代码之家 › 专栏 › 技术社区 › peter Schiza

用JWT(弹簧+反作用力)固定腹板箱

spring-websocket jwt spring-boot reactjs

peter Schiza · 技术社区 · 8 年前

我想在spring boot中保护WebSocket。到目前为止,我成功地保护了正常的http请求,但WebSocket有问题。我希望能够确保安全,然后向特定用户发送消息。根据这些消息来源:

我写了以下代码:

@Configuration
@EnableWebSocketMessageBroker
@Order(Ordered.HIGHEST_PRECEDENCE + 99)
@Slf4j
public class WebSocketConfig implements WebSocketMessageBrokerConfigurer {

    @Autowired
    private JwtTokenProvider jwtTokenProvider;

    @Autowired
    private CustomUserServiceDetails customUserServiceDetails;



    @Override
    public void configureMessageBroker(MessageBrokerRegistry config) {
        config.enableSimpleBroker("/topic", "/queue");
        config.setApplicationDestinationPrefixes("/app");
    }

    @Override
    public void registerStompEndpoints(StompEndpointRegistry registry) {
        registry.addEndpoint("/voting-socket").setAllowedOrigins("*").withSockJS();
    }

    @Override
    public void configureClientInboundChannel(ChannelRegistration registration) {
        registration.setInterceptors(new ChannelInterceptorAdapter() {
            @Override
            public Message<?> preSend(Message<?> message, MessageChannel channel) {

                StompHeaderAccessor accessor = MessageHeaderAccessor.getAccessor(message, StompHeaderAccessor.class);

                if (StompCommand.CONNECT.equals(accessor.getCommand())) {

                    String header = accessor.getFirstNativeHeader("Authorization");

                    log.info("Header auth token: " + header);

                    String jwt = JwtTokenProvider.getToken(header);

                    log.info("Token only : " + jwt);

                    if (StringUtils.hasText(jwt) && jwtTokenProvider.validateToken(jwt)) {
                        Long userId = jwtTokenProvider.getUserIdFromJWT(jwt);

                        User user = (User) customUserServiceDetails.loadUserById(userId);

                        Principal principal = new UsernamePasswordAuthenticationToken(user, null, user.getAuthorities());

                        if (Objects.isNull(principal))
                            return null;

                        accessor.setUser(principal);
                    } else if (StompCommand.DISCONNECT.equals(accessor.getCommand())) {
                        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();

                        if (Objects.nonNull(authentication))
                            log.info("Disconnected Auth : " + authentication.getName());
                        else
                            log.info("Disconnected Sess : " + accessor.getSessionId());
                    }
                }

                return message;
            }



        });
    }
}

这和预期一样有效(身份验证有效)。但是现在,当我想添加用户注册表时:

@Autowired
private SimpUserRegistry userRegistry;

我的代码根本没有被执行(但没有得到任何关于接线或任何东西的错误)。我做错了什么?或者我应该使用一些不同的方法。我的主要目标是:

认证
能够使用converAndSendToUser方法。

0 回复 | 直到 8 年前