Spring Boot Rest安全性基本認證密碼編碼器在登錄時不對密碼進行加密

Question

問題是，BCryptPasswordEncoder未在登錄過程中對密碼進行加密，因此登錄失敗，我們假設密碼爲123，並以散列形式存儲在數據庫中，密碼123返回invalid_grants，但是當從客戶端發送散列密碼時，返回訪問令牌。當密碼編碼器的密碼被註釋時也是可以的。

App.java

@SpringBootApplication 
public class App { 

    @Bean 
    BCryptPasswordEncoder getPasswordEncoder() { 
     return new BCryptPasswordEncoder(); 
    } 

    public static void main(String[] args) throws Exception { 
     SpringApplication.run(App.class, args); 
    } 



    @Autowired 
    public void authenticationManager(AuthenticationManagerBuilder authenticationManagerBuilder, final UserRepository userRepository, UserService userService) throws Exception { 
     if(userRepository.count() == 0) { 

      User user = new User(); 
      Role role = new Role(); 
      role.setName("SA"); 
      user.setEmail("test"); 
      user.setPassword("123"); 
      user.setRoles(Arrays.asList(role)); 
      user.setBlocked(false); 
      user.setEnable(true); 
      userService.save(user); 
     } 
     authenticationManagerBuilder.userDetailsService(email -> { 
      return userService.loadUserByUsername(email); 
     }); 
    } 
} 

WebSecurityConfiguration.java

@Configuration 
@EnableWebSecurity 
@EnableGlobalMethodSecurity(prePostEnabled=true) 
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter { 

    static final String SIGNING_KEY = "kKSMJ92Mknk38njs9HJ8KNALiuc938FH"; 
    static final int ENCODING_STRENGTH = 256; 
    static final String SECURITY_REALM = "Task Manager"; 


    @Autowired 
    private BCryptPasswordEncoder passwordEncoder; 

    @Autowired 
    private UserDetailsService userDetailsService; 

    @Autowired 
    private DataSource dataSource; 




    @Override 
    protected void configure(AuthenticationManagerBuilder auth) throws Exception { 
     auth 
     .userDetailsService(userDetailsService) 
     .passwordEncoder(passwordEncoder) 
     .and() 
     .authenticationProvider(authenticationProvider()) 
     .jdbcAuthentication() 
     .dataSource(dataSource); 
    } 



    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http.sessionManagement() 
     .sessionCreationPolicy(SessionCreationPolicy.STATELESS) 
     .and() 
     .authorizeRequests() 
     .antMatchers("/sign-up", "/sign-in", "/").permitAll() 
     .antMatchers("/api/**").authenticated() 
     .and() 
     .httpBasic() 
     .realmName(SECURITY_REALM) 
     .and() 
     .csrf() 
     .disable(); 
    } 



    @Bean 
    public UserDetailsService userDetailsService() { 
     return super.userDetailsService(); 
    } 

    @Bean 
    public DaoAuthenticationProvider authenticationProvider() { 
     DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider(); 
     authenticationProvider.setUserDetailsService(userDetailsService); 
     authenticationProvider.setPasswordEncoder(passwordEncoder); 
     return authenticationProvider; 


} 

UserService.java

@Service 
public class UserService implements UserDetailsService { 

    @Autowired 
    private UserRepository userRepository; 

    @Autowired 
    private BCryptPasswordEncoder passwordEncoder; 

    public void save(User user) { 
     user.setPassword(passwordEncoder.encode(user.getPassword()));; 
     userRepository.save(user); 
    } 

    @Override 
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { 
     User user = this.userRepository.findUserByEmail(username); 
     if (user == null) { 
      throw new UsernameNotFoundException(username); 
     } 
     return new CustomUserDetails(user); 

    } 

} 

Answer 1

問題可能出在這裏。刪除註釋掉的行。

@Autowired 
public void authenticationManager(AuthenticationManagerBuilder authenticationManagerBuilder, final UserRepository userRepository, UserService userService) throws Exception { 
    if(userRepository.count() == 0) { 

     User user = new User(); 
     Role role = new Role(); 
     role.setName("SA"); 
     user.setEmail("test"); 
     user.setPassword("123"); 
     user.setRoles(Arrays.asList(role)); 
     user.setBlocked(false); 
     user.setEnable(true); 
     userService.save(user); 
    } 
    // authenticationManagerBuilder.userDetailsService(email -> { 
    //  return userService.loadUserByUsername(email); 
    // }); 
} 

要覆蓋所有您在配置類也做了多種配置，並因此口令編碼器永遠不會應用到您的AuthenticationManagerBuilder。