Я хотел бы спросить, как удалять фильтр токена jwt, присоединяющийся к каждому запросу. На самом деле он мне нужен при каждом запросе, но не при входе в систему или регистрации. Я пытался с WebSecurityConfig, но это не сработало, я искал в Google, но решения тоже мне не помогли, поэтому я прошу здесь, я вставлю часть кода так что вы можете проверить это и дать мне предложения
я получаю
JWT Token does not begin with Bearer string
каждый раз, когда я сделал запрос от почтальона, чтобы войти или зарегистрироваться
WebSecurityConfig
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
// make sure we use stateless session; session won't be used to store user's state.
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
// authorization requests config
.authorizeRequests()
// allow all who are accessing "auth" service
.antMatchers(HttpMethod.POST, "/login").permitAll()
.antMatchers(HttpMethod.POST, "/register").permitAll()
// must be an admin if trying to access admin area (authentication is also required here)
.antMatchers("/admin/**").hasAuthority("ADMIN")
//for other uris
// .antMatchers(HttpMethod.GET, "/v1/**").hasRole("USER")
// Any other request must be authenticated
.anyRequest().authenticated()
.and()
// handle an authorized attempts
.exceptionHandling().authenticationEntryPoint((req, rsp, e) -> rsp.sendError(HttpServletResponse.SC_UNAUTHORIZED))
.and()
// Add a filter to validate the tokens with every request
.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
}
JwtRequestFilter
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
final String requestTokenHeader = request.getHeader("Authorization");
String username = null;
String jwtToken = null;
if(requestTokenHeader != null && requestTokenHeader.startsWith("Bearer ")){
jwtToken = requestTokenHeader.substring(7);
try {
username = jwtTokenUtil.getUsernameFromToken(jwtToken);
} catch (IllegalArgumentException e) {
logger.error("Unable to get JWT Token");
} catch (ExpiredJwtException e) {
logger.info("JWT Token has expired");
}
} else {
logger.warn("JWT Token does not begin with Bearer string");
}
if(username != null && SecurityContextHolder.getContext().getAuthentication() != null) {
UserDetails userDetails = this.jwtUserDetailsService.loadUserByUsername(username);
if(jwtTokenUtil.validateToken(jwtToken, userDetails)) {
UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(
userDetails, null, userDetails.getAuthorities());
usernamePasswordAuthenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
}
}
filterChain.doFilter(request, response);
}
}
JwtAuthenticationEntryPoint
@Override
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
}
AuthRest
@RequestMapping(value = "/login", method = RequestMethod.POST)
public ResponseEntity<?> login(@RequestBody JwtRequest authenticationRequest) throws Exception {
authenticate(authenticationRequest.getUsername(), authenticationRequest.getPassword());
final UserDetails userDetails = this.jwtUserDetailsService.loadUserByUsername(authenticationRequest.getUsername());
final String token = jwtToken.generateToken(userDetails);
return ResponseEntity.ok(new JwtResponse(token));
}
private void authenticate(String username, String password) throws Exception {
try {
authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password));
} catch (DisabledException e) {
throw new Exception("USER_DISABLED", e);
} catch (BadCredentialsException e) {
throw new Exception("INVALID_CREDENTIALS", e);
}
}
UserRest
@PostMapping(value = "/register")
public ResponseEntity<?> register(@RequestBody UserDto userDto) {
String username = userDto.getEmail();
User user = new User();
if(userRepo.existsByEmail(username)){
return new ResponseEntity<>(new ApiResponse(false, "Email already exists!"), HttpStatus.BAD_REQUEST);
}
user.setEmail(userDto.getEmail());
user.setFullName(userDto.getFullName());
user.setPassword(new BCryptPasswordEncoder().encode(userDto.getPassword()));
User result = userRepo.save(user);
URI location = ServletUriComponentsBuilder
.fromCurrentContextPath().path("/users/{username}")
.buildAndExpand(result.getEmail()).toUri();
return ResponseEntity.created(location).body(new ApiResponse(true, "User registered successfully"));
}