如何使用 Webflux 访问 Spring API 处理程序方法中的 JWT 声明？

Question

我正在添加一个 WebFilter 以在 SecurityWebFilterChain 内部执行 JWT 身份验证。我们在 JWT 中编码了许多 API 端点所需的非身份验证相关信息，因此我需要能够从 JWT 中提取信息并在我的 API 处理程序方法（例如，LoginController.爪哇）。实现这一目标的最佳模式是什么？

这是我的 SecurityWebFilterChain 显示 WebFilter 身份验证：

    @Bean

    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {

        return http

                .authorizeExchange()

                .pathMatchers("/login", "/")

                .authenticated()

                .and()

                .addFilterAt(basicAuthenticationFilter(), SecurityWebFiltersOrder.HTTP_BASIC)

                .authorizeExchange()

                .pathMatchers("/adm")

                .authenticated()

                .and()

                .addFilterAt(basicAuthenticationFilter(), SecurityWebFiltersOrder.HTTP_BASIC)

                .authorizeExchange()

                .pathMatchers("/api/**")

                .access(authorizationManager)

                .and()

                .addFilterAt(bearerAuthenticationFilter(), SecurityWebFiltersOrder.AUTHENTICATION)

                .build();

    }

这是我想在 LoginController.java 中访问声明的地方：

@RestController()

@RequestMapping(value = "/login")

public class LoginController {

    private final UserMongoRepository repository;

    @Autowired

    public LoginController(UserMongoRepository repository) {

        this.repository = repository;

    }

    @PostMapping("")

    public Mono<User> login(@RequestBody User post,

                            @RequestParam String user_id,

                            @RequestParam String username) {

        //Need to access information from JWT claims here

        return this.repository.findById(user_id);

    }

}

Answer 1

我会创建一个自定义Authentication对象并在其中存储所需的信息。对于用户相关的数据，存储在其内部Principal。对于非用户相关的数据，听起来Details是一个存储的好地方。许多内置函数AuthenticationProvider会创建一个UserDetails并存储到Principal.&nbsp;UserDetails这意味着如果您正在使用那些内置的，您可以考虑只创建一个 customsied&nbsp;AuthenticationProvider。因此，根据您实现身份验证逻辑的方式，您需要自定义相关AuthenticationProvider等Filter。目的是访问HttpServletRequest，从 HTTP 标头获取 JWT，解析 JWT，设置和配置此自定义Authentication对象并将其设置为SecurityContext：SecurityContextHolder.getContext().setAuthentication(authenication);Authentication要在 Controller 中访问此对象，您可以使用：Authentication auth = SecurityContextHolder.getContext().getAuthentication();CurrentUser user = (CurrentUser) auth.getPrincipal();CurrentRequestDetail detail= (CurrentRequestDetail) auth.getDetails();/** CurrentUser and CurrentRequestDetail is the customised Principal and Details**/如果您只需要访问 [ Principal]，您可以使用@AuthenticationPrincipal：&nbsp; &nbsp; @PostMapping("")&nbsp; &nbsp; public Mono<User> login(@RequestBody User post,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; @RequestParam String user_id,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; @RequestParam String username,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; @AuthenticationPrincipal CurrentUser currentUser) {&nbsp; &nbsp; &nbsp; &nbsp; //Need to access information from JWT claims here&nbsp; &nbsp; &nbsp; &nbsp; return this.repository.findById(user_id);&nbsp; &nbsp; }