Question

我使用underow作为我的HTTP库，并希望验证每个请求的JWT令牌和HTTP方法。我不想在每个HttpHandler中实施验证。这是正确的方法吗？

Handler.java

public abstract class Handler implements HttpHandler {

    private HttpString[] methods;

    Handler(HttpString... methods) {
        this.methods = methods;
    }

    @Override
    public void handleRequest(HttpServerExchange httpServerExchange) throws Exception {
        // verifying HTTP method
        boolean verified = false;
        for (HttpString method : methods) {
            if (httpServerExchange.getRequestMethod().equals(method)) {
                verified = true;
                break;
            }
        }

        if (!verified) {
            // return http 405, cause: invalid HTTP method
            httpServerExchange.setStatusCode(StatusCodes.METHOD_NOT_ALLOWED);
            httpServerExchange.getResponseSender().send(Variables.Response.EMPTY);
        }

    // verifying JWT token
    String jwt = httpServerExchange.getRequestHeaders().get("jwt", 0);
    JWT.verifyToken(jwt)
            .addListener(token -> {
                if (token != null) {
                    handleVerifiedRequest(httpServerExchange, token);
                } else {
                    // return http 400, cause: JWT invalid
                    httpServerExchange.setStatusCode(StatusCodes.UNAUTHORIZED);
                    httpServerExchange.getResponseSender().send(Variables.Errors.INVALID_JWT);
                }
            });
    }

    public abstract void handleVerifiedRequest(HttpServerExchange httpServerExchange, String Token);
}

HelloHandler.java

public class HelloHandler extends Handler {

    public HelloHandler(HttpString... methods) {
        super(methods);
    }

    @Override
    public void handleVerifiedRequest(HttpServerExchange httpServerExchange, String Token) {
        // .. do something
    }
}

Answer 1

更可重用和推荐的方法是坚持使用Undertow HttpHandler API并将处理程序链接在一起。

首先，正如您已经提出的那样，您的JWT身份验证处理程序，检查请求中的传入令牌：

public class JwtAuthHandler implements HttpHandler {

  AttachmentKey<JwtToken> JWT_TOKEN = AttachmentKey.create(JwtToken.class);

  private final HttpHandler next;
  public JwtAuthHandler(HttpHandler next) {
    this.next = next;
  }

  @Override
  public void handleRequest(HttpServerExchange exchange) throws Exception {
    ...
    JWT.verifyToken(jwt)
        .addListener(token -> {
          if (token != null) {
            exchange.putAttachment(JWT_TOKEN, token);
            next.handleRequest(exchange);
          } else {
            // return http 400, cause: JWT invalid
            httpServerExchange.setStatusCode(StatusCodes.UNAUTHORIZED);
            httpServerExchange.getResponseSender().send(Variables.Errors.INVALID_JWT);
          }
        });
  }
}

但有一点不同，它只是实现了HttpHandler接口，并希望在成功的情况下调用 next HttpHandler。在下一个处理程序上调用 handleRequest 方法之前，请注意将当前有效标记添加为交换附件的行。附件是一种在处理程序之间传递数据的方法。

然后，您的 HelloHandler 只需要交换附件中的JwtToken（请注意，这只是一个猜测，我不知道您使用的JWT库，这只是类型您示例中的令牌变量。）

public class HelloHandler implements HttpHandler {

  @Override
  public void handleRequest(HttpServerExchange exchange) throws Exception {
    JwtToken token = exchange.getAttachment(JWT_TOKEN);
    ...
  }
}

只有在请求验证成功时才会调用此处理程序。

正如您可能知道的那样，处理程序应该被链接在一起：

Undertow.builder()
    .addHttpListener(8080, "0.0.0.0")
    .setHandler(new JwtAuthHandler(new HelloHandler()))
    .build().start();

如果你坚持使用HttpHandler API，你可以轻松地集成和使用Undertow提供的现有处理程序，看看here。

Answer 2

您的方法将强制子类实施handleVerifiedRequest，但也允许某人重新实现handleRequest以绕过您的验证。要防止子类这样做，请将final关键字添加到抽象类中的原始方法。

public abstract class Handler implements HttpHandler {
    // ... //

    @Override
    public final void handleRequest(HttpServerExchange httpServerExchange) throws Exception {
       // ... your verification code ... //
    }

    public abstract void handleVerifiedRequest(HttpServerExchange httpServerExchange, String Token);
}

从抽象类中的回调调用抽象方法

2 个答案: