Spring Boot 1.5.1中设置AnonymousAuthenticationToken的方法及相关疑问

Hey there! Let's walk through your questions step by step, drawing on Spring Security best practices:

The key here is used to verify the integrity of the AnonymousAuthenticationToken—it prevents malicious tampering of the token after it's set in the SecurityContext. Here's how to handle it properly:

• Best practice: Define a secure, random key in your configuration file (like application.properties or application.yml) instead of hardcoding it:

  security.anonymous.token-key=your-strong-random-secret-key-keep-it-safe
  

• Inject this key into your filter using @Value:

  @Value("${security.anonymous.token-key}")
  private String anonymousTokenSigningKey;
  

• This key will be used later (if needed) to validate that the AnonymousAuthenticationToken hasn't been altered, so make sure to keep it confidential and rotate it periodically if required.

The authorities represent the permissions granted to this anonymous identity. You have two main options depending on your business needs:

• Default anonymous permissions: If your anonymous JWT doesn't carry specific permission data, use Spring Security's default anonymous role. This keeps your setup aligned with the framework's native behavior:

  Collection<GrantedAuthority> authorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_ANONYMOUS"));
  

• Extract from JWT claims: If your JWT includes permission/role information in its payload (e.g., a roles or authorities claim), parse those values and convert them into GrantedAuthority objects:

  // Assume your JWT claims have a "roles" field with a list of strings
  List<String> roleStrings = (List<String>) jwtClaims.get("roles");
  Collection<GrantedAuthority> authorities = roleStrings.stream()
      .map(role -> new SimpleGrantedAuthority("ROLE_" + role)) // Prefix with ROLE_ to match Spring's convention
      .collect(Collectors.toList());
  

Absolutely—this is the perfect pick for your use case, and here's why:

• It guarantees your filter logic runs exactly once per request, even if the request is forwarded or included (common in some web architectures). This avoids redundant JWT validation and keeps your performance in check.
• Unlike a generic Filter, which might execute multiple times for a single request, OncePerRequestFilter is designed specifically to handle this edge case, making it the standard base class for custom security filters in Spring.
• Many official Spring Security filters (like the built-in JWT authentication filters) use this base class, so you're following established best practices by extending it.

内容的提问来源于stack exchange，提问作者Jitesh