Spring Security 401 несанкционированный ⇐ JAVA

[Anonymous]

Я пытаюсь создать jwt-аутентификацию и вернуть токен, пароль хранится в коде, вот весь код
package com.example.test.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import com.example.test.security.JwtAuthenticationEntryPoint;
import com.example.test.security.JwtRequestFilter;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

@Autowired
private JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;

@Autowired
private JwtRequestFilter jwtRequestFilter;

@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}

@Bean
public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
return authConfig.getAuthenticationManager();
}

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.csrf(csrf -> csrf.disable())
.authorizeHttpRequests(authz -> authz
.requestMatchers("/hello", "/authenticate").permitAll()
.anyRequest().authenticated()
)
.exceptionHandling(excpHandler -> excpHandler.authenticationEntryPoint(jwtAuthenticationEntryPoint))
.sessionManagement(sessionManager -> sessionManager.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

http.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);

return http.build();
}
}

-----------JwtAuthenticationEntryPoint.java --------------
package com.example.test.security;

import java.io.IOException;
import java.io.Serializable;

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.stereotype.Component;

@Component
public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint, Serializable {

private static final long serialVersionUID = -7858869558953243875L;

@Override
public void commence(HttpServletRequest request, HttpServletResponse response,
AuthenticationException authException) throws IOException {

response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
}
}

----------------------JwtRequestFilter.java-------------- -------------
package com.example.test.security;

import java.io.IOException;

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

@Component
public class JwtRequestFilter extends OncePerRequestFilter {

@Autowired
private JwtUserDetailsService jwtUserDetailsService;

@Autowired
private JwtTokenUtil jwtTokenUtil;

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
throws ServletException, IOException {

final String requestTokenHeader = request.getHeader("Authorization");

String username = null;
String jwtToken = null;

if (requestTokenHeader != null && requestTokenHeader.startsWith("Bearer ")) {
jwtToken = requestTokenHeader.substring(7);
try {
username = jwtTokenUtil.extractUsername(jwtToken);
} catch (IllegalArgumentException e) {
System.out.println("Unable to get JWT Token");
}
} else {
logger.warn("JWT Token does not begin with Bearer String");
}

if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
UserDetails userDetails = this.jwtUserDetailsService.loadUserByUsername(username);

if (jwtTokenUtil.validateToken(jwtToken, userDetails)) {
UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(
userDetails, null, userDetails.getAuthorities());
usernamePasswordAuthenticationToken
.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
}
}
chain.doFilter(request, response);
}
}

----------------------------JwtTokenUtil.java-------- -----------------------
package com.example.test.security;

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;

import java.util.Date;
import java.util.HashMap;
import java.util.Map;
import java.util.function.Function;

@Component
public class JwtTokenUtil {

@Value("${jwt.secret}")
private String secret;

@Value("${jwt.expiration}")
private Long expiration;

public String generateToken(UserDetails userDetails) {
Map claims = new HashMap();
return createToken(claims, userDetails.getUsername());
}

private String createToken(Map claims, String subject) {
return Jwts.builder()
.setClaims(claims)
.setSubject(subject)
.setIssuedAt(new Date(System.currentTimeMillis()))
.setExpiration(new Date(System.currentTimeMillis() + expiration))
.signWith(SignatureAlgorithm.HS512, secret)
.compact();
}

public Boolean validateToken(String token, UserDetails userDetails) {
final String username = extractUsername(token);
return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
}

public String extractUsername(String token) {
return extractClaim(token, Claims::getSubject);
}

public Date extractExpiration(String token) {
return extractClaim(token, Claims::getExpiration);
}

public T extractClaim(String token, Function claimsResolver) {
final Claims claims = extractAllClaims(token);
return claimsResolver.apply(claims);
}

private Claims extractAllClaims(String token) {
return Jwts.parser().setSigningKey(secret).parseClaimsJws(token).getBody();
}

private Boolean isTokenExpired(String token) {
return extractExpiration(token).before(new Date());
}
}

------------------------------JwtUserDetailsService.java------ ------------------------------------
package com.example.test.security;

import java.util.ArrayList;

import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

@Service
public class JwtUserDetailsService implements UserDetailsService {

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
// Here you should fetch the user from the database
// For simplicity, we're using a hardcoded user
if ("testuser".equals(username)) {
return new User("testuser", "$2a$10$Dow0gxhEG2KfF7cCB.PuUOec91J7Fhze5K7ySDo.KT2V.bqBCwE0u",
new ArrayList());
} else {
throw new UsernameNotFoundException("User not found with username: " + username);
}
}
}

