Spring Security采用JWT验证时filter异常处理和JWT续期问题

最新推荐文章于 2024-08-28 13:41:04 发布

fooleryang

最新推荐文章于 2024-08-28 13:41:04 发布

阅读量2.3k

点赞数 4

分类专栏：其它文章标签： spring java

本文链接：https://blog.csdn.net/hey_lie/article/details/134201753

版权

其它专栏收录该内容

25 篇文章 2 订阅

订阅专栏

问题描述

security+jwt进行身份认证授权时，在登录前通常增加一个jwtfilter进行jwt验证，filter中的异常并不会被全局异常捕获，导致返回数据格式与统一格式不对

具体描述为： jwtfilter中对分发的token进行验证时抛出的异常捕获统一返回

问题出现原因

通常的filter时java web提供，并不被spring接管

解决方案将异常抛给controller

JWTFilter中处理异常并跳转到异常处理控制器，再由控制器抛出异常，最终被全局异常捕获，统一返回格式

jwt验证时通常会抛出4中异常

ExpiredJwtException token过期时抛出

MalformedJwtException token的格式错误，即token被篡改

SignatureException token签名错误，生成 token 和解析 token 使用的 SECRET 签名不一致就会报这个错误

```
UnsupportedJwtException jwt不支持
```

在进行jwt验证时捕获这4种异常，再处理异常信息抛给controller处理

具体步骤

1 在JwtAuthenticationTokenFilter extends OncePerRequestFilter 中

try {
                Claims claims = JwtUtil.parseJWT(token);
}catch (ExpiredJwtException exception){
                log.error("身份验证过期"+exception);
                request.setAttribute("jwtFilter.error",new BaseException("身份验证过期"));
                request.getRequestDispatcher("/error/jwtFilter").forward(request,response);
}catch (MalformedJwtException exception){
                log.error("JWT Token格式不对"+exception);
                request.setAttribute("jwtFilter.error",new BaseException("JWT Token格式不对"));
                request.getRequestDispatcher("/error/jwtFilter").forward(request,response);
}catch (SignatureException exception){
                //生成 token 和解析 token 使用的 SECRET 签名不一致就会报这个错误
                log.error("JWT 签名错误"+exception);
                request.setAttribute("jwtFilter.error",new BaseException("JWT 签名错误"));
                request.getRequestDispatcher("/error/jwtFilter").forward(request,response);
}catch (UnsupportedJwtException exception){
                log.error("不支持的 Jwt "+exception);
                request.setAttribute("jwtFilter.error",new BaseException("不支持的 Jwt"));
                request.getRequestDispatcher("/error/jwtFilter").forward(request,response);
}catch (Exception e) {
                log.error("jwt验证:"+e);
                request.setAttribute("jwtFilter.error",new BaseException("JWT 验证失败"));
                request.getRequestDispatcher("/error/jwtFilter").forward(request,response);
          
}

2 FilterExceptionController 中最终被抛出，会被全局异常处理器处理返回统一的数据格式

    @RequestMapping("/error/jwtFilter")
    public void jwtFilterException(HttpServletRequest reques){
        log.warn("jwt controller ");
        Exception e = (Exception) reques.getAttribute("jwtFilter.error");
        log.warn(e.getMessage());
        throw e;
    }

其他相关

security在认证授权时抛出的异常

认证时重写 AuthenticationEntryPoint

授权时重写 AccessDeniedHandler

@Component
public class CustomAuthenticationEntryPoint implements AuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {
        httpServletResponse.setCharacterEncoding("UTF-8");
        httpServletResponse.setContentType("application/json");
        httpServletResponse.getWriter().println(JSON.toJSON(BaseResponse.fail("1005",e.getMessage())));
        httpServletResponse.getWriter().flush();
    }
}



@Component
public class CustomAccessDeniedHandler implements AccessDeniedHandler {

    @Override
    public void handle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AccessDeniedException e) throws IOException, ServletException {
        httpServletResponse.setCharacterEncoding("UTF-8");
        httpServletResponse.setContentType("application/json");
        httpServletResponse.getWriter().println(JSON.toJSON(BaseResponse.fail("1004",e.getMessage())));
        httpServletResponse.getWriter().flush();
    }
}

在security配置中加入

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)//EnableGlobalMethodSecurity开启全局方法级别授权控制，prePostEnabled在执行方法前进行授权
public class SecurityConfig  extends WebSecurityConfigurerAdapter {
     @Override
    protected void configure(HttpSecurity http) throws Exception {
      //认证失败时的提示返回自定义信息
        http.exceptionHandling()
                .accessDeniedHandler(customAccessDeniedHandler)
                .authenticationEntryPoint(customAuthenticationEntryPoint);


    }
}