResponse response, FilterChain filterChain) throws servletexception, IOException {
        Csrftoken token = (Csrftoken) request.getAttribute("_csrf");

        response.setheader("X-CSRF-header", token.getheadername());
        response.setheader("X-CSRF-ParaM", token.getParametername());
        response.setheader("X-CSRF-TOKEN", token.getToken());
        filterChain.doFilter(request, responsE);
    }
}

接线如下：

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @autowired
    private CustomUserDetailsservice customUserDetailsservice;

    @OverrIDe
    protected voID configure(httpSecurity http) throws Exception {
        http
                .addFilterafter(new CSrftokenGeneratorFilter(), CsrfFilter.class)
                .authorizerequests()
                .antMatchers("/").permitAll()
                .antMatchers("/login").permitAll()
..}
}

我不确定为什么需要过滤器，但是我想spring-boot / security不会使用它作为默认值。

解决方法

我正在使用Spring-Boot 1.1.7，带有Spring
Security，html（没有Thyme leaf）和javascript。使用javascript提交登录名时，我无法使登录名正常工作。当我将html与表单一起使用时，spring-
security会接受请求，进行身份验证并愉快地进行。但是使用Javascript，我得到了302重定向并且没有身份验证。

这是我的配置：

@ComponentScan
@EnableAutoConfiguration
@EnableGlobalMethodSecurity(securedEnabled = truE)
public class MyApplication {
    public static void main(String[] args) {
        ApplicationContext edm = SpringApplication.run( MyApplication.class,args );
    }
}

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomUserDetailsservice customUserDetailsservice;

    @Override
    protected void configure(httpSecurity http) throws Exception {
        http
                .authorizerequests()
                .antMatchers("/").permitAll()
                .antMatchers("/menu").permitAll()
                .antMatchers("/error").permitAll()
                .antMatchers("/resources/**").permitAll()
                .antMatchers("/css/**").permitAll()
                .antMatchers("/js/**").permitAll()
                .antMatchers("/fonts/**").permitAll()
                .antMatchers("/libs/**").permitAll();


        http
                .formLogin().failureUrl("/login?error")
                .defaultsuccessUrl("/")
                .permitAll()
                .and()
                .logout().logoutrequestMatcher(new AntPathrequestMatcher("/logout")).logoutsuccessUrl("/")
                .permitAll();

        http
                .sessionManagement()
                .maximumSessions(1)
                .expiredUrl("/login?expired")
                .maxSessionsPreventsLogin(true)
                .and()
                .sessionCreationPolicy(SessionCreationPolicy.IF_requIRED)
                .invalidSessionUrl("/");

        http
                .authorizerequests().anyrequest().authenticated();
    }

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        passwordEncoder encoder = new BCryptpasswordEncoder();
        auth.userDetailsservice( customUserDetailsservice ).passwordEncoder( encoder );
    }

    @Override
    public void configure(WebSecurity security){
        security.ignoring().antMatchers("/css/**","/fonts/**","/libs/**");
    }
}

我有自己的UserDetailsService

@Component
public class CustomUserDetailsservice implements UserDetailsservice {

    @Autowired
    private Userservice userservice;

    @Autowired
    private UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {

        User user = userservice.findByUsername( userName );
        if ( user == null ) {
            throw new UsernameNotFoundException( "UserName " + userName + " not found" );
        }
        return user;
    }
}

最后，这是提交帖子的javascript：

var token = $("meta[name='_csrf']").attr("content");
var header = $("meta[name='_csrf_header']").attr("content");
$("#login").click(function(){
  username=$("#username").val();
  password=$("#password").val();
  $.ajax({
   type: "POST",url: "/login",beforeSend: function(xhr){
       xhr.setrequestHeader(header,token);
   },data: "username="+username+"&password="+password,success: function(html){
        alert("logged in");
    }
  });
return false;
});