基於Spring Security Header的認證

Question

默認情況下，spring security通過將JSESSIONID cookie添加到會話中來運行。我已經使用過並看到了很多基於表單的完成相同結果的表單（通常使用一個或兩個過濾器）。但我覺得這是我應該能夠在配置中設置的東西。在這樣的形式：

config.setTokenLocation(TokenLocationEnum.HEADER) 
config.setTokenName("Bearer") 

或

config.setTokenLocation(TokenLocationEnum.COOKIE) 
config.setTokenName("JSESSIONID") 

我想試試這個實現自己，但我首先要看看是否有人有異議的想法，爲什麼它尚未實施。

感謝

Answer 1

您可以配置Spring Security，只要你想。通過JSESSIONID進行會話管理只是一個開箱即用的工具。例如，如果您要使用承載OAuth 2.0令牌，則需要配置AuthServer。這是在配置的例子來自我的一個項目：

@EnableAuthorizationServer 
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter 
{ 
    private final AuthenticationManager authenticationManager; 

    private final InGridSecurityProperties inGridSecurityProperties; 

    @Autowired 
    public AuthorizationServerConfig(AuthenticationManager authenticationManager, InGridSecurityProperties inGridSecurityProperties, GoogleConnectionFactory connectionFactory) { 
     this.authenticationManager = authenticationManager; 
     this.inGridSecurityProperties = inGridSecurityProperties; 
     this.connectionFactory = connectionFactory; 
    } 

    @Override public void configure(ClientDetailsServiceConfigurer clients) throws Exception 
    { 
     clients.inMemory() 
         .withClient(inGridSecurityProperties.getClientId()) 
         .secret(inGridSecurityProperties.getClientSecret()) 
         .authorities("ROLE_TRUSTED_CLIENT") 
         .authorizedGrantTypes(inGridSecurityProperties.getGrantTypes()) 
         .scopes(inGridSecurityProperties.getClientScope()) 
         .accessTokenValiditySeconds(
             inGridSecurityProperties.getAccessTokenValiditySeconds()) 
         .refreshTokenValiditySeconds(
             inGridSecurityProperties.getRefreshTokenValiditySeconds()); 
    } 

    @Override public void configure(AuthorizationServerSecurityConfigurer security) throws Exception 
    { 
     security.tokenKeyAccess("isAnonymous() || hasAuthority('ROLE_TRUSTED_CLIENT')") 
         .checkTokenAccess("hasAuthority('ROLE_TRUSTED_CLIENT')"); 
    } 

    @Override public void configure(AuthorizationServerEndpointsConfigurer endpoints) 
        throws Exception 
    { 
     endpoints 
         .authenticationManager(authenticationManager) 
         .tokenStore(jwtTokenStore()) 
         .tokenEnhancer(jwtAccessTokenConverter()); 
    } 


    @Bean 
    public JwtAccessTokenConverter jwtAccessTokenConverter() 
    { 
     JwtAccessTokenConverter converter = new JwtAccessTokenConverter(); 
     KeyPair keyPair = new KeyStoreKeyFactory(
         new ClassPathResource(inGridSecurityProperties.getJwtKeyStore()), 
         inGridSecurityProperties.getJwtKeyStorePassword().toCharArray()) 
         .getKeyPair(inGridSecurityProperties.getJwtKeyPairAlias(), 
             inGridSecurityProperties.getJwtKeyPairPassword().toCharArray()); 
     converter.setKeyPair(keyPair); 
     return converter; 
    } 


} 

你可以在Spring中的安全文檔查找更多信息：http://docs.spring.io/spring-security/site/docs/current/reference/