我发现了一种在测试中效果很好的黑客程序。绕过内置的Spring连接级Spring auth机制。相反，可以通过在客户端的Stomp标头中发送身份验证令牌来在消息级别设置身份验证令牌（这很好地反映了常规HTTP XHR调用已在执行的操作），例如：
stompClient.connect({'X-Authorization': 'token'}, ...);
stompClient.subscribe(..., {'X-Authorization': 'token'});
stompClient.send("/wherever", {'X-Authorization': 'token'}, ...);
在服务器端，使用以下命令从Stomp消息中获取令牌： ChannelInterceptor
@Override
public void configureClientInboundChannel(ChannelRegistration registration) {
registration.setInterceptors(new ChannelInterceptorAdapter() {
Message<*> preSend(Message<*> message, MessageChannel channel) {
StompHeaderAccessor accessor = StompHeaderAccessor.wrap(message);
List tokenList = accessor.getNativeHeader("X-Authorization");
String token = null;
if(tokenList == null || tokenList.size < 1) {
return message;
} else {
token = tokenList.get(0);
if(token == null) {
return message;
}
}
// validate and convert to a Principal based on your own requirements e.g.
// authenticationManager.authenticate(JwtAuthentication(token))
Principal yourAuth = [...];
accessor.setUser(yourAuth);
// not documented anywhere but necessary otherwise NPE in StompSubProtocolHandler!
accessor.setLeaveMutable(true);
return MessageBuilder.createMessage(message.payload, accessor.messageHeaders)
}
})
这很简单，可以让我们达到85％的方式，但是，这种方法不支持向特定用户发送消息。这是因为Spring的将用户关联到会话的机制不受的结果影响ChannelInterceptor。Spring WebSocket假定身份验证是在传输层而不是消息层完成的，因此忽略了消息级身份验证。
使这项工作反正砍，就是创造我们的情况DefaultSimpUserRegistry和DefaultUserDestinationResolver，揭露那些环境，然后用拦截器来更新这些仿佛Spring本身是这样做。换句话说，类似：
@Configuration
@EnableWebSocketMessageBroker
@Order(HIGHEST_PRECEDENCE + 50)
class WebSocketConfig extends AbstractWebSocketMessageBrokerConfigurer() {
private DefaultSimpUserRegistry userRegistry = new DefaultSimpUserRegistry();
private DefaultUserDestinationResolver resolver = new DefaultUserDestinationResolver(userRegistry);
@Bean
@Primary
public SimpUserRegistry userRegistry() {
return userRegistry;
}
@Bean
@Primary
public UserDestinationResolver userDestinationResolver() {
return resolver;
}
@Override
public configureMessageBroker(MessageBrokerRegistry registry) {
registry.enableSimpleBroker("/queue", "/topic");
}
@Override
public registerStompEndpoints(StompEndpointRegistry registry) {
registry
.addEndpoint("/stomp")
.withSockJS()
.setWebSocketEnabled(false)
.setSessionCookieNeeded(false);
}
@Override public configureClientInboundChannel(ChannelRegistration registration) {
registration.setInterceptors(new ChannelInterceptorAdapter() {
Message<*> preSend(Message<*> message, MessageChannel channel) {
StompHeaderAccessor accessor = StompHeaderAccessor.wrap(message);
List tokenList = accessor.getNativeHeader("X-Authorization");
accessor.removeNativeHeader("X-Authorization");
String token = null;
if(tokenList != null && tokenList.size > 0) {
token = tokenList.get(0);
}
// validate and convert to a Principal based on your own requirements e.g.
// authenticationManager.authenticate(JwtAuthentication(token))
Principal yourAuth = token == null ? null : [...];
if (accessor.messageType == SimpMessageType.CONNECT) {
userRegistry.onApplicationEvent(SessionConnectedEvent(this, message, yourAuth));
} else if (accessor.messageType == SimpMessageType.SUBSCRIBE) {
userRegistry.onApplicationEvent(SessionSubscribeEvent(this, message, yourAuth));
} else if (accessor.messageType == SimpMessageType.UNSUBSCRIBE) {
userRegistry.onApplicationEvent(SessionUnsubscribeEvent(this, message, yourAuth));
} else if (accessor.messageType == SimpMessageType.DISCONNECT) {
userRegistry.onApplicationEvent(SessionDisconnectEvent(this, message, accessor.sessionId, CloseStatus.NORMAL));
}
accessor.setUser(yourAuth);
// not documented anywhere but necessary otherwise NPE in StompSubProtocolHandler!
accessor.setLeaveMutable(true);
return MessageBuilder.createMessage(message.payload, accessor.messageHeaders);
}
})
}
}
现在，Spring完全意识到了身份验证，即它将注入Principal到需要它的任何控制器方法中，将其公开给Spring Security 4.x的上下文，并将用户与WebSocket会话相关联，以向特定的用户/会话发送消息。
Spring Security Messaging
最后，如果你使用Spring Security 4.x Messaging支持，请确保将@Order你的AbstractWebSocketMessageBrokerConfigurer设置为高于Spring Security的值AbstractSecurityWebSocketMessageBrokerConfigurer（Ordered.HIGHEST_PRECEDENCE + 50将起作用，如上所示）。这样，你的拦截器将Principal在Spring Security执行其检查之前设置并设置安全上下文。
上面的代码中的这一行似乎使很多人感到困惑：
// validate and convert to a Principal based on your own requirements e.g.
