我试图阻止访问api端点,但不包括登录。使用这些属性,当我尝试登录时,它会给我以下响应
{
"timestamp": "2021-05-14T14:18:30.335+00:00",
"status": 401,
"error": "Unauthorized",
"message": "Unauthorized",
"path": "/login"
}
但对于需要jwt令牌的用户,服务/用户/状态/检查可以在没有jwt令牌的情况下工作
@Component
public class AuthorizationHeaderFilter extends
AbstractGatewayFilterFactory<AuthorizationHeaderFilter.Config> {
private final Environment environment;
public AuthorizationHeaderFilter(Environment environment) {
super(Config.class);
this.environment = environment;
}
@Override
public GatewayFilter apply(Config config) {
return (exchange, chain) -> {
ServerHttpRequest request = exchange.getRequest();
if (request.getHeaders().containsKey(HttpHeaders.AUTHORIZATION)) {
return onError(exchange, "no auth header", HttpStatus.UNAUTHORIZED);
}
String authorizationHeader = request.getHeaders().get(HttpHeaders.AUTHORIZATION).get(0);
String jwt = authorizationHeader.replace("Bearer", "");
if (isJwtValid(jwt)) {
return onError(exchange, "Jwt is not valid", HttpStatus.UNAUTHORIZED);
}
return chain.filter(exchange);
};
}
public static class Config {
// put
}
private Mono<Void> onError(ServerWebExchange exchange, String no_auth_header, HttpStatus unauthorized) {
ServerHttpResponse response = exchange.getResponse();
response.setStatusCode(unauthorized);
return response.setComplete();
}
private boolean isJwtValid(String jwt) {
String subject = Jwts.parser().setSigningKey(environment.getProperty("token.secret"))
.parseClaimsJws(jwt).getBody().getSubject();
return subject != null && !subject.isEmpty();
}
}
属性文件
spring.cloud.gateway.routes[0].id=users-status-check
spring.cloud.gateway.routes[0].uri=lb://users-service
spring.cloud.gateway.routes[0].predicates[0]=Path=/users-service/users/status/check
spring.cloud.gateway.routes[0].predicates[1]=Method=GET
spring.cloud.gateway.routes[0].predicates[2]=Header=Authorization, Bearer (.*)
spring.cloud.gateway.routes[0].filters[0]=RemoveRequestHeader=Cookie
spring.cloud.gateway.routes[0].filters[1]=RewritePath=/users-service/(?<segment>.*), /$\{segment}
spring.cloud.gateway.routes[0].filters[2]=AuthorizationHeaderFilter
spring.cloud.gateway.routes[1].id=users-service
spring.cloud.gateway.routes[1].uri=lb://users-service
spring.cloud.gateway.routes[1].predicates[0]=Path=/users-service/users
spring.cloud.gateway.routes[1].predicates[1]=Method=POST
spring.cloud.gateway.routes[1].filters[0]=RemoveRequestHeader=Cookie
spring.cloud.gateway.routes[1].filters[1]=RewritePath=/users-service/(?<segment>.*), /$\{segment}
spring.cloud.gateway.routes[2].id=users-service-login
spring.cloud.gateway.routes[2].uri=lb://users-service
spring.cloud.gateway.routes[2].predicates[0]=Path=/users-service/login
spring.cloud.gateway.routes[2].predicates[1]=Method=POST
spring.cloud.gateway.routes[2].filters[0]=RemoveRequestHeader=Cookie
spring.cloud.gateway.routes[2].filters[1]=RewritePath=/users-service/(?<segment>.*), /$\{segment}
spring.cloud.gateway.routes[3].id=users-service-get-update-delete
spring.cloud.gateway.routes[3].uri=lb://users-service
spring.cloud.gateway.routes[3].predicates[0]=Path=/users-service/users/**
spring.cloud.gateway.routes[3].predicates[1]=Method=GET,PUT,DELETE
spring.cloud.gateway.routes[3].predicates[2]=Header=Authorization, Bearer (.*)
spring.cloud.gateway.routes[3].filters[0]=RemoveRequestHeader=Cookie
spring.cloud.gateway.routes[3].filters[1]=AuthorizationHeaderFilter
spring.cloud.gateway.routes[3].filters[2]=RewritePath=/users-service/(?<segment>.*), /$\{segment}
所有spring依赖项都是最新版本。Java16是jdk版本。你能告诉我这个问题吗?谢谢
暂无答案!
目前还没有任何答案,快来回答吧!