1 回答

TA貢獻(xiàn)1876條經(jīng)驗(yàn) 獲得超5個(gè)贊
你是對(duì)的,spring嘗試重定向到“/error”,因?yàn)槟阍贑ustomAuthEntryPoint中調(diào)用了response.sendError并嘗試再次進(jìn)行身份驗(yàn)證,因此你得到另一個(gè)InsufficentAuthentication異常。解決此問(wèn)題的一種方法是使用response.setStatus(401)而不是response.sendError方法。就像這樣:
@Component
public class CustomAuthEntryPoint implements AuthenticationEntryPoint {
@Override
public void commence(HttpServletRequest request, HttpServletResponse response,
AuthenticationException exception) throws IOException, ServletException {
System.out.println("entrypoint " + exception.getClass().getName());
response.getOutputStream().print(exception.getClass().getName());
response.setStatus(401);
}
}
或者,您可以從授權(quán)中排除“/error”url,但您必須小心不要泄漏該錯(cuò)誤端點(diǎn)上的敏感信息:
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.cors().and()
.logout().deleteCookies("SESSION").and()
.authorizeRequests()
.antMatchers("/actuator/**","/error").permitAll()
.anyRequest().authenticated().and()
.httpBasic().authenticationEntryPoint(customAuthEntryPoint).and()
.csrf().disable();
}
添加回答
舉報(bào)