iframe中Spring Boot表单登录Principal为null，SameSite Cookie失效排查

现象说明 #

• 浏览器直接访问时表单登录功能正常，但将网站嵌入iframe后，登录成功后同一用户的JSESSIONID显示为null
• 在AuthenticationSuccessHandler中能正常获取用户的密码令牌对象，但重定向到仪表盘页面后，安全过滤器中的principal对象突然变为null
• 尝试手动将认证对象存入session也无法成功，请求过滤器中该对象值始终为null
• 同时存在SameSite=None Cookie在Safari和Chrome 80版本中不生效的问题

iframe环境下的日志 #

UsernamePasswordAuthenticationToken [Principal=test@example.com, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=0:0:0:0:0:0:0:1, SessionId=null], Granted Authorities=[ROLE_USER]]

浏览器环境下的日志 #

[Authentication=UsernamePasswordAuthenticationToken [Principal=test@example.com, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=0:0:0:0:0:0:0:1, SessionId=04E5DB0982A859E5C215294EF96814FD], Granted Authorities=[ROLE_MANAGER, ROLE_USER]]]

安全配置代码 #

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
        .csrf().disable()
        .cors().disable()
        .authorizeHttpRequests(authorize -> authorize
            .requestMatchers("/app_resources/**", "/signup", "/favicon.ico", "/login", "/logout", "/signup",
                            "/oauth2/authorization/**", "/pages/**", "/login/oauth2/code/**", "/login/oauth2/code/**",
                             "/product/authenticate", "/cdnjs.cloudflare.com/**").permitAll()
            .requestMatchers("/admin/**").hasRole("ADMIN")
            .anyRequest().authenticated()
        )
        .addFilterBefore(securityFilter, UsernamePasswordAuthenticationFilter.class)
        .formLogin(form -> form
            .loginPage("/auth")
            .defaultSuccessUrl("/index")
            .failureHandler(authenticationfailure())
            .successHandler(new AuthSuccessHandler()).permitAll()
        )
        .logout(out -> out
            .logoutUrl("/logout")
        )
        .sessionManagement()                          
            .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
            .and()
        .authenticationProvider(authProvider())
        .oauth2Login()
            .loginPage("/auth")
            .defaultSuccessUrl("/homesuccess")
            .successHandler(new AuthSuccessHandler());

    http
        .headers()
            .frameOptions().disable();
    return http.build();
}

AuthenticationSuccessHandler代码 #

@Override
public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
    Authentication authentication) throws IOException, ServletException {
    System.out.println("onAuthenticationSuccess >>>>>>>>>>>>>>>"+authentication.toString());
    request.getSession(false).setMaxInactiveInterval(604800);
    RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
    redirectStrategy.sendRedirect(request, response, "/");
}

MVC配置代码 #

@EnableWebMvc
@Configuration
public class MvcConfig implements WebMvcConfigurer{
    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {

        VersionResourceResolver versionResolver = new VersionResourceResolver().addContentVersionStrategy("/**/*.js",
                "/**/*.css", "/**/*.png");
        registry.addResourceHandler("/app_resources/**", "/favicon.ico", "/firebase-messaging-sw.js", "/manifest.json",
                "/salesken.png")
                .addResourceLocations("/assets/js/",
                        "/assets/css/","/assets/img/","/")
                .setCacheControl(CacheControl.maxAge(1, TimeUnit.MINUTES)).resourceChain(true)
                .addResolver(versionResolver);

    }   
    
    @Override
    public void configureContentNegotiation(ContentNegotiationConfigurer configurer) {
        configurer.defaultContentType(MediaType.APPLICATION_JSON);
    }
    
    @Bean
    public ViewResolver viewResolver() {
        InternalResourceViewResolver bean = new InternalResourceViewResolver();
        bean.setPrefix("pages/");
        bean.setSuffix(".jsp");
        return bean;
    }   
}

Cookie设置截图 #

内容的提问来源于stack exchange，提问作者Feroz Siddiqui