스프링 보안 + JWT + 인증 및 hasRole이 작동하지 않습니까?

Question

내 문제는 사용자가으로 로그인 할 때 사용자를 인증 할 수 없다는 것입니다. 내가 hasRole("CUSTOMER")를 사용하는 경우

public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 

// Web Security 

@Autowired 
private UserDetailsService userDetailsService; 

@Bean 
public PasswordEncoder passwordEncoder() { 
    return new BCryptPasswordEncoder(); 
} 

@Autowired 
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
    auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder()); 
} 


// Authentication and Authorization 

@Override 
protected void configure(HttpSecurity http) throws Exception { 
    http.csrf().disable(); 

    //h2 database console 
    http.headers().frameOptions().disable(); 

    http.exceptionHandling() 
      .and().anonymous() 
      .and().servletApi() 
      .and().headers().cacheControl(); 
    http.addFilterBefore(
      new JWTLoginFilter("/login", authenticationManager()), 
      UsernamePasswordAuthenticationFilter.class); 
    http.addFilterBefore(
      new JWTAuthenticationFilter(), 
      UsernamePasswordAuthenticationFilter.class); 
    http.authorizeRequests() 
      .antMatchers(HttpMethod.GET, "/api/**").authenticated() 
      .antMatchers(HttpMethod.GET, "/login").permitAll(); 

    http.logout() 
      .logoutUrl("/api/logout") 
      .logoutSuccessUrl("/api/index") 
      .invalidateHttpSession(true); 

} 

}

다음 값 message: Access is denied와 reponse 다음과 같이 나는, 내 WebSecurityConfig 파일에 문제가있는 것 같아요. 문제가있는 곳을 모르겠습니다. 여러 관련 파일 : JWTLoginFilter :

public class JWTLoginFilter extends AbstractAuthenticationProcessingFilter { 
public JWTLoginFilter(String url, AuthenticationManager authManager) { 
    super(new AntPathRequestMatcher(url)); 
    setAuthenticationManager(authManager); 
} 

@Override 
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException { 
    User credentials = new User(request.getParameter("username"), request.getParameter("email"), request.getParameter("password")); 
    return getAuthenticationManager().authenticate(
      new UsernamePasswordAuthenticationToken(
        credentials.getEmail(), 
        credentials.getPassword(), 
        Collections.emptyList() 
      ) 
    ); 
} 

@Override 
protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException { 
    TokenAuthenticationService.addAuthentication(response, authResult.getName()); 
} 

} JWTAuthenticationFilter :

public class JWTAuthenticationFilter extends GenericFilterBean { 
@Override 
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { 
    Authentication authentication = TokenAuthenticationService.getAuthentication((HttpServletRequest) servletRequest); 
    SecurityContextHolder.getContext().setAuthentication(authentication); 
    filterChain.doFilter(servletRequest, servletResponse); 
} 

} TokenAuthenticationService

public class TokenAuthenticationService { 
static final long EXPIRATIONTIME = 864_000_000; // 10 days 
static final String SECRET = "ThisIsASecret"; 
static final String TOKEN_PREFIX = "Bearer"; 
static final String HEADER_STRING = "Authorization"; 

public static void addAuthentication(HttpServletResponse res, String username) { 
    String JWT = Jwts.builder() 
      .setSubject(username) 
      .setExpiration(new Date(System.currentTimeMillis() + EXPIRATIONTIME)) 
      .signWith(SignatureAlgorithm.HS512, SECRET) 
      .compact(); 
    res.addHeader(HEADER_STRING, TOKEN_PREFIX+ " " + JWT); 
} 

public static Authentication getAuthentication(HttpServletRequest request) { 
    String token = request.getHeader(HEADER_STRING); 

    if (token != null) { 
     // parse the token. 
     String user = Jwts.parser() 
       .setSigningKey(SECRET) 
       .parseClaimsJws(token.replace(TOKEN_PREFIX, "")) 
       .getBody() 
       .getSubject(); 

     return user != null ? 
       new UsernamePasswordAuthenticationToken(user, null, emptyList()) : 
       null; 
    } 
    return null; 
} 

} 도와주세요! 감사!

Answer 1

우선 응용 프로그램이 실행되는 주 응용 프로그램 클래스에서 기본 메서드 인 BCryptPasswordEncoder 개체를 초기화하십시오. BCryptPasswordEncoder 개체 만 WebSecurityConfig 클래스에 초기화하십시오. 코드의 git repo를 공유 할 수 있다면 쉽게 해결할 수 있습니다. Here은 스프링 부트와 함께 JWT를 사용하는 아주 기본적인 애플리케이션으로 코드에 매우 익숙합니다. 대부분 우리는 0Auth 튜토리얼에서 배워야했습니다.