Spring Security REST Web服务匿名身份验证会话管理
我使用 Spring MVC 编写了一个 RESTful Web 服务。我基本上注册了一个客户，然后在注册后添加更多详细信息。流程基本如下：
输入第一组注册信息。这将由网络服务验证并返回给客户端
输入第二组注册信息。这也会由网络服务验证并返回给客户端。
报名已确认。用户现在可以通过各种网络服务调用添加更多特定帐户详细信息。
第 1 步和第 2 步不需要用户登录（不能登录，因为他们还没有完整的登录详细信息）。但是，我需要一个会话，因为除非步骤 1 已完成，否则用户不应该能够完成步骤 2。注册完成后，我希望用户登录并创建一个完整的身份验证会话，以便添加更多详细信息。
阅读了 spring security 文档后，我认为我可以接受成功注册后的经过身份验证的会话（尽管这很复杂，因为我没有实际的 login.jsp）。我从 Spring 文档中无法理解的是是否可以在匿名请求之间维护会话状态。看看如何从 SecurityContextHolder 中提取信息似乎都取决于 UserDetails （当然不存在）。我可以理解它如何处理单个未经身份验证的请求，但我只是不确定同一用户的多个未经身份验证的请求。
是否有可能在 Spring Security 中维护匿名请求的会话？
I've written a RESTful webservice using Spring MVC. I essentially enrole a customer then add further details following enrollment. The flow is basically as follows:
Enter 1st set of enrollment information. This gets validated by the webservice and returns to the client
Enter 2nd Set of enrollment information. This also gets validated by the webservice and returns to the client.
Enrollment is confirmed. User can now add further specific account details via various webservice calls.
Step 1 and 2 do not require the user to be logged in (they can't be as they don't have full login details yet). However, I need a session as users should not be able to complete step 2 unless step 1 has been completed. Once enrollment is complete I want the user to login and create a full authenticated session to enable further details to be added.
Having read the spring security docs I think I'm ok with the authenticated session following successful enrollment (although it's complicated because I don't have an actual login.jsp). What I can't understand from the Spring Docs is if it's even possible to maintain session state between anonymous requests. Looking at how information is pulled from the SecurityContextHolder all seems to depend upon UserDetails (which of course doesn't exist). I can understand how it will work for a single unathenticated request but I'm just unsure about multiple unauthenticated requests by the same user.
Is it even possible to maintain a session for anonymous requests in Spring Security.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论