Spring Boot：Rest Client向服务端传递权限与用户主体信息

Hi Mahi, let's walk through how to handle your requirements for passing role information and address your question about dummy sessions, step by step:

1. Passing Role Information (ADMIN/GUEST_USER) #

There are a couple of practical ways to send role details from your client, depending on what your server-side controller expects:

Option 1: Custom Request Headers

This is the most common approach for REST endpoints. You can add custom headers to explicitly send roles and user principal data. Here's how to adjust your code:

String endpoint = "http://localhost:8096/polygons/34";
HttpHeaders headers = new HttpHeaders();
headers.setBasicAuth("mahi", "ChangeM6");
headers.setConnection("keep-alive");

// Send a single role (use comma-separated values for multiple roles, e.g., "ADMIN,GUEST_USER")
headers.add("X-User-Roles", "ADMIN");
// Optional: Explicitly send user principal if the server expects it separately
headers.add("X-User-Principal", "mahi");

HttpEntity<String> httpEntity = new HttpEntity<>(headers);
ResponseEntity<Long> exchange = restTemplate.exchange(endpoint, HttpMethod.GET, httpEntity, Long.class);

Just ensure the server-side controller is set up to read these headers (for example, using @RequestHeader("X-User-Roles") in Spring).

Option 2: JWT Token (If Server Supports It)

If your service uses JWT for authentication instead of Basic Auth, you can encode the user principal and roles directly into the token. Replace the Basic Auth header with a Bearer token:

// Generate a JWT token containing username "mahi" and role "ADMIN"
String jwtToken = generateJwtToken("mahi", Collections.singletonList("ADMIN"));

HttpHeaders headers = new HttpHeaders();
headers.set("Authorization", "Bearer " + jwtToken);
headers.setConnection("keep-alive");

HttpEntity<String> httpEntity = new HttpEntity<>(headers);
ResponseEntity<Long> exchange = restTemplate.exchange(endpoint, HttpMethod.GET, httpEntity, Long.class);

This is more secure and aligns with REST's stateless design principle.

2. Using a Dummy Session for User Information #

Yes, you can simulate a dummy session if your server relies on session-based authentication. Here's the workflow:

1. First, call the server's login endpoint to establish a session and retrieve the JSESSIONID cookie.
2. Include this cookie in your subsequent request to the protected endpoint.

Example code:

// Step 1: Login to get a session ID
String loginEndpoint = "http://localhost:8096/login";
HttpHeaders loginHeaders = new HttpHeaders();
loginHeaders.setBasicAuth("mahi", "ChangeM6");
HttpEntity<Void> loginEntity = new HttpEntity<>(loginHeaders);
ResponseEntity<Void> loginResponse = restTemplate.exchange(loginEndpoint, HttpMethod.POST, loginEntity, Void.class);

// Extract JSESSIONID from the Set-Cookie response header
String sessionCookie = loginResponse.getHeaders().getFirst(HttpHeaders.SET_COOKIE);
String sessionId = sessionCookie.split(";")[0].split("=")[1];

// Step 2: Call the protected endpoint with the session cookie
String targetEndpoint = "http://localhost:8096/polygons/34";
HttpHeaders targetHeaders = new HttpHeaders();
targetHeaders.add(HttpHeaders.COOKIE, "JSESSIONID=" + sessionId);
targetHeaders.setConnection("keep-alive");

HttpEntity<String> targetEntity = new HttpEntity<>(targetHeaders);
ResponseEntity<Long> exchange = restTemplate.exchange(targetEndpoint, HttpMethod.GET, targetEntity, Long.class);

Note that this approach is stateful, which isn't ideal for REST services. Whenever possible, stick with custom headers or JWT for a cleaner, stateless solution.

Quick Final Check #

• Always verify your server's documentation to confirm exactly how it expects to receive role and user principal data (custom headers, JWT claims, etc.).
• If the server already maps your Basic Auth user "mahi" to roles internally, you might not need to send roles explicitly—double-check if the user has the required permissions on the server side.

内容的提问来源于stack exchange，提问作者codder