В итоге я решил проблему, создав фильтр, который создает файл cookie с токеном, и добавив две конфигурации для Spring Security: одну, когда файл cookie находится в запросе, и одну, когда его нет. Я как бы думаю, что это слишком много работы для чего-то, что должно быть относительно простым, поэтому я, вероятно, что-то упустил в том, как все это должно работать.
public class TokenCookieCreationFilter extends OncePerRequestFilter {
public static final String ACCESS_TOKEN_COOKIE_NAME = "token";
private final UserInfoRestTemplateFactory userInfoRestTemplateFactory;
@Override
protected void doFilterInternal(final HttpServletRequest request, final HttpServletResponse response, final FilterChain filterChain) throws ServletException, IOException {
try {
final OAuth2ClientContext oAuth2ClientContext = userInfoRestTemplateFactory.getUserInfoRestTemplate().getOAuth2ClientContext();
final OAuth2AccessToken authentication = oAuth2ClientContext.getAccessToken();
if (authentication != null && authentication.getExpiresIn() > 0) {
log.debug("Authentication is not expired: expiresIn={}", authentication.getExpiresIn());
final Cookie cookieToken = createCookie(authentication.getValue(), authentication.getExpiresIn());
response.addCookie(cookieToken);
log.debug("Cookied added: name={}", cookieToken.getName());
}
} catch (final Exception e) {
log.error("Error while extracting token for cookie creation", e);
}
filterChain.doFilter(request, response);
}
private Cookie createCookie(final String content, final int expirationTimeSeconds) {
final Cookie cookie = new Cookie(ACCESS_TOKEN_COOKIE_NAME, content);
cookie.setMaxAge(expirationTimeSeconds);
cookie.setHttpOnly(true);
cookie.setPath("/");
return cookie;
}
}
/**
* Adds the authentication information to the SecurityContext. Needed to allow access to restricted paths after a
* successful authentication redirects back to the application. Without it, the filter
* {@link org.springframework.security.web.authentication.AnonymousAuthenticationFilter} cannot find a user
* and rejects access, redirecting to the login page again.
*/
public class SecurityContextRestorerFilter extends OncePerRequestFilter {
private final UserInfoRestTemplateFactory userInfoRestTemplateFactory;
private final ResourceServerTokenServices userInfoTokenServices;
@Override
public void doFilterInternal(final HttpServletRequest request, final HttpServletResponse response, final FilterChain chain) throws IOException, ServletException {
try {
final OAuth2AccessToken authentication = userInfoRestTemplateFactory.getUserInfoRestTemplate().getOAuth2ClientContext().getAccessToken();
if (authentication != null && authentication.getExpiresIn() > 0) {
OAuth2Authentication oAuth2Authentication = userInfoTokenServices.loadAuthentication(authentication.getValue());
SecurityContextHolder.getContext().setAuthentication(oAuth2Authentication);
log.debug("Added token authentication to security context");
} else {
log.debug("Authentication not found.");
}
chain.doFilter(request, response);
} finally {
SecurityContextHolder.clearContext();
}
}
}
Это конфигурация, когда файл cookie находится в запросе.
@RequiredArgsConstructor
@EnableOAuth2Sso
@Configuration
public static class WebSecurityConfig extends WebSecurityConfigurerAdapter {
private final UserInfoRestTemplateFactory userInfoRestTemplateFactory;
private final ResourceServerTokenServices userInfoTokenServices;
/**
* Filters are created directly here instead of creating them as Spring beans to avoid them being added as filters * by ResourceServerConfiguration security configuration. This way, they are only executed when the api gateway * behaves as a SSO client.
