1. 技术文章
  2. Spring Security - Remember Me Authentication Error

Spring Security - Remember Me Authentication Error

由 眉间皱痕 提交于 2019-12-04 12:13:21

This is being caused by the FilterChainProxy being used after the SecurityContextPersistenceFilter. Specifically the FilterChainProxy's HttpFirewall is replacing the HttpServletResponse with a DefaultHttpFirewall which no longer implements the SavedRequest. To get around this, you can inject a custom HttpFirewall into the samlFilter FilterChainProxy that returns the same HttpServletResponse that is passed into it. For example:

public class DoNothingHttpFirewall implements HttpFirewall {

    public FirewalledRequest getFirewalledRequest(HttpServletRequest request) throws RequestRejectedException {
        return new MyFirewalledRequest(request);
    }

    public HttpServletResponse getFirewalledResponse(HttpServletResponse response) {
        return response;
    }

    private static class MyFirewalledRequest extends FirewalledRequest {
         MyFirewalledRequest(HttpServletRequest r) {
             super(r);
         }
         public void reset() {}
    }
}

You can then wire it using:

<bean id="samlFilter" class="org.springframework.security.web.FilterChainProxy">
  <security:filter-chain-map request-matcher="ant">
    <security:filter-chain pattern="/saml/login/**" filters="samlEntryPoint"/>
    <security:filter-chain pattern="/saml/SSO/**" filters="samlWebSSOProcessingFilter"/>
  </security:filter-chain-map>
  <property name="firewall">
    <bean class="DoNothingHttpFirewall"/>
  </property>
</bean>

I have logged a ticket to make this work transparently in the future https://jira.spring.io/browse/SEC-2578

I ran into this problem as well. My solution is inspired from @RobWinch's answer but using a perhaps safer implementation:

  1. create a class that extends DefaultHttpFirewall
  2. Override the getFirewalledResponse(HttpResponse response) method, replacing with one that checks the type of the response; if it is instanceof SaveContextOnUpdateOrErrorResponseWrapper, then trivially return the supplied response, and otherwise return return super.getFirewalledResponse().
  3. Inject a bean of this class using the property injection outlined in @RobWinch's answer.

This implementation is more consistent with the prior behavior of the FilterChainProxy and DefaultHttpFirewall as it will only trivially return the passed-in response when the type matches the error-prone response type. Otherwise, the super method is called, preserving the parent's logic. Also, the logic of the getFirewalledRequest(...) method is preserved, since this does not seem to be the source of the error in this case.

标签
spring-mvc
spring-security
remember-me
易学教程内所有资源均来自网络或用户发布的内容，如有违反法律规定的内容欢迎反馈！
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!