Spring安全异常处理自定义响应

如何可能返回json而不是html?

我:

<!doctype html>
<html lang="en">
<head>
<title>HTTP Status 401 – Unauthorized</title>
<style type="text/css">
body {
font-family: Tahoma, Arial, sans-serif;
}
h1,
h2,
h3,
b {
color: white;
background-color: #525D76;
}
h1 {
font-size: 22px;
}
h2 {
font-size: 16px;
}
h3 {
font-size: 14px;
}
p {
font-size: 12px;
}
a {
color: black;
}
.line {
height: 1px;
background-color: #525D76;
border: none;
}
</style>
</head>
<body>
<h1>HTTP Status 401 – Unauthorized</h1>
</body>
</html>

我需要这样的东西:

{
"errors": [
{
"status": "401",
"title": "UNAUTHORIZED",
"detail": "xyz ..."
}
]
}

我的适配器:

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter
{
@Override
protected void configure(HttpSecurity httpSecurity) throws Exception
{
// @formatter:off
httpSecurity
.csrf()
.disable()
.authorizeRequests()
.antMatchers(HttpMethod.GET).permitAll()
.anyRequest()
.authenticated()
.and()
.httpBasic()
.and()
.exceptionHandling()
.authenticationEntryPoint(new CustomAuthenticationEntryPoint());
// @formatter:on
}
}

CustomAuthenticationEntryPoint

@Component
class CustomAuthenticationEntryPoint implements AuthenticationEntryPoint
{
@Override
public void commence(HttpServletRequest request, HttpServletResponse response,
AuthenticationException authException) throws IOException
{
Collection<String> authorities = response.getHeaders("Authorization");
response.addHeader("access_denied_reason", "authentication_required");
response.sendError(HttpStatus.UNAUTHORIZED.value(), "Unauthorized");
}
}

实际上，我们可以在入口点内打印/写入response[.getWriter()]，如:

import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
//...
private static AuthenticationEntryPoint authenticationEntryPoint() {
return (request, response, authException) -> {
response.addHeader( // identic/similar to "basic" entry point
"WWW-Authenticate", "Basic realm="Realm""
);
// subtle difference to "basic" entry point :
// better/looks like:
response.setContentType(MediaType.APPLICATION_JSON_VALUE);
// response.addHeader...
response.setStatus(HttpStatus.UNAUTHORIZED.value() /*, no message!(?) */);
// "print" custom to "response" (with String#format, jackson, gson... (templating fw...)):
response.getWriter().format("""
{
"errors":[
{
"status": %d,
"title": "%s",
"detail": "%s"
}
]
}
""",
HttpStatus.UNAUTHORIZED.value(),
HttpStatus.UNAUTHORIZED.name(),
authException.getMessage() // or whatever message/params/format we see fit
);
};
}

BasicAuthenticationEntryPoint@github

那么我们就可以通过这样的测试:

package com.example.security.custom.entrypoint;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
import org.springframework.test.web.servlet.MockMvc;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
import static org.springframework.test.web.servlet.result.MockMvcResultHandlers.print;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
@WebMvcTest
class SecurityCustomEntrypointApplicationTests {
@Autowired
private MockMvc mvc;
@Test
void testUnauthorized() throws Exception {
mvc
.perform(post("/somewhere")) // no (basic) credentials(!), assuming no 404 :)
.andDo(print())
.andExpectAll(
status().isUnauthorized(),
header().exists("WWW-Authenticate"),
jsonPath("$.errors[0].detail").exists(),
jsonPath("$.errors[0].title").value("UNAUTHORIZED"),
jsonPath("$.errors[0].status").value(401) // , ...
);
}
}

使其适用于基本身份验证和错误凭据"参见:https://stackoverflow.com/a/74547059/592355。

Dup/相关:

如何在发送到客户端之前设置响应体
使用@ExceptionHandler处理spring安全认证异常

相关内容

最新更新

热门标签：