Spring boot 前后台分离项目 怎么处理spring security 抛出的异常

原创
2018/05/07 10:33
阅读数 2.5W

最近在开发一个项目 前后台分离的 使用 spring boot + spring security + jwt 实现用户登录权限控制等操作。但是 在用户登录的时候,怎么处理spring  security  抛出的异常呢?使用了@RestControllerAdvice 和@ExceptionHandler 不能处理Spring Security抛出的异常,如 UsernameNotFoundException等,我想要友好的给前端返回提示信息  如,用户名不存在之类的。 贴上我的代码:

JWT 验证类 : 重写了spring security UsernamaPasswordAuthenticationFilter

public class JWTAuthenticationFilter extends UsernamePasswordAuthenticationFilter {

    private AuthenticationManager authenticationManager;

    private RedisServiceImpl redisService;

    private AppConfig appConfig;

    public JWTAuthenticationFilter(AuthenticationManager authenticationManager, RedisServiceImpl redisService, AppConfig appConfig) {
        this.authenticationManager = authenticationManager;
        this.redisService = redisService;
        this.appConfig = appConfig;
    }

    /**
     * @param req
     * @param res
     * @return
     * @throws AuthenticationException
     * @// TODO: 2018/4/12 接受并解析用户凭证
     */
    @Override
    public Authentication attemptAuthentication(HttpServletRequest req, HttpServletResponse res) throws AuthenticationException {
        try {
            AuthEntity creds = new ObjectMapper()
                    .readValue(req.getInputStream(), AuthEntity.class);

            //验证码校验
            if (appConfig.getCaptchaEnabled()) { //如果开启了验证码登录校验功能
                if (StringUtils.isBlank(creds.getCaptcha())) {
                    logger.error("验证码为空");
                    throw new WelendException(StatusCode.CAPTCHA_EMPTY);
                }
                if (!redisService.exists(appConfig.getCaptchaKey())) {
                    logger.error("验证码已失效");
                    throw new WelendException(StatusCode.CAPTCHA_OVERDUE);
                }
                String captcha = (String) redisService.get(appConfig.getCaptchaKey());
                if (!creds.getCaptcha().equals(captcha)) {
                    logger.error("验证码不正确");
                    throw new WelendException(StatusCode.CAPTCHA_ERROR);
                }
            }
            return authenticationManager.authenticate(
                    new UsernamePasswordAuthenticationToken(
                            creds.getUsername(),
                            creds.getPassword(),
                            new ArrayList<>())
            );
        } catch (IOException e) {
            logger.error("Client's variables can't be parsed by com.fasterxml.jackson.core.JsonParse");
            throw new WelendException(StatusCode.SERVER_ERROR);
        }

    }
}

验证用户名 密码:

public class CustomAuthenticationProvider implements AuthenticationProvider {

    private UserDetailsServiceImpl userDetailsService;

    private BCryptPasswordEncoder bCryptPasswordEncoder;

    public CustomAuthenticationProvider(UserDetailsServiceImpl userDetailsService, BCryptPasswordEncoder bCryptPasswordEncoder) {
        this.userDetailsService = userDetailsService;
        this.bCryptPasswordEncoder = bCryptPasswordEncoder;
    }

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        // 获取认证的用户名 & 密码
        String name = authentication.getName();
        String password = authentication.getCredentials().toString();
        // 认证逻辑
        JWTUserDetails userDetails = userDetailsService.loadUserByUsername(name);
        if (null != userDetails) {
            Boolean verifyPwd = bCryptPasswordEncoder.matches(password,userDetails.getLoginPwd());
            if (verifyPwd) {
                // 生成令牌 这里令牌里面存入了:userDetails,password,authorities(权限列表)
                Authentication auth = new UsernamePasswordAuthenticationToken(userDetails, password, userDetails.getAuthorities());
                return auth;
            } else {
                throw new BadCredentialsException("username or password wrong!");
            }
        } else {
            throw new UsernameNotFoundException("can not find this account");
        }
    }

    /**
     * 是否可以提供输入类型的认证服务
     * @param authentication
     * @return
     */
    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }

}

全局异常处理

@RestControllerAdvice
public class GlobalExceptionHandler {
    private Logger logger = LoggerFactory.getLogger(getClass());

    /**
     * @param request
     * @param exception
     * @return
     * @throws Exception
     * @// TODO: 2018/4/25 参数未通过验证异常
     */
    @ExceptionHandler(value = MethodArgumentNotValidException.class)
    public Object MethodArgumentNotValidHandler(HttpServletRequest request, MethodArgumentNotValidException exception) throws Exception {
        //按需重新封装需要返回的错误信息
        //List<StatusCode> invalidArguments = new ArrayList<>();
        //解析原错误信息,封装后返回,此处返回非法的字段名称,原始值,错误信息
        ResultObject resultMsg = ResultObject.dataMsg(exception.getBindingResult().getFieldError().getDefaultMessage(), StatusCode.VARIABLE_ERROR);
        return resultMsg;
    }

