如何在Spring认证重定向响应中添加HX-Refresh头部？

你的问题出在Spring Security的执行顺序上——Security的认证过滤器优先级远高于你自定义的Filter和Interceptor，当用户未登录时，Security会先发送302重定向，此时响应已经被提交，你后续的代码根本拿不到这个状态码，也没法修改响应头部。

下面是可行的解决方案，直接在Spring Security的认证入口处处理htmx请求：

1. 自定义AuthenticationEntryPoint #

这是Spring Security处理未认证请求的核心入口，我们在这里判断是否是htmx请求，替换默认的重定向逻辑：

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.AuthenticationEntryPoint;
import java.io.IOException;

public class HtmxAwareAuthenticationEntryPoint implements AuthenticationEntryPoint {

    private final AuthenticationEntryPoint delegate;

    // 传入默认的认证入口，保留原有非htmx请求的逻辑
    public HtmxAwareAuthenticationEntryPoint(AuthenticationEntryPoint delegate) {
        this.delegate = delegate;
    }

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException {
        String hxRequestHeader = request.getHeader("HX-Request");
        if ("true".equals(hxRequestHeader)) {
            // 针对htmx请求，添加HX-Refresh头部触发全页刷新
            response.setHeader("HX-Refresh", "true");
            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        } else {
            // 非htmx请求，走默认的OAuth2登录重定向逻辑
            delegate.commence(request, response, authException);
        }
    }
}

2. 在Security配置中替换默认入口 #

修改你的WebSecurityConfiguration，把自定义的EntryPoint配置进去：

@Configuration
public class WebSecurityConfiguration {
    private final ClientRegistrationRepository clientRegistrationRepository;

    public WebSecurityConfiguration(ClientRegistrationRepository clientRegistrationRepository) {
        this.clientRegistrationRepository = clientRegistrationRepository;
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        // 获取Spring Security默认的AuthenticationEntryPoint
        AuthenticationEntryPoint defaultEntryPoint = http.getSharedObject(AuthenticationEntryPoint.class);
        
        http.authorizeRequests(registry -> {
            registry.mvcMatchers("/actuator/info", "/actuator/health").permitAll();
            registry.mvcMatchers("/**").hasAuthority(Roles.ADMIN);
            registry.requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll();
            registry.anyRequest().authenticated();
        });
        http.oauth2Client();
        http.oauth2Login();
        http.logout(logout -> logout.logoutSuccessHandler(oidcLogoutSuccessHandler()));
        
        // 替换为自定义的htmx感知入口
        http.exceptionHandling(exceptions -> 
            exceptions.authenticationEntryPoint(new HtmxAwareAuthenticationEntryPoint(defaultEntryPoint))
        );

        return http.build();
    }

    private LogoutSuccessHandler oidcLogoutSuccessHandler() {
        OidcClientInitiatedLogoutSuccessHandler logoutSuccessHandler = new OidcClientInitiatedLogoutSuccessHandler(clientRegistrationRepository);
        logoutSuccessHandler.setPostLogoutRedirectUri("{baseUrl}");
        return logoutSuccessHandler;
    }
}

为什么这个方案有效 #

• AuthenticationEntryPoint是Spring Security处理未认证请求的第一个环节，在重定向响应发送前就能介入，不会出现响应已提交无法修改的问题。
• htmx会自动识别HX-Refresh: true头部，触发全页刷新，从而跳转到登录页，完美适配AJAX请求的场景。
• 非htmx请求依然保留原有重定向逻辑，不影响正常页面访问。

可选：处理未授权的htmx请求 #

如果你的应用存在用户已登录但无权限的场景，可以用同样的思路自定义AccessDeniedHandler：

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.web.access.AccessDeniedHandler;
import java.io.IOException;

public class HtmxAwareAccessDeniedHandler implements AccessDeniedHandler {

    private final AccessDeniedHandler delegate;

    public HtmxAwareAccessDeniedHandler(AccessDeniedHandler delegate) {
        this.delegate = delegate;
    }

    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException {
        String hxRequestHeader = request.getHeader("HX-Request");
        if ("true".equals(hxRequestHeader)) {
            response.setHeader("HX-Refresh", "true");
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        } else {
            delegate.handle(request, response, accessDeniedException);
        }
    }
}

然后在Security配置中添加：

http.exceptionHandling(exceptions -> 
    exceptions.authenticationEntryPoint(new HtmxAwareAuthenticationEntryPoint(defaultEntryPoint))
              .accessDeniedHandler(new HtmxAwareAccessDeniedHandler(http.getSharedObject(AccessDeniedHandler.class)))
);

内容的提问来源于stack exchange，提问作者Wim Deblauwe