無法更改彈簧安全訪問被拒絕的標準響應

我有一個Spring Boot應用程序，我在Spring Security中使用了OAuth。當我請求授權令牌，以春季安全返回以下響應：無法更改彈簧安全訪問被拒絕的標準響應

我需要改變，以自定義的JSON響應，但沒有辦法我都試過的作品。

我曾嘗試使用自定義AccessDeniedHandler類似如下：

public class CustomOAuth2AccessDeniedHandler implements AccessDeniedHandler{ 

    public CustomOAuth2AccessDeniedHandler() { 
    } 

    @Override 
    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException authException) 
      throws IOException, ServletException { 
     response.setContentType(MediaType.TEXT_PLAIN_VALUE); 
     response.setStatus(HttpStatus.SC_INTERNAL_SERVER_ERROR); 
     response.getOutputStream().println("Exception with message : " + authException.getMessage()); 
     //doHandle(request, response, authException); 

    }

，但它不會被調用。使用web.xml重定向響應對我來說不是一種選擇，因爲我使用Spring Boot，而且我不想全局更改響應的格式。

我spring-security.xml配置是這樣的：

<!-- Definition of the Authentication Service --> 
<http pattern="/oauth/token" create-session="stateless" authentication-manager-ref="clientAuthenticationManager" 
     xmlns="http://www.springframework.org/schema/security"> 
    <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY"/> 
    <anonymous enabled="false"/> 
    <http-basic entry-point-ref="clientAuthenticationEntryPoint"/> 
    <!-- include this only if you need to authenticate clients via request parameters --> 
    <custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER"/> 
    <access-denied-handler ref="oauthAccessDeniedHandler"/> 
</http> 

<bean id="oauthAuthenticationEntryPoint" 
     class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"> 
    <property name="realmName" value="dstest"/> 
</bean> 

<bean id="clientAuthenticationEntryPoint" 
     class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"> 
    <property name="realmName" value="dstest/client"/> 
    <property name="typeName" value="Basic"/> 
</bean> 

<!-- <bean id="oauthAccessDeniedHandler" --> 
<!--  class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"/> --> 
<bean id="oauthAccessDeniedHandler" 
     class="in.robotrack.brad.config.CustomOAuth2AccessDeniedHandler"/> 


<bean id="clientCredentialsTokenEndpointFilter" 
     class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"> 
    <property name="authenticationManager" ref="clientAuthenticationManager"/> 
</bean> 

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased" 
     xmlns="http://www.springframework.org/schema/beans"> 
    <constructor-arg> 
     <list> 
      <bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter"/> 
      <bean class="org.springframework.security.access.vote.RoleVoter"/> 
      <bean class="org.springframework.security.access.vote.AuthenticatedVoter"/> 
     </list> 
    </constructor-arg> 
</bean> 

<!-- Authentication in config file --> 
<authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security"> 
    <authentication-provider user-service-ref="clientDetailsUserService"/> 
</authentication-manager> 

<authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security"> 
    <authentication-provider user-service-ref="customUserDetailsService"> 
    </authentication-provider> 
</authentication-manager> 

<bean id="clientDetailsUserService" 
     class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"> 
    <constructor-arg ref="clientDetails"/> 
</bean> 

<!-- Token Store --> 
<bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore"/> 

<bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"> 
    <property name="tokenStore" ref="tokenStore"/> 
    <property name="supportRefreshToken" value="true"/> 
    <property name="clientDetailsService" ref="clientDetails"/> 
    <!-- VIV --> 
    <property name="accessTokenValiditySeconds" value="10"/> 
</bean> 

<bean id="userApprovalHandler" 
     class="org.springframework.security.oauth2.provider.approval.TokenServicesUserApprovalHandler"> 
    <property name="tokenServices" ref="tokenServices"/> 
</bean>

來源

2017-04-20 joanlofe

嘗試波紋管：

HttpSecurity http = ... 
http.exceptionHandling().accessDeniedHandler(myAccessDeniedHandler);

，如果你不想定義自定義AccessdeniedHandler那麼即使你可以試試這個

HttpSecurity http = ... 
http.exceptionHandling().accessDeniedPage("/403");

然後在你的控制器中定義一個可以處理/ 403請求的方法映射，在那裏你只是返回你的403錯誤頁面，就像你在任何控制器類中的普通方法中那樣。

來源

2017-04-20 10:51:56 KAmit

無法更改彈簧安全訪問被拒絕的標準響應

回答

相關問題