Spring Boot中Filter修改Authorization Header后接口获旧值问题

你的问题出在CustomHeaderRequestWrapper仅重写了getHeader方法，但Spring MVC在解析@RequestHeader注解时，可能会调用getHeaders或getHeaderNames等其他方法读取请求头，这些方法仍会返回原始请求的头信息，导致接口拿到旧令牌。

修复方案：完善请求包装类 #

修改CustomHeaderRequestWrapper，维护一个修改后的请求头映射，并重写所有相关的头读取方法，确保所有途径都能获取到更新后的令牌：

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.util.*;

public class CustomHeaderRequestWrapper extends HttpServletRequestWrapper {

    private final Map<String, String> modifiedHeaders;

    public CustomHeaderRequestWrapper(HttpServletRequest request, String headerName, String newValue) {
        super(request);
        modifiedHeaders = new HashMap<>();
        
        // 复制原始请求的所有请求头
        Enumeration<String> originalHeaderNames = request.getHeaderNames();
        while (originalHeaderNames.hasMoreElements()) {
            String name = originalHeaderNames.nextElement();
            modifiedHeaders.put(name.toLowerCase(), request.getHeader(name));
        }
        
        // 替换目标请求头（忽略大小写）
        modifiedHeaders.put(headerName.toLowerCase(), newValue);
    }

    @Override
    public String getHeader(String name) {
        return modifiedHeaders.get(name.toLowerCase());
    }

    @Override
    public Enumeration<String> getHeaders(String name) {
        String value = modifiedHeaders.get(name.toLowerCase());
        return value != null ? Collections.enumeration(Collections.singletonList(value)) : super.getHeaders(name);
    }

    @Override
    public Enumeration<String> getHeaderNames() {
        return Collections.enumeration(modifiedHeaders.keySet());
    }
}

额外验证步骤 #

1. 确认过滤器触发逻辑：在过滤器的doFilter方法中添加日志，验证是否进入了令牌替换分支：

if(httpServletRequest.getRequestURI().contains("/specific")){
    log.info("开始替换令牌，请求URI：{}", httpServletRequest.getRequestURI());
    String attorneyPortalToken = tokenGeneneratorUtil.generateToken();
    log.info("生成新令牌：{}", attorneyPortalToken);
    httpServletRequest = new CustomHeaderRequestWrapper(httpServletRequest, HttpHeaders.AUTHORIZATION, "Bearer " + attorneyPortalToken);
}

2. 确认过滤器优先级：你已经设置了@Order(Ordered.HIGHEST_PRECEDENCE)，确保这个过滤器在Spring Security等其他处理Authorization头的组件之前执行。

内容的提问来源于stack exchange，提问作者user1250720