我用 jwt 保护了我的身份验证服务,当我请求标头中带有 jwt 的重新资源时,一切正常。在我实现 Eureka 服务发现和 Zuul 网关并尝试请求安全资源后,我收到以下响应:
{
"timestamp": "2019-06-04T15:28:31.690+0000",
"status": 403,
"error": "Forbidden",
"message": "Access Denied",
"path": "/user"
}
因此,仅当我通过网关发送请求时,才会发生此 meesage。也可以通过 gatway 获得不安全的资源,只有安全资源存在问题。
身份验证服务中的安全配置:
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf()
.disable()
.cors()
.and()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()
.antMatchers("/signup").permitAll()
.antMatchers("/login").permitAll()
.antMatchers("/confirm-account").permitAll()
.antMatchers("/resendMail").permitAll()
.antMatchers("/validate/user").permitAll()
.antMatchers("/reset/password").permitAll()
.antMatchers("/reset-password").permitAll()
.antMatchers("/new/password").permitAll()
.anyRequest().authenticated()
.and()
.apply(new JWTConfigurer(this.tokenProvider));
}
application.properties in auth-service
spring.datasource.url=jdbc:postgresql://localhost:5432/gamificationdb
spring.datasource.username = postgres
spring.datasource.password = root
spring.jpa.properties.hibernate.dialect = org.hibernate.dialect.PostgreSQLDialect
spring.jpa.hibernate.ddl-auto = update
spring.jpa.properties.hibernate.jdbc.lob.non_contextual_creation=true
spring.main.allow-bean-definition-overriding=true
eureka.client.serviceUrl.defaultZone= http://localhost:8080/eureka/
我遇到了同样的问题。我已经使用下面的类解决了这个问题。
创建扩展 ZuulFilter 类的过滤器类。
public class AccessFilter extends ZuulFilter {
@Override
public String filterType() {
return "pre";
}
@Override
public int filterOrder() {
return 0;
}
@Override
public boolean shouldFilter() {
return true;
}
@Override
public Object run() {
RequestContext requestContext = RequestContext.getCurrentContext();
String request = requestContext.getRequest().getHeader("Authorization");
if(request == null) {
requestContext.setSendZuulResponse(false);
requestContext.setResponseStatusCode(HttpStatus.SC_UNAUTHORIZED);
return null;
}
return null;
}
}
然后从安全配置类中的AccessFilter
创建 Bean。
@Bean
public AccessFilter accessFilter() {
return new AccessFilter();
}