Spring WebFlux双认证方式下类型转换异常问题求助

问题场景 #

在Spring WebFlux结合Spring Security的项目中实现了两种认证方式：

• 自定义头认证：通过x-user-id和x-forward-host请求头验证，合法则生成自定义MyAuthentication对象完成认证
• JWT认证：通过Authorization头的JWT令牌验证，生成JwtAuthenticationToken

当前JWT认证功能正常，但使用自定义头认证时，系统抛出ClassCastException，提示无法将MyAuthentication强制转换为JwtAuthenticationToken。

核心原因分析 #

1. 硬编码的类型强转：项目中某个位置直接将Authentication对象强制转为JwtAuthenticationToken，没有考虑多认证类型的场景
2. 过滤器顺序/匹配逻辑问题：JWT过滤器在自定义头认证过滤器之后执行，且未做请求匹配判断，对已通过自定义认证的请求重复处理，导致类型不匹配
3. 自定义Authentication实现不规范：MyAuthentication未正确实现Authentication接口，导致底层逻辑误判类型

解决方案 #

1. 修复所有强转Authentication的代码 #

遍历项目中所有获取认证对象的代码，替换直接强转的逻辑，先判断类型再处理：

// 错误写法
JwtAuthenticationToken jwtAuth = (JwtAuthenticationToken) SecurityContextHolder.getContext().getAuthentication();

// 正确写法
Authentication auth = SecurityContextHolder.getContext().getAuthentication();
if (auth instanceof JwtAuthenticationToken) {
    JwtAuthenticationToken jwtAuth = (JwtAuthenticationToken) auth;
    // 处理JWT相关逻辑
} else if (auth instanceof MyAuthentication) {
    MyAuthentication myAuth = (MyAuthentication) auth;
    // 处理自定义头认证相关逻辑
}

同时检查全局方法安全的@PreAuthorize等注解，避免依赖JWT特有的属性而未兼容自定义认证。

2. 调整SecurityFilterChain的过滤器配置 #

确保自定义头认证过滤器优先执行，且JWT过滤器仅处理携带Authorization头的请求：

@Bean
public SecurityFilterChain securityFilterChain(ServerHttpSecurity http) {
    return http
            .authorizeExchange(exchanges -> exchanges.anyExchange().authenticated())
            // 自定义头认证过滤器放在认证流程最前面
            .addFilterBefore(customHeaderAuthFilter(), SecurityWebFiltersOrder.AUTHENTICATION)
            // JWT过滤器仅处理带Bearer令牌的请求
            .addFilterAfter(jwtAuthFilter(), SecurityWebFiltersOrder.AUTHENTICATION)
            .csrf(ServerHttpSecurity.CsrfSpec::disable)
            .build();
}

// 自定义头认证过滤器：仅处理携带指定头的请求
private AuthenticationWebFilter customHeaderAuthFilter() {
    AuthenticationWebFilter filter = new AuthenticationWebFilter(customHeaderAuthManager());
    filter.setServerAuthenticationConverter(exchange -> {
        String userId = exchange.getRequest().getHeaders().getFirst("x-user-id");
        String host = exchange.getRequest().getHeaders().getFirst("x-forward-host");
        if (StringUtils.hasText(userId) && StringUtils.hasText(host)) {
            // 验证userId和host合法性，合法则返回MyAuthentication
            return Mono.just(new MyAuthentication(userId, host, AuthorityUtils.createAuthorityList("ROLE_USER")));
        }
        return Mono.empty(); // 不处理，交给后续过滤器
    });
    return filter;
}

// JWT过滤器：仅处理Authorization头存在的请求
private AuthenticationWebFilter jwtAuthFilter() {
    AuthenticationWebFilter filter = new AuthenticationWebFilter(jwtAuthManager());
    filter.setServerAuthenticationConverter(new JwtServerAuthenticationConverter());
    // 添加请求匹配器
    filter.setRequiresAuthenticationMatcher(exchange -> {
        String authHeader = exchange.getRequest().getHeaders().getFirst(HttpHeaders.AUTHORIZATION);
        return Mono.just(authHeader != null && authHeader.startsWith("Bearer "));
    });
    return filter;
}

3. 确保自定义Authentication实现规范 #

检查MyAuthentication是否正确实现Authentication接口，示例实现：

public class MyAuthentication implements Authentication {
    private final String userId;
    private final String host;
    private final Collection<? extends GrantedAuthority> authorities;
    private boolean authenticated = true;

    public MyAuthentication(String userId, String host, Collection<? extends GrantedAuthority> authorities) {
        this.userId = userId;
        this.host = host;
        this.authorities = authorities;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return authorities;
    }

    @Override
    public Object getCredentials() {
        return null; // 自定义头认证无凭证，返回null即可
    }

    @Override
    public Object getDetails() {
        return host;
    }

    @Override
    public Object getPrincipal() {
        return userId;
    }

    @Override
    public boolean isAuthenticated() {
        return authenticated;
    }

    @Override
    public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
        this.authenticated = isAuthenticated;
    }

    @Override
    public String getName() {
        return userId;
    }
}

验证步骤 #

1. 用自定义头请求接口，检查SecurityContext中的认证对象是否为MyAuthentication
2. 确认后续逻辑未再触发类型转换异常
3. 验证JWT认证流程不受影响

内容的提问来源于stack exchange，提问作者amir