Spring Security中自定义过滤器与JWT认证过滤器的执行顺序控制

@Component // 确保Spring能够发现并管理此过滤器 public class TenantFilter extends OncePerRequestFilter {     private static final Logger logger = LoggerFactory.getLogger(TenantFilter.class);     private static final String TENANT_HEADER = "X-Tenant";      @Override     protected void doFilterInternal(HttpservletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {         String tenantId = request.getHeader(TENANT_HEADER);         if (tenantId != null && !tenantId.isEmpty()) {             // 示例：根据租户ID设置连接字符串或租户上下文             String dbConnectionString = "jdbc:mysql://localhost:3306/" + tenantId + "?usessl=false";             ConnectionStorage.setConnection(dbConnectionString); // 假设ConnectionStorage是一个线程局部变量             logger.info("TenantFilter: Set connection for tenant: {}", tenantId);         } else {             logger.warn("TenantFilter: No X-Tenant header found.");         }         try {             filterChain.doFilter(request, response);         } finally {             ConnectionStorage.clear(); // 清理租户上下文             logger.info("TenantFilter: Cleared connection.");         }     } }

// JwtAuthenticationFilter (用于处理 /api/user/login 并生成JWT) public class JwtAuthenticationFilter extends UsernamePasswordAuthenticationFilter {     // ... 构造器和attemptAuthentication, successfulAuthentication 方法 ...     // attemptAuthentication 会尝试从数据库加载用户，此时就需要正确的租户连接 }  // JwtAuthorizationFilter (用于验证后续请求的JWT) public class JwtAuthorizationFilter extends BasicAuthenticationFilter {     // ... 构造器和doFilterInternal, getAuthentication 方法 ...     // getAuthentication 可能会从数据库加载用户，此时也需要正确的租户连接 }

import org.springframework.core.Ordered; import org.springframework.core.annotation.Order; import org.springframework.stereotype.Component; import org.springframework.web.filter.OncePerRequestFilter;  // ... 其他导入 ...  @Component @Order(Ordered.HIGHEST_PRECEDENCE) // 确保此过滤器具有最高的优先级 public class TenantFilter extends OncePerRequestFilter {     // ... 过滤器实现 ... }

Build AI

为您的业务构建自己的AI应用程序。不需要任何技术技能。

20

查看详情

// TenantFilter.Java (不带@Component或@Order) public class TenantFilter extends OncePerRequestFilter {     // ... 过滤器实现 ... }

import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;  @Configuration @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter {      // 假设你有自定义的UserDetailsService和PasswordEncoder     // @Autowired     // private UserDetailsService userDetailsService;     // @Autowired     // private PasswordEncoder passwordEncoder;      @Override     protected void configure(HttpSecurity http) throws Exception {         // 实例化你的自定义过滤器         TenantFilter tenantFilter = new TenantFilter(); // 如果TenantFilter有依赖，需要通过构造器注入或Spring上下文获取          // JwtAuthenticationFilter需要AuthenticationManager         // JwtAuthenticationFilter jwtAuthenticationFilter = new JwtAuthenticationFilter(authenticationManagerBean());         // jwtAuthenticationFilter.setFilterProcessesUrl("/api/user/login"); // 设置登录URL          // JwtAuthorizationFilter也需要AuthenticationManager         // JwtAuthorizationFilter jwtAuthorizationFilter = new JwtAuthorizationFilter(authenticationManagerBean());          http.csrf().disable() // 禁用CSRF             .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS) // 无状态会话             .and()             .authorizeRequests()                 .antMatchers("/api/user/login").permitAll() // 允许登录接口访问                 .anyRequest().authenticated() // 其他所有请求都需要认证             .and()             // 关键步骤：在Spring Security的任何过滤器之前添加TenantFilter             // UsernamePasswordAuthenticationFilter 是 Spring Security 认证流程的早期过滤器             // BasicAuthenticationFilter 也是认证/授权流程的早期过滤器             // 你可以选择一个合适的内置过滤器作为锚点             .addFilterBefore(tenantFilter, UsernamePasswordAuthenticationFilter.class)             // .addFilterBefore(tenantFilter, BasicAuthenticationFilter.class) // 也可以选择在BasicAuthenticationFilter之前              // 添加你的JWT认证过滤器 (如果需要自定义)             // .addFilter(jwtAuthenticationFilter) // 如果是自定义的UsernamePasswordAuthenticationFilter，直接addFilter即可             // .addFilterBefore(jwtAuthorizationFilter, UsernamePasswordAuthenticationFilter.class); // JwtAuthorizationFilter通常在认证之后，但需要在其他安全检查之前             ;          // 推荐：使用Spring Security内置的JWT/OAuth2支持，而不是自定义实现         // 如果使用Spring Security的OAuth2资源服务器，配置会更简洁         // http.oauth2ResourceServer().jwt();     }      // Spring Security 5.7+ 推荐通过SecurityFilterChain Bean来配置     /*     @Bean     public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {         TenantFilter tenantFilter = new TenantFilter(); // 实例化         // ... 其他配置 ...         http.addFilterBefore(tenantFilter, UsernamePasswordAuthenticationFilter.class);         // ...         return http.build();     }     */      @Bean     @Override     public AuthenticationManager authenticationManagerBean() throws Exception {         return super.authenticationManagerBean();     }      // 配置UserDetailsService和PasswordEncoder     // @Override     // protected void configure(AuthenticationManagerBuilder auth) throws Exception {     //     auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder);     // } }