Spring-Security：不确认在RestTemplate中设置的Cookie

Question

我正在使用Spring-Security进行身份验证/授权的Java应用程序，该应用程序连接到Spring-MVC服务器。登录部分工作正常，并且我在Java应用程序中返回了JSESSIONID，但是当我向安全资源发出请求时，它失败，Spring-Security无法找到任何已登录的用户。我在这里做错了什么？

安全的applicationContext.xml：

<security:http pattern="/resources/**" security="none"/> 

    <security:http create-session="ifRequired" use-expressions="true" auto-config="false" disable-url-rewriting="true"> 
     <security:form-login login-page="/login" login-processing-url="/j_spring_security_check" 
          default-target-url="/dashboard" always-use-default-target="false" 
          authentication-failure-url="/denied"/> 
     <security:remember-me key="_spring_security_remember_me" user-service-ref="userDetailsService" 
           token-validity-seconds="1209600" data-source-ref="dataSource"/> 
     <security:logout delete-cookies="JSESSIONID" invalidate-session="true" logout-url="/j_spring_security_logout"/> 
     <!--<security:intercept-url pattern="/**" requires-channel="https"/>--> 
     <security:port-mappings> 
      <security:port-mapping http="8080" https="8443"/> 
     </security:port-mappings> 
     <security:logout logout-url="/logout" logout-success-url="/" success-handler-ref="myLogoutHandler"/> 


     <security:session-management session-fixation-protection="migrateSession"> 
      <security:concurrency-control session-registry-ref="sessionRegistry" max-sessions="5" expired-url="/login"/> 
     </security:session-management> 

    </security:http> 

    <security:authentication-manager alias="authenticationManager"> 
     <security:authentication-provider ref="restaurantauthenticationprovider"/> 
     <security:authentication-provider ref="userauthenticationprovider"/> 
    </security:authentication-manager> 

    <beans:bean id="encoder" 
       class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"> 
     <beans:constructor-arg name="strength" value="11"/> 
    </beans:bean> 

    <beans:bean id="restaurantauthenticationprovider" 
       class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"> 
     <beans:property name="userDetailsService" ref="LoginServiceImpl"/> 
     <beans:property name="passwordEncoder" ref="encoder"/> 
    </beans:bean> 

    <beans:bean id="userauthenticationprovider" 
       class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"> 
     <beans:property name="userDetailsService" ref="UserLoginServiceImpl"/> 
     <beans:property name="passwordEncoder" ref="encoder"/> 
    </beans:bean> 

正如我有2代表从登录到检查，我有2个DAOAuthenticationProviders。

UserLoginServiceImpl：

@Transactional 
@Service("loginuserDetailsService") 
public class UserLoginServiceImpl implements UserDetailsService { 


    @Autowired 
    private PersonDAO personDAO; 
    @Autowired 
    private UserAssembler userAssembler; 

    @Override 
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException,DataAccessException { 
     System.out.println("Username is "+username); 
     Person person = this.personDAO.findPersonByUserName(username.toLowerCase()); 
     if(person == null) { throw new UsernameNotFoundException("Wrong username or password");} 
     return userAssembler.buildUserFromUserEntity(person); 
    } 
} 

汇编：

@Service("userassembler") 
@Transactional 
public class UserAssembler { 

    @Transactional 
    User buildUserFromUserEntity(Person userEntity){ 
     System.out.println("We are in Userassembler"+userEntity.getEmail()); 
     String username = userEntity.getUsername().toLowerCase(); 
     String password = userEntity.getPassword(); 

     boolean enabled = userEntity.isEnabled(); 
     boolean accountNonExpired = userEntity.isAccountNonExpired(); 
     boolean credentialsNonExpired = userEntity.isCredentialsNonExpired(); 
     boolean accountNonLocked = userEntity.isAccountNonLocked(); 

     Collection<GrantedAuthority> authorities = new ArrayList<>(); 
     authorities.add(new SimpleGrantedAuthority("ROLE_USER")); 

     return new User(username,password,enabled,accountNonExpired,credentialsNonExpired,accountNonLocked,authorities); 
    } 
} 

上面是配置，现在我要把这是失败的其余代码：

Thread thread = new Thread(new Runnable() { 
      @Override 
      public void run() { 
       Log.d("Username is ", username); 
       String jsessionid = rest.execute("http://192.168.178.60:8080/j_spring_security_check", HttpMethod.POST, 
         new RequestCallback() { 
          @Override 
          public void doWithRequest(ClientHttpRequest request) throws IOException { 
           request.getBody().write(("j_username=" + username + "&j_password=" + password).getBytes()); 
          } 
         }, new ResponseExtractor<String>() { 
          @Override 
          public String extractData(ClientHttpResponse response) throws IOException { 
           List<String> cookies = response.getHeaders().get("Cookie"); 
           if (cookies == null) { 
            cookies = response.getHeaders().get("Set-Cookie"); 
           } 
           String cookie = cookies.get(cookies.size() - 1); 
           System.out.println("Cookie is " + cookie); 
// The method below gets me which user is logged in, and I always get null for Controller method. 
           reply = rest.getForObject(
             "http://192.168.178.60:8080/dashboard", String.class); 

           int start = cookie.indexOf('='); 
           int end = cookie.indexOf(';'); 
           return cookie.substring(start + 1, end); 
          } 
         }); 

      } 
     }); 
     thread.start(); 

更新 最后，这个代码ked：

//我从服务器获取cookie，我为每个请求手动设置cookie，cookie是一个静态易失性字符串。

HttpHeaders requestHeaders = new HttpHeaders(); 
requestHeaders.add("Cookie", "JSESSIONID=" + StaticRestTemplate.jsessionid); 
HttpEntity requestEntity = new HttpEntity(null, requestHeaders); 

ResponseEntity rssResponse = rest.exchange(
            "http://192.168.178.60:8080/dashboard", 
            HttpMethod.GET, 
            requestEntity, 
            String.class); 

String abc = (String) rssResponse.getBody(); 

Answer 1

Spring的RestTemplate默认不会跟踪cookie。这可以确保您不会意外地从一个用户代表另一个用户传递cookie（即JSESSIONID）（即，考虑在许多用户利用相同RestTemplate的服务器上使用RestTemplate）。

如果要做到这一点，你可以使用这样的配置是：

RestTemplate rest = new RestTemplate(); 

// initialize the RequestFactory to allow cookies 
HttpClient httpClient = HttpClientBuilder.create().build(); 
ClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory(httpClient); 
rest.setRequestFactory(factory); 

MultiValueMap<String, String> map = new LinkedMultiValueMap<String, String>(); 
map.add("username", "user"); 
map.add("password", "password"); 

String result = rest.postForObject("http://localhost:8080/login", map, String.class); 

String hello = rest.postForObject("http://localhost:8080/", map, String.class); 

assertThat(hello).isEqualTo("Hello"); 

要使用此代码，你需要确保你的HttpClient在classpath。例如，下面可能是在你的pom.xml如果你正在使用Maven：

<dependency> 
    <groupId>org.apache.httpcomponents</groupId> 
    <artifactId>httpclient</artifactId> 
    <version>4.5</version> 
</dependency> 

显然，你需要确保你的HttpClient包含的版本，为您的依赖工作。