Thiết kế website giá rẻ

Question

I am developing and spring-boot application and to do some testing regarding the functionality of the jwt i created 2 endpoints one that returns all the information regarding the user and the second one that returns all the users in the db.

when i log in using postman i get the token but when i put it in the bearer and try to make use of the endpoints i always receive a forbidden only exception being when the token has expired for some reason it returns an 200 but does not return any of the information.

here is the code

ApplicationConfiguration

@Configuration
public class ApplicationConfiguration {
    private final EmployeeRepository employeeRepository;
    private final ClientRepository clientRepository;

    public ApplicationConfiguration(EmployeeRepository employeeRepository, ClientRepository clientRepository) {
        this.employeeRepository = employeeRepository;
        this.clientRepository = clientRepository;
    }

    @Bean
    public UserDetailsService employeeDetailsService() {
        return username -> employeeRepository.findByEmail(username)
            .orElseThrow(() -> new UsernameNotFoundException("Employee not found"));
    }

    @Bean
    public UserDetailsService clientDetailsService() {
        return username -> clientRepository.findByEmail(username)
            .orElseThrow(() -> new UsernameNotFoundException("Client not found"));
    }

    @Bean
    public BCryptPasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    private DaoAuthenticationProvider createDaoAuthenticationProvider(UserDetailsService userDetailsService) {
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
        authProvider.setUserDetailsService(userDetailsService);
        authProvider.setPasswordEncoder(passwordEncoder());
        return authProvider;
    }

    @Bean
    public AuthenticationProvider employeeAuthenticationProvider() {
        return createDaoAuthenticationProvider(employeeDetailsService());
    }

    @Bean
    public AuthenticationProvider clientAuthenticationProvider() {
        return createDaoAuthenticationProvider(clientDetailsService());
    }
}

JwtAuthenticationFilter

@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {
    private final HandlerExceptionResolver handlerExceptionResolver;

    private final JwtService jwtService;
    private final UserDetailsService employeeDetailsService;
    private final UserDetailsService clientDetailsService;

    public JwtAuthenticationFilter(
        JwtService jwtService,
        @Qualifier("employeeDetailsService") UserDetailsService employeeDetailsService,
        @Qualifier("clientDetailsService") UserDetailsService clientDetailsService,
        HandlerExceptionResolver handlerExceptionResolver
    ) {
        this.jwtService = jwtService;
        this.employeeDetailsService = employeeDetailsService;
        this.clientDetailsService = clientDetailsService;
        this.handlerExceptionResolver = handlerExceptionResolver;
    }

    @Override
    protected void doFilterInternal(
        @NonNull HttpServletRequest request,
        @NonNull HttpServletResponse response,
        @NonNull FilterChain filterChain
    ) throws ServletException, IOException {
        final String authHeader = request.getHeader("Authorization");

        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
            filterChain.doFilter(request, response);
            return;
        }

        try {
            final String jwt = authHeader.substring(7);
            final String userEmail = jwtService.extractUsername(jwt);

            Authentication authentication = SecurityContextHolder.getContext().getAuthentication();

            if (userEmail != null && authentication == null) {
                UserDetails userDetails = null;

                // Determinar qué UserDetailsService utilizar basado en el tipo de usuario
                if (userEmail.startsWith("EMPLOYEE_")) {
                    userDetails = this.employeeDetailsService.loadUserByUsername(userEmail);
                } else if (userEmail.startsWith("CLIENT_")) {
                    userDetails = this.clientDetailsService.loadUserByUsername(userEmail);
                }

                if (userDetails != null && jwtService.isTokenValid(jwt, userDetails)) {
                    UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
                            userDetails,
                            null,
                            userDetails.getAuthorities()
                    );

                    authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                    SecurityContextHolder.getContext().setAuthentication(authToken);
                }
            }

            filterChain.doFilter(request, response);
        } catch (Exception exception) {
            handlerExceptionResolver.resolveException(request, response, null, exception);
        }
    }
}

SecurityConfiguration

@Configuration
@EnableWebSecurity
public class SecurityConfiguration {
    private final JwtAuthenticationFilter jwtAuthenticationFilter;
    private final AuthenticationProvider employeeAuthenticationProvider;
    private final AuthenticationProvider clientAuthenticationProvider;

    public SecurityConfiguration(
        JwtAuthenticationFilter jwtAuthenticationFilter,
        AuthenticationProvider employeeAuthenticationProvider,
        AuthenticationProvider clientAuthenticationProvider
    ) {
        this.jwtAuthenticationFilter = jwtAuthenticationFilter;
        this.employeeAuthenticationProvider = employeeAuthenticationProvider;
        this.clientAuthenticationProvider = clientAuthenticationProvider;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(authorizeRequests -> authorizeRequests
                .requestMatchers("/auth/**").permitAll()
                .anyRequest().authenticated()
            )
            .sessionManagement(sessionManagement -> sessionManagement
                .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
            )
            .authenticationProvider(employeeAuthenticationProvider)
            .authenticationProvider(clientAuthenticationProvider)
            .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }

