[JavaScript知识库]关于每次请求都要执行两个即经过重写FilterInvocationSecurityMetadataSource的getAttributes()方法

关于每次请求都要执行两个,即经过重写FilterInvocationSecurityMetadataSource的getAttributes()方法

执行两次的方法

	@Override
    public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
        //获取请求地址
        String requestUrl = ((FilterInvocation) object).getRequestUrl();
        List<TbPermission> permissions = permissionMapper.selectPermissionsByUrl(requestUrl);
        if(permissions == null || permissions.size() == 0){
            //请求路径没有配置权限，表明该请求接口可以任意访问
            return null;
        }
        String[] attributes = new String[permissions.size()];
        for(int i = 0;i< permissions.size();i++){
            attributes[i] = permissions.get(i).getPermissionCode();
        }
        return SecurityConfig.createList(attributes);
    }

原因:

1. 自己定义了一个新的拦截器
2. 在extends AbstractSecurityInterceptor implements Filter,使用了 InterceptorStatusToken token = super.beforeInvocation(filterInvocation);

/**
 * @author sl
 * @date: 2022/2/22 22:12
 * @description: 权限拦截器
 */
@Component
public class CustomizeAbstractSecurityInterceptor extends AbstractSecurityInterceptor implements Filter {



    private FilterInvocationSecurityMetadataSource securityMetadataSource;

    @Autowired
    public CustomizeAbstractSecurityInterceptor(FilterInvocationSecurityMetadataSource securityMetadataSource) {
        this.securityMetadataSource = securityMetadataSource;
    }

    @Autowired
    public void setMyAccessDecisionManager(CustomizeAccessDecisionManager accessDecisionManager) {
        super.setAccessDecisionManager(accessDecisionManager);
    }

    @Override
    public Class<?> getSecureObjectClass() {
        return FilterInvocation.class;
    }

    @Override
    public SecurityMetadataSource obtainSecurityMetadataSource() {
        return securityMetadataSource;
    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        //为了安全的传送servletRequest、servletResponse、filterChain
        FilterInvocation fi = new FilterInvocation(servletRequest, servletResponse, filterChain);
        invoke(fi);
    }

    // 处理doFilter拦截下来的url
    private void invoke(FilterInvocation filterInvocation) throws IOException, ServletException {
        //调用MyInvocationSecurityMetadataSource的getAttributes(Object object)这个方法获取fi对应的所有权限
        //再MyAccessDecisionManager的decide方法来校验用户的权限是否足够
//        InterceptorStatusToken token = super.beforeInvocation(filterInvocation);
//        try {
//            //执行下一个拦截器
//            System.out.println("===========");
            filterInvocation.getChain().doFilter(filterInvocation.getRequest(), filterInvocation.getResponse());
//        } finally {
//            super.afterInvocation(token, null);
//        }
    }

解决方法:

1. 不使用新的filter
2. 直接注释掉InterceptorStatusToken token = super.beforeInvocation(filterInvocation);等影响的代码,然后直接让它执行下一个拦截器

我这里做的是直接执行下一个拦截器