*/
@Override
protected void configure(final HttpSecurity http) throws Exception {
http
.requestMatcher(withoutCookieToken())
.authorizeRequests()
.antMatchers("/login**", "/oauth/**")
.permitAll()
.anyRequest()
.authenticated()
.and()
.exceptionHandling().authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/login"))
.and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.csrf().requireCsrfProtectionMatcher(csrfRequestMatcher()).csrfTokenRepository(csrfTokenRepository())
.and()
.addFilterAfter(new TokenCookieCreationFilter(userInfoRestTemplateFactory), AbstractPreAuthenticatedProcessingFilter.class)
.addFilterAfter(new CsrfHeaderFilter(), CsrfFilter.class)
.addFilterBefore(new SecurityContextRestorerFilter(userInfoRestTemplateFactory, userInfoTokenServices), AnonymousAuthenticationFilter.class);
}
private RequestMatcher withoutCookieToken() {
return request -> request.getCookies() == null || Arrays.stream(request.getCookies()).noneMatch(cookie -> cookie.getName().equals(ACCESS_TOKEN_COOKIE_NAME));
}
И это конфигурация, когда есть куки с токеном. Существует экстрактор файлов cookie, который расширяет функциональность BearerTokenExtractor с Spring для поиска маркера в файле cookie и точки входа для проверки подлинности, срок действия файла cookie которой истекает при сбое аутентификации.
@EnableResourceServer
@Configuration
public static class ResourceSecurityServerConfig extends ResourceServerConfigurerAdapter {
@Override
public void configure(final ResourceServerSecurityConfigurer resources) {
resources.tokenExtractor(new BearerCookiesTokenExtractor());
resources.authenticationEntryPoint(new InvalidTokenEntryPoint());
}
@Override
public void configure(final HttpSecurity http) throws Exception {
http.requestMatcher(withCookieToken())
.authorizeRequests()
.... security config
.and()
.exceptionHandling().authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/"))
.and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.logout().logoutSuccessUrl("/your-logging-out-endpoint").permitAll();
}
private RequestMatcher withCookieToken() {
return request -> request.getCookies() != null && Arrays.stream(request.getCookies()).anyMatch(cookie -> cookie.getName().equals(ACCESS_TOKEN_COOKIE_NAME));
}
}
/**
* {@link TokenExtractor} created to check whether there is a token stored in a cookie if there wasn't any in a header
* or a parameter. In that case, it returns a {@link PreAuthenticatedAuthenticationToken} containing its value.
*/
@Slf4j
public class BearerCookiesTokenExtractor implements TokenExtractor {
private final BearerTokenExtractor tokenExtractor = new BearerTokenExtractor();
@Override
public Authentication extract(final HttpServletRequest request) {
Authentication authentication = tokenExtractor.extract(request);
if (authentication == null) {
authentication = Arrays.stream(request.getCookies())
.filter(isValidTokenCookie())
.findFirst()
.map(cookie -> new PreAuthenticatedAuthenticationToken(cookie.getValue(), EMPTY))
.orElseGet(null);
}
return authentication;
}
private Predicate<Cookie> isValidTokenCookie() {
return cookie -> cookie.getName().equals(ACCESS_TOKEN_COOKIE_NAME);
}
}
/**
* Custom entry point used by {@link org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter}
* to remove the current cookie with the access token, redirect the browser to the home page and invalidate the
* OAuth2 session. Related to the session, it is invalidated to destroy the {@link org.springframework.security.oauth2.client.DefaultOAuth2ClientContext}
* that keeps the token in session for when the gateway behaves as an OAuth2 client.
* For further details, {@link org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2RestOperationsConfiguration.SessionScopedConfiguration.ClientContextConfiguration}
*/
@Slf4j
public class InvalidTokenEntryPoint implements AuthenticationEntryPoint {
public static final String CONTEXT_PATH = "/";
@Override
public void commence(final HttpServletRequest request, final HttpServletResponse response, final AuthenticationException authException) throws IOException, ServletException {
log.info("Invalid token used. Destroying cookie and session and redirecting to home page");
request.getSession().invalidate(); //Destroys the DefaultOAuth2ClientContext that keeps the invalid token
response.addCookie(createEmptyCookie());
response.sendRedirect(CONTEXT_PATH);
}
private Cookie createEmptyCookie() {
final Cookie cookie = new Cookie(TokenCookieCreationFilter.ACCESS_TOKEN_COOKIE_NAME, EMPTY);
cookie.setMaxAge(0);
cookie.setHttpOnly(true);
cookie.setPath(CONTEXT_PATH);
return cookie;
}
}
person
Juan Vega
schedule
16.10.2018
