Question

我试图阻止访问 api 端点，但登录。有了这些属性，当我尝试登录时，它给了我这个响应

{
    "timestamp": "2021-05-14T14:18:30.335+00:00",
    "status": 401,
    "error": "Unauthorized",
    "message": "Unauthorized",
    "path": "/login"
}

但是对于需要 jwt 令牌的 users-service/users/status/check，不需要一个即可

@Component
public class AuthorizationHeaderFilter extends 
AbstractGatewayFilterFactory<AuthorizationHeaderFilter.Config> {
private final Environment environment;

public AuthorizationHeaderFilter(Environment environment) {
    super(Config.class);
    this.environment = environment;
}

@Override
public GatewayFilter apply(Config config) {
    return (exchange, chain) -> {
        ServerHttpRequest request = exchange.getRequest();
        if (request.getHeaders().containsKey(HttpHeaders.AUTHORIZATION)) {
            return onError(exchange, "no auth header", HttpStatus.UNAUTHORIZED);
        }
        String authorizationHeader = request.getHeaders().get(HttpHeaders.AUTHORIZATION).get(0);
        String jwt = authorizationHeader.replace("Bearer", "");
        if (isJwtValid(jwt)) {
            return onError(exchange, "Jwt is not valid", HttpStatus.UNAUTHORIZED);
        }
        return chain.filter(exchange);
    };
}

public static class Config {
    // put
}



private Mono<Void> onError(ServerWebExchange exchange, String no_auth_header, HttpStatus unauthorized) {
    ServerHttpResponse response = exchange.getResponse();
    response.setStatusCode(unauthorized);
    return response.setComplete();
}

private boolean isJwtValid(String jwt) {
    String subject = Jwts.parser().setSigningKey(environment.getProperty("token.secret"))
            .parseClaimsJws(jwt).getBody().getSubject();
    return subject != null && !subject.isEmpty();
}
}

属性文件

    spring.cloud.gateway.routes[0].id=users-status-check
spring.cloud.gateway.routes[0].uri=lb://users-service
spring.cloud.gateway.routes[0].predicates[0]=Path=/users-service/users/status/check
spring.cloud.gateway.routes[0].predicates[1]=Method=GET
spring.cloud.gateway.routes[0].predicates[2]=Header=Authorization, Bearer (.*)
spring.cloud.gateway.routes[0].filters[0]=RemoveRequestHeader=Cookie
spring.cloud.gateway.routes[0].filters[1]=RewritePath=/users-service/(?<segment>.*), /$\{segment}
spring.cloud.gateway.routes[0].filters[2]=AuthorizationHeaderFilter

spring.cloud.gateway.routes[1].id=users-service
spring.cloud.gateway.routes[1].uri=lb://users-service
spring.cloud.gateway.routes[1].predicates[0]=Path=/users-service/users
spring.cloud.gateway.routes[1].predicates[1]=Method=POST
spring.cloud.gateway.routes[1].filters[0]=RemoveRequestHeader=Cookie
spring.cloud.gateway.routes[1].filters[1]=RewritePath=/users-service/(?<segment>.*), /$\{segment}

spring.cloud.gateway.routes[2].id=users-service-login
spring.cloud.gateway.routes[2].uri=lb://users-service
spring.cloud.gateway.routes[2].predicates[0]=Path=/users-service/login
spring.cloud.gateway.routes[2].predicates[1]=Method=POST
spring.cloud.gateway.routes[2].filters[0]=RemoveRequestHeader=Cookie
spring.cloud.gateway.routes[2].filters[1]=RewritePath=/users-service/(?<segment>.*), /$\{segment}

spring.cloud.gateway.routes[3].id=users-service-get-update-delete
spring.cloud.gateway.routes[3].uri=lb://users-service
spring.cloud.gateway.routes[3].predicates[0]=Path=/users-service/users/**
spring.cloud.gateway.routes[3].predicates[1]=Method=GET,PUT,DELETE
spring.cloud.gateway.routes[3].predicates[2]=Header=Authorization, Bearer (.*)
spring.cloud.gateway.routes[3].filters[0]=RemoveRequestHeader=Cookie
spring.cloud.gateway.routes[3].filters[1]=AuthorizationHeaderFilter
spring.cloud.gateway.routes[3].filters[2]=RewritePath=/users-service/(?<segment>.*), /$\{segment}

所有 spring 依赖项都是最新版本。 java 16 是 jdk 版本。你能告诉我问题吗？谢谢

未调用客户授权标头过滤器

0 个答案: