我需要在我的代碼上使用請求范圍來獲取和使用 JWT 令牌上的授權，每個請求都有一個單獨的令牌，每個請求都需要一個獨立的驗證。當任何請求過程沒有任何錯誤時，一切正常，但如果應用程序拋出任何運行時異常，例如 BadRequestException，響應中斷：java.lang.IllegalStateException: No thread-bound request found我正在使用帶有 Ribbon、Feign 和 Hystrix 的 Spring 云環境。這里的 WebSecurityConfigurerAdapter 實現： @Override protected void configure(HttpSecurity http) throws Exception { http.cors() .and() .authorizeRequests() .antMatchers(HttpMethod.OPTIONS, "/**").permitAll() .anyRequest().authenticated() .and() .addFilterBefore(new JWTAuthenticationFilter(enviroment, jwtAuthenticationService, authScope), UsernamePasswordAuthenticationFilter.class) .httpBasic() .and() .csrf().disable(); http.headers().frameOptions().sameOrigin(); }我之前的過濾器 package br.com.qisi.twoface.configuration.security.jwt; import br.com.qisi.twoface.authorization.model.Authorization; import br.com.qisi.twoface.configuration.security.AuthRequestScope; import io.jsonwebtoken.Claims; import org.springframework.security.core.Authentication; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.web.filter.GenericFilterBean; import javax.servlet.FilterChain; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; }
1 回答
慕哥6287543
TA貢獻1831條經驗 獲得超10個贊
根據@dur 評論，我將代碼更改為使用 SecurityContextHolder 并獲取當前線程上下文授權。
我現在的組件：
@Component
public class AuthRequestInfo {
private AuthorizationService authorizationService;
public AuthRequestInfo(AuthorizationService authorizationService) {
this.authorizationService = authorizationService;
}
public Authorization getAuthorization(){
Claims claims = (Claims)SecurityContextHolder.getContext().getAuthentication().getPrincipal();
String key = claims.get(KEY_CLAIM).toString();
return this.authorizationService.findByExampleOptional(Authorization.builder().key(key).build())
.orElseThrow(new UnauthorizedException(INVALID_TWOFACE_AUTHORIZATION_HEADER));
}
}
SecurityContextHolder 身份驗證是在 GenericFilterBean 上設置的?，F在我沒有問題。
添加回答
舉報
0/150
提交
取消