    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();

        configuration.setAllowedOrigins(List.of("http://localhost:8005"));
        configuration.setAllowedMethods(List.of("GET","POST"));
        configuration.setAllowedHeaders(List.of("Authorization","Content-Type"));

        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();

        source.registerCorsConfiguration("/**",configuration);

        return source;
    }

    @Bean
    public ProviderManager authenticationManager() {
        return new ProviderManager(Arrays.asList(employeeAuthenticationProvider, clientAuthenticationProvider));
    }
}

the service of the endpoints

@Service
public class UserService {
    private final EmployeeRepository employeeRepository;

    public UserService(EmployeeRepository employeeRepository) {
        this.employeeRepository = employeeRepository;
    }

    public List<Employee> allUsers() {
        return employeeRepository.findAll();
    }
}

and the controller

@RequestMapping("/users")
@RestController
public class UserController {
    private final UserService userService;

    public UserController(UserService userService) {
        this.userService = userService;
    }

    @GetMapping("/me")
    public ResponseEntity<Employee> authenticatedUser() {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();

        Employee currentUser = (Employee) authentication.getPrincipal();

        return ResponseEntity.ok(currentUser);
    }

    @GetMapping("/")
    public ResponseEntity<List<Employee>> allUsers() {
    try {   
        List <Employee> users = userService.allUsers();

        return ResponseEntity.ok(users);
    } catch (Exception e) {
        return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body(null);
    }
    }
}

JwtService

@Service
public class JwtService {
    
    private final UserDetailsService employeeDetailsService;
    private final UserDetailsService clientDetailsService;

    public JwtService(@Qualifier("employeeDetailsService") UserDetailsService employeeDetailsService, 
                      @Qualifier("clientDetailsService") UserDetailsService clientDetailsService) {
        this.employeeDetailsService = employeeDetailsService;
        this.clientDetailsService = clientDetailsService;
    }


    @Value("${security.jwt.secret-key}")
    private String secretKey;

    @Value("${security.jwt.expiration-time}")
    private long jwtExpiration;

    public String extractUsername(String token) {
        return extractClaim(token, Claims::getSubject);
    }

    public <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {
        final Claims claims = extractAllClaims(token);
        return claimsResolver.apply(claims);
    }

    public String generateToken(UserDetails userDetails) {
        return generateToken(new HashMap<>(), userDetails);
    }

    public String generateToken(Map<String, Object> extraClaims, UserDetails userDetails) {
        return buildToken(extraClaims, userDetails, jwtExpiration);
    }

    public long getExpirationTime() {
        return jwtExpiration;
    }

    private String buildToken(
            Map<String, Object> extraClaims,
            UserDetails userDetails,
            long expiration
    ) {
        return Jwts
                .builder()
                .setClaims(extraClaims)
                .setSubject(userDetails.getUsername())
                .setIssuedAt(new Date(System.currentTimeMillis()))
                .setExpiration(new Date(System.currentTimeMillis() + expiration))
                .signWith(getSignInKey(), SignatureAlgorithm.HS256)
                .compact();
    }
    
    public String refreshJwt(String expiredToken) {
        String username = extractUsername(expiredToken);
        UserDetails userDetails;
        
        if (username != null && username.startsWith("EMPLOYEE_")) {
            userDetails = employeeDetailsService.loadUserByUsername(username);
        } else if (username != null && username.startsWith("CLIENT_")) {
            userDetails = clientDetailsService.loadUserByUsername(username);
        } else {
            throw new RuntimeException("Invalid token or user not found");
        }
        
        if (username != null && isTokenExpired(expiredToken)) {
            Map<String, Object> extraClaims = new HashMap<>();
            String newToken = generateToken(extraClaims, userDetails);
            long newExpiration = jwtExpiration;
            
            try {
                Claims claims = extractAllClaims(newToken);
                Date expirationDate = claims.getExpiration();
                if (expirationDate != null) {
                    newExpiration = expirationDate.getTime() - System.currentTimeMillis();
                }
            } catch (Exception e) {
                throw new RuntimeException("Error extracting expiration time from new token");
            }
            
            return newToken + "|" + newExpiration; 
        } else {
            throw new RuntimeException("Invalid token or user not found");
        }
    }
    

    public boolean isTokenValid(String token, UserDetails userDetails) {
        final String username = extractUsername(token);
        return (username.equals(userDetails.getUsername())) && !isTokenExpired(token);
    }

    private boolean isTokenExpired(String token) {
        return extractExpiration(token).before(new Date());
    }

    private Date extractExpiration(String token) {
        return extractClaim(token, Claims::getExpiration);
    }

    private Claims extractAllClaims(String token) {
        return Jwts
                .parserBuilder()
                .setSigningKey(getSignInKey())
                .build()
                .parseClaimsJws(token)
                .getBody();
    }

    private Key getSignInKey() {
        byte[] keyBytes = Decoders.BASE64.decode(secretKey);
        return Keys.hmacShaKeyFor(keyBytes);
    }
}

i set up the CORS and added code to see if the JWT was being build up from the pertinent data but frankly i dont know what else to do the service and controller are quite simple as i just wanted to see if the token was working properly and are not designed to be kept in the final code

Thiết kế website giá rẻ

Danh mục

forbidden response in implemented jwt authentication