    /**
     * @param request
     * @param exception
     * @return
     * @throws Exception
     * @// TODO: 2018/4/25 无法解析参数异常
     */
    @ExceptionHandler(value = HttpMessageNotReadableException.class)
    public Object HttpMessageNotReadableHandler(HttpServletRequest request, HttpMessageNotReadableException exception) throws Exception {
        logger.info(exception.getMessage());
        ResultObject resultMsg = ResultObject.dataMsg("参数无法正常解析", StatusCode.VARIABLE_ERROR);
        return resultMsg;
    }

    /**
     * @param exception
     * @return
     * @throws Exception
     * @// TODO: 2018/4/25 处理token 过期异常
     */
    @ExceptionHandler(value = ExpiredJwtException.class)
    public Object ExpiredJwtExceptionHandler(ExpiredJwtException exception) throws Exception {
        logger.info(exception.getMessage());
        ResultObject resultMsg = ResultObject.dataMsg("登录已过期!", StatusCode.FORBIDDEN);
        return resultMsg;
    }

    /**
     * @param request
     * @param exception
     * @return
     * @throws Exception
     * @// TODO: 2018/4/25 方法访问权限不足异常
     */
    @ExceptionHandler(value = AccessDeniedException.class)
    public Object AccessDeniedExceptionHandler(AccessDeniedException exception) throws Exception {
        logger.info(exception.getMessage());
        ResultObject resultMsg = ResultObject.dataMsg("权限不足!", StatusCode.FORBIDDEN);
        return resultMsg;
    }

    @ExceptionHandler(value = NoHandlerFoundException.class)
    public Object NoHandlerFoundExceptionHandler(NoHandlerFoundException exception) throws Exception {
        logger.info(exception.getMessage());
        return ResultObject.dataMsg("链接不存在", StatusCode.NOT_FOUND);
    }
    /**
     * 处理自定义异常
     */
    @ExceptionHandler(value = WelendException.class)
    public Object WelendExceptionHandler(WelendException e) {
        ResultObject r = new ResultObject();
        r.setStatus(String.valueOf(e.getCode()));
        r.setMessage(e.getMessage());
        return r;
    }

    @ExceptionHandler(value = AuthenticationException.class)
    public Object AuthenticationExceptionHandler(AuthenticationException e) {
        return ResultObject.dataMsg(e.getLocalizedMessage(),StatusCode.FORBIDDEN);
    }

    @ExceptionHandler(value = DuplicateKeyException.class)
    public Object DuplicateKeyExceptionHandler(DuplicateKeyException e) throws Exception {
        logger.error(e.getMessage(), e);
        return ResultObject.codeMsg(StatusCode.EXISTED);
    }

    @ExceptionHandler(value = BadCredentialsException.class)
    public Object BadCredentialsExceptionHandler(BadCredentialsException e) throws Exception {
        logger.error(e.getMessage(), e);
        return ResultObject.codeMsg(StatusCode.AUTH_ERROR);
    }

    @ExceptionHandler(value = Exception.class)
    public Object ExceptionHandler(Exception e) throws Exception {
        logger.error(e.getMessage(), e);
        return ResultObject.codeMsg(StatusCode.FAILED);
    }
}

登录时输入错误的用户名

控制台直接打印信息了, 并没有经过ExceptionHandler 处理。

如上所示,我想在全局异常类中 处理spring security抛出异常, 以便返回友好的提示信息。有什么解决办法么?

 

展开阅读全文
打赏
0
21 收藏
分享
加载中

引用来自“放手的风筝”的评论

你的异常抛出是在filter里面,filter和controller是两个概念
先走filter-->走完后才走controller就是说RestControllerAdvice根本就执行不到
处理方式模拟
public class TestFilter implements Filter {

  public void destroy() {
    // TODO Auto-generated method stub
    
  }

  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
      throws IOException, ServletException {
    if(1==1) {
      //方式1 直接print到前端,考虑的问题避免后续chain.doFilter()执行
      response.getWriter().write("filter print ok");
      
    }
  }

  public void init(FilterConfig arg0) throws ServletException {
    // TODO Auto-generated method stub
    
  }

}


public class TestFilter implements Filter {

  public void destroy() {
    // TODO Auto-generated method stub
    
  }

  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
      throws IOException, ServletException {
    if(1==1) {
      //方式2 使用filter拦截异常
      throw new RuntimeException("filter error");
      
    }
  }

  public void init(FilterConfig arg0) throws ServletException {
    // TODO A
正解
2019/01/08 12:04
回复
举报
liululee博主
OK, 首先谢谢大家的回答,给了我很多灵感。我的问题可以总结为:在spring security 进行用户验证的时候,想要抛出自定义的异常,并且该异常能通过ExceptionHandler捕获并处理。今天我在JWTAuthenticationFilter 这个方法中,注入了一个exceptionHandlerResovler 。
public class JWTAuthenticationFilter extends UsernamePasswordAuthenticationFilter {

private AuthenticationManager authenticationManager;

private RedisServiceImpl redisService;

private AppConfig appConfig;

private ExceptionHandlerResovler resolver;

public JWTAuthenticationFilter(AuthenticationManager authenticationManager, RedisServiceImpl redisService, AppConfig appConfig, ExceptionHanderResolver resolver) {
this.authenticationManager = authenticationManager;
this.redisService = redisService;
this.appConfig = appConfig;
this.resolver = resolver;
}

