未调用客户授权标头筛选器

wfypjpf4  于 2021-10-10  发布在  Java
关注(0)|答案(0)|浏览(217)

我试图阻止访问api端点,但不包括登录。使用这些属性,当我尝试登录时,它会给我以下响应

{
    "timestamp": "2021-05-14T14:18:30.335+00:00",
    "status": 401,
    "error": "Unauthorized",
    "message": "Unauthorized",
    "path": "/login"
}

但对于需要jwt令牌的用户,服务/用户/状态/检查可以在没有jwt令牌的情况下工作

@Component
public class AuthorizationHeaderFilter extends 
AbstractGatewayFilterFactory<AuthorizationHeaderFilter.Config> {
private final Environment environment;

public AuthorizationHeaderFilter(Environment environment) {
    super(Config.class);
    this.environment = environment;
}

@Override
public GatewayFilter apply(Config config) {
    return (exchange, chain) -> {
        ServerHttpRequest request = exchange.getRequest();
        if (request.getHeaders().containsKey(HttpHeaders.AUTHORIZATION)) {
            return onError(exchange, "no auth header", HttpStatus.UNAUTHORIZED);
        }
        String authorizationHeader = request.getHeaders().get(HttpHeaders.AUTHORIZATION).get(0);
        String jwt = authorizationHeader.replace("Bearer", "");
        if (isJwtValid(jwt)) {
            return onError(exchange, "Jwt is not valid", HttpStatus.UNAUTHORIZED);
        }
        return chain.filter(exchange);
    };
}

public static class Config {
    // put
}

private Mono<Void> onError(ServerWebExchange exchange, String no_auth_header, HttpStatus unauthorized) {
    ServerHttpResponse response = exchange.getResponse();
    response.setStatusCode(unauthorized);
    return response.setComplete();
}

private boolean isJwtValid(String jwt) {
    String subject = Jwts.parser().setSigningKey(environment.getProperty("token.secret"))
            .parseClaimsJws(jwt).getBody().getSubject();
    return subject != null && !subject.isEmpty();
}
}

属性文件

spring.cloud.gateway.routes[0].id=users-status-check
spring.cloud.gateway.routes[0].uri=lb://users-service
spring.cloud.gateway.routes[0].predicates[0]=Path=/users-service/users/status/check
spring.cloud.gateway.routes[0].predicates[1]=Method=GET
spring.cloud.gateway.routes[0].predicates[2]=Header=Authorization, Bearer (.*)
spring.cloud.gateway.routes[0].filters[0]=RemoveRequestHeader=Cookie
spring.cloud.gateway.routes[0].filters[1]=RewritePath=/users-service/(?<segment>.*), /$\{segment}
spring.cloud.gateway.routes[0].filters[2]=AuthorizationHeaderFilter

spring.cloud.gateway.routes[1].id=users-service
spring.cloud.gateway.routes[1].uri=lb://users-service
spring.cloud.gateway.routes[1].predicates[0]=Path=/users-service/users
spring.cloud.gateway.routes[1].predicates[1]=Method=POST
spring.cloud.gateway.routes[1].filters[0]=RemoveRequestHeader=Cookie
spring.cloud.gateway.routes[1].filters[1]=RewritePath=/users-service/(?<segment>.*), /$\{segment}

spring.cloud.gateway.routes[2].id=users-service-login
spring.cloud.gateway.routes[2].uri=lb://users-service
spring.cloud.gateway.routes[2].predicates[0]=Path=/users-service/login
spring.cloud.gateway.routes[2].predicates[1]=Method=POST
spring.cloud.gateway.routes[2].filters[0]=RemoveRequestHeader=Cookie
spring.cloud.gateway.routes[2].filters[1]=RewritePath=/users-service/(?<segment>.*), /$\{segment}

spring.cloud.gateway.routes[3].id=users-service-get-update-delete
spring.cloud.gateway.routes[3].uri=lb://users-service
spring.cloud.gateway.routes[3].predicates[0]=Path=/users-service/users/**
spring.cloud.gateway.routes[3].predicates[1]=Method=GET,PUT,DELETE
spring.cloud.gateway.routes[3].predicates[2]=Header=Authorization, Bearer (.*)
spring.cloud.gateway.routes[3].filters[0]=RemoveRequestHeader=Cookie
spring.cloud.gateway.routes[3].filters[1]=AuthorizationHeaderFilter
spring.cloud.gateway.routes[3].filters[2]=RewritePath=/users-service/(?<segment>.*), /$\{segment}

所有spring依赖项都是最新版本。Java16是jdk版本。你能告诉我这个问题吗?谢谢

暂无答案!

目前还没有任何答案,快来回答吧!

相关问题