---------------------------контроллер----------- -----------------
package com.example.test.controller;

import java.util.List;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.ResponseEntity;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.DisabledException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RestController;

import com.example.test.dto.EmployeeDTO;
import com.example.test.security.JwtTokenUtil;
import com.example.test.service.EmployeeService;
import com.example.test.security.JwtUserDetailsService;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

@RestController
public class TestController {

private static final Logger logger = LoggerFactory.getLogger(TestController.class);

@Autowired
private EmployeeService employeeService;

@Autowired
private AuthenticationManager authenticationManager;

@Autowired
private JwtTokenUtil jwtTokenUtil;

@Autowired
private JwtUserDetailsService userDetailsService;

@GetMapping("/hello")
public String hello() {
return "Hellooo";
}

@GetMapping("/listemployee")
public List listEmployee() {
return employeeService.getAllEmployeesWithDeptAndSales();
}

@PostMapping("/authenticate")
public ResponseEntity createAuthenticationToken(@RequestBody JwtRequest authenticationRequest) throws Exception {
logger.info("Request received for username: {}", authenticationRequest.getUsername());

// Log password only if needed for debugging, but avoid this in production
logger.debug("Password provided: {}", authenticationRequest.getPassword());

authenticate(authenticationRequest.getUsername(), authenticationRequest.getPassword());

final UserDetails userDetails = userDetailsService.loadUserByUsername(authenticationRequest.getUsername());
logger.info("User authenticated: {}", userDetails.getUsername());

final String token = jwtTokenUtil.generateToken(userDetails);
logger.info("Generated JWT Token: {}", token);

return ResponseEntity.ok(new JwtResponse(token));
}

private void authenticate(String username, String password) throws Exception {
try {
authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password));
} catch (DisabledException e) {
throw new Exception("USER_DISABLED", e);
} catch (BadCredentialsException e) {
throw new Exception("INVALID_CREDENTIALS", e);
}
}
}

class JwtRequest {
private String username;
private String password;
// getters and setters

// Default constructor (needed for JSON deserialization)
public JwtRequest() {
}

// Getter for username
public String getUsername() {
return username;
}

// Setter for username
public void setUsername(String username) {
this.username = username;
}

// Getter for password
public String getPassword() {
return password;
}

// Setter for password
public void setPassword(String password) {
this.password = password;
}
}

class JwtResponse {
private final String jwttoken;

public JwtResponse(String jwttoken) {
this.jwttoken = jwttoken;
}

public String getToken() {
return this.jwttoken;
}
}


я использую почтальон для отправки запроса на публикацию с необработанным телом и json
{
"имя ​​пользователя ": "testuser",
"password": "password123"

но это был 401 несанкционированный, похоже, пароль неправильный, кто-нибудь знает, что это такое проблема?
и логи есть
2024-10-01T22:43:15.414+08:00 DEBUG 22328 --- [test] [nio-8080-exec-5] o.s.security.web.FilterChainProxy : Securing POST /authenticate
2024-10-01T22:43:15.414+08:00 WARN 22328 --- [test] [nio-8080-exec-5] c.e.test.security.JwtRequestFilter : JWT Token does not begin with Bearer String
2024-10-01T22:43:15.415+08:00 DEBUG 22328 --- [test] [nio-8080-exec-5] o.s.s.w.a.AnonymousAuthenticationFilter : Set SecurityContextHolder to anonymous SecurityContext
2024-10-01T22:43:15.415+08:00 DEBUG 22328 --- [test] [nio-8080-exec-5] o.s.security.web.FilterChainProxy : Secured POST /authenticate
2024-10-01T22:43:15.417+08:00 INFO 22328 --- [test] [nio-8080-exec-5] c.e.test.controller.TestController : Request received for username: testuser
2024-10-01T22:43:15.560+08:00 DEBUG 22328 --- [test] [nio-8080-exec-5] o.s.s.a.dao.DaoAuthenticationProvider : Failed to authenticate since password does not match stored value
2024-10-01T22:43:15.563+08:00 DEBUG 22328 --- [test] [nio-8080-exec-5] o.s.security.web.FilterChainProxy : Securing POST /error
2024-10-01T22:43:15.564+08:00 DEBUG 22328 --- [test] [nio-8080-exec-5] o.s.s.w.a.AnonymousAuthenticationFilter : Set SecurityContextHolder to anonymous SecurityContext


Подробнее здесь: https://stackoverflow.com/questions/790 ... authorized