// authenticationManager.authenticate(JwtAuthentication(token))
Principal yourAuth = [...];
这不是问题的范围，因为它不是特定于Stomp的，但是无论如何我都会对其进行一些扩展，因为它与在Spring中使用auth令牌有关。使用基于令牌的身份验证时，Principal通常需要的JwtAuthentication是扩展Spring Security的AbstractAuthenticationToken类的自定义类。AbstractAuthenticationToken实现Authentication扩展该Principal接口的接口，并包含将令牌与Spring Security集成的大多数机制。
因此，在Kotlin代码中（很抱歉，我没有时间或意愿将其转换回Java），你JwtAuthentication可能看起来像这样，这是一个简单的包装AbstractAuthenticationToken：
import my.model.UserEntity
import org.springframework.security.authentication.AbstractAuthenticationToken
import org.springframework.security.core.GrantedAuthority
class JwtAuthentication(
val token: String,
// UserEntity is your application's model for your user
val user: UserEntity? = null,
authorities: Collection<GrantedAuthority>? = null) : AbstractAuthenticationToken(authorities) {
override fun getCredentials(): Any? = token
override fun getName(): String? = user?.id
override fun getPrincipal(): Any? = user
}
现在你需要一个AuthenticationManager知道如何处理它的人。在Kotlin中，这可能看起来像以下内容：
@Component
class CustomTokenAuthenticationManager @Inject constructor(
val tokenHandler: TokenHandler,
val authService: AuthService) : AuthenticationManager {
val log = logger()
override fun authenticate(authentication: Authentication?): Authentication? {
return when(authentication) {
// for login via username/password e.g. crash shell
is UsernamePasswordAuthenticationToken -> {
findUser(authentication).let {
//checkUser(it)
authentication.withGrantedAuthorities(it).also { setAuthenticated(true) }
}
}
// for token-based auth
is JwtAuthentication -> {
findUser(authentication).let {
val tokenTypeClaim = tokenHandler.parseToken(authentication.token)[CLAIM_TOKEN_TYPE]
when(tokenTypeClaim) {
TOKEN_TYPE_ACCESS -> {
//checkUser(it)
authentication.withGrantedAuthorities(it).also { setAuthenticated(true) }
}
TOKEN_TYPE_REFRESH -> {
//checkUser(it)
JwtAuthentication(authentication.token, it, listOf(SimpleGrantedAuthority(Authorities.REFRESH_TOKEN)))
}
else -> throw IllegalArgumentException("Unexpected token type claim $tokenTypeClaim.")
}
}
}
else -> null
}
}
private fun findUser(authentication: JwtAuthentication): UserEntity =
authService.login(authentication.token) ?:
throw BadCredentialsException("No user associated with token or token revoked.")
private fun findUser(authentication: UsernamePasswordAuthenticationToken): UserEntity =
authService.login(authentication.principal.toString(), authentication.credentials.toString()) ?:
throw BadCredentialsException("Invalid login.")
@Suppress("unused", "UNUSED_PARAMETER")
private fun checkUser(user: UserEntity) {
// TODO add these and lock account on x attempts
//if(!user.enabled) throw DisabledException("User is disabled.")
//if(user.accountLocked) throw LockedException("User account is locked.")
}
fun JwtAuthentication.withGrantedAuthorities(user: UserEntity): JwtAuthentication {
return JwtAuthentication(token, user, authoritiesOf(user))
}
fun UsernamePasswordAuthenticationToken.withGrantedAuthorities(user: UserEntity): UsernamePasswordAuthenticationToken {
return UsernamePasswordAuthenticationToken(principal, credentials, authoritiesOf(user))
}
private fun authoritiesOf(user: UserEntity) = user.authorities.map(::SimpleGrantedAuthority)
}
注入的内容将TokenHandler抽象出JWT令牌解析，但应使用通用的JWT令牌库，如jjwt。注入的内容AuthService是你的抽象，它实际上是UserEntity根据令牌中的声明创建你的抽象的，并且可以与你的用户数据库或其他后端系统对话。
现在，回到我们开始与线，它可能是这个样子，哪里authenticationManager是一个AuthenticationManager注入由spring我们适配器，是一个实例CustomTokenAuthenticationManager上面定义我们：
Principal yourAuth = token == null ? null : authenticationManager.authenticate(new JwtAuthentication(token));
然后，将此主体附加到消息中，如上所述。HTH！
602392714
清零编程群