然后在下面的验证方法中, 就可以处理自己的异常,resolver.handlerException(request, response, null, new WelendException(StatusCode.CAPTCHA_ERROR));
通过这个调用,就可以用@ExceptionHandler(WelendException.class) 处理异常, 并返回json格式的数据给前端。
2018/05/08 20:42
回复
举报
我注入 exceptionHandlerResovler 报空指针异常
10/20 18:32
回复
举报
前后端分离的应该把后端的业务错误直接返给前端
2018/05/07 17:35
回复
举报
TOKEN的过滤器,我没有用。用的OncePerRequestFilter ,在里面进行的验证,然后抛出对应的401权限异常。
2018/05/07 16:01
回复
举报
还有一个ExceptionHandler 这个说明已经进入到controller层,权限认证哪个是filter层次,还没到controller,所以捕获不到
2018/05/07 15:48
回复
举报
@ControllerAdvice
public class GlobalExceptionHandler


  @ExceptionHandler(value = BusException.class)
  public Object busExceptionHandler(HttpServletRequest request, HttpServletResponse response, Exception e) {
    Boolean isAjax = isAjax(request);
    BusException bus = (BusException) e;
    String errorCode = bus.getErrorCode();
    String errorCodeMsg = bus.getErrorMessage();
    if (isAjax) {
      ResultObj<Object> retObj = new ResultObj<Object>();
      retObj.setCode(errorCode);
      retObj.setCodeMsg(errorCodeMsg);
      String jsonStr = JSON.toJSONString(retObj);
      responseJson(response, jsonStr);
      return null;
    } else {
      ModelAndView modelView = new ModelAndView();
      String viewName = "error-all";
      modelView.addObject("errorCode", errorCode);
      modelView.addObject("errorCodeMsg", errorCodeMsg);
      modelView.setViewName(viewName);
      return modelView;
    }
  }
2018/05/07 15:44
回复
举报
@Bean
public FilterRegistrationBean<ExceptionHandlerFilter> filterDemo3Registration() {
FilterRegistrationBean<ExceptionHandlerFilter> registration = new FilterRegistrationBean<ExceptionHandlerFilter>();
registration.setFilter(new ExceptionHandlerFilter());
registration.addUrlPatterns("/*");
registration.setOrder(1);
return registration;
}
2018/05/07 15:21
回复
举报
兄弟,你这种处理方法可以吗?有没有源码参考下?
2019/07/19 10:07
回复
举报
}

}



public class ExceptionHandlerFilter implements Filter {

  public void destroy() {
    // TODO Auto-generated method stub
    
  }

  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
      throws IOException, ServletException {
    try {
      chain.doFilter(request, response);
    } catch(Exception e) {
//处理对应异常
      if(e instanceof RuntimeException) {
        response.getWriter().print("ExceptionHandlerFilter print error");
      } else {
        try {
          throw e;
        } catch (Exception e1) {
          e1.printStackTrace();
        }
      }
    }
  }

  public void init(FilterConfig arg0) throws ServletException {
    
  }

}


//配置 ExceptionHandlerFilter的order要排在TestFilter前 TestFilter对应的就是JWTAuthenticationFilter
@Bean
public FilterRegistrationBean<TestFilter> testFilter() {
FilterRegistrationBean<TestFilter> registration = new FilterRegistrationBean<TestFilter>();
registration.setFilter(new TestFilter());
registration.addUrlPatter
2018/05/07 15:21
回复
举报
你的异常抛出是在filter里面,filter和controller是两个概念
先走filter-->走完后才走controller就是说RestControllerAdvice根本就执行不到
处理方式模拟
public class TestFilter implements Filter {

  public void destroy() {
    // TODO Auto-generated method stub
    
  }

  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
      throws IOException, ServletException {
    if(1==1) {
      //方式1 直接print到前端,考虑的问题避免后续chain.doFilter()执行
      response.getWriter().write("filter print ok");
      
    }
  }

  public void init(FilterConfig arg0) throws ServletException {
    // TODO Auto-generated method stub
    
  }

}


public class TestFilter implements Filter {

  public void destroy() {
    // TODO Auto-generated method stub
    
  }

  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
      throws IOException, ServletException {
    if(1==1) {
      //方式2 使用filter拦截异常
      throw new RuntimeException("filter error");
      
    }
  }

  public void init(FilterConfig arg0) throws ServletException {
    // TODO A
2018/05/07 15:20
回复
举报
更多评论
打赏
11 评论
21 收藏
0
分享
返回顶部
顶部