Spring Security：推迟使用 HTTP 基本身份验证之前的 IP 地址白名单
我有一个可通过 servlet 访问的 URL，我已使用 Spring Security 的 DaoAuthenticationProvider 锁定该 URL。我现在要求某些传入 IP 地址必须列入白名单，因此不需要进行身份验证。
如果 IP 地址与已知的 IP 地址匹配，我可以通过覆盖 DaoAuthenticationProvider 的验证方法并绕过超类的实现来轻松解决这个问题，但这仅在请求的发送者提供用户名和密码时才起作用（即使它是无意义的）。否则，提供商不会被调用。
最好的方法是什么？如果传入已知 IP 地址，我是否应该使用过滤器来绕过身份验证过程？
I have a single URL accessible through a servlet that I have locked down using Spring Security's DaoAuthenticationProvider. I now have the requirement that certain incoming IP addresses must be whitelisted and so are not requested to authenticate.
I can hack around this easily enough by overriding DaoAuthenticationProvider's authenticate method and bypassing the superclasses's implementation if the IP address matches a known IP address but this then only works when the sender of the request supplies a username and password (even if it's nonsense). Otherwise the provider doesn't get called.
What would be the best way to do this? Should I be using a filter to bypass the authentication procedure if a known IP address is incoming?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您可以使用
hasIpAddress()表达式？我们正在针对类似的案例这样做。Could you just use the
hasIpAddress()expression? We're doing that for what appears to be a similar case.我认为惯用的 Spring Security 方法是实现一个预身份验证过滤器，当客户端位于白名单中时，该过滤器将使用有效的 Authentication 对象填充安全上下文。您可以从头开始实现这样的过滤器（例如，如此处）或使用
AbstractPreAuthenticatedProcessingFilter（尽管它对于您的任务来说似乎过于复杂）。I think the idiomatic Spring Security way to do it is to implement a pre-authentication filter that would populate security context with a valid
Authenticationobject when client is in the whitelist. You can implement such a filter from scratch (for example, as here) or useAbstractPreAuthenticatedProcessingFilter(though it seems to be overcomplicated for your task).