Spring Security中如何为HTTPBasic认证配置登录失败处理器？

核心思路 #

HTTPBasic认证的处理器配置逻辑和表单登录一致，但需要在httpBasic()配置分支下设置failureHandler和successHandler，而非formLogin()分支。我们只需自定义实现AuthenticationFailureHandler和AuthenticationSuccessHandler接口，分别编写失败、成功场景的日志记录逻辑，再将处理器注入到HTTPBasic的配置中即可。

步骤1：自定义认证失败处理器 #

实现AuthenticationFailureHandler接口，在方法中添加日志记录逻辑，同时保留HTTPBasic默认的401响应行为：

@Component
public class CustomBasicAuthFailureHandler implements AuthenticationFailureHandler {

    private static final Logger logger = LoggerFactory.getLogger(CustomBasicAuthFailureHandler.class);

    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
        // 记录失败详情：客户端IP、异常原因等
        String clientIp = request.getRemoteAddr();
        logger.warn("HTTP Basic认证失败 | 客户端IP: {} | 原因: {}", clientIp, exception.getMessage());
        
        // 维持默认401响应，避免破坏认证流程
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Authentication Failed");
    }
}

步骤2：自定义认证成功处理器 #

实现AuthenticationSuccessHandler接口，记录成功登录的关键信息：

@Component
public class CustomBasicAuthSuccessHandler implements AuthenticationSuccessHandler {

    private static final Logger logger = LoggerFactory.getLogger(CustomBasicAuthSuccessHandler.class);

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        // 记录成功详情：用户名、客户端IP等
        String username = authentication.getName();
        String clientIp = request.getRemoteAddr();
        logger.info("HTTP Basic认证成功 | 用户名: {} | 客户端IP: {}", username, clientIp);
        
        // 维持默认成功响应（默认会继续处理原请求，这里显式设置200状态）
        response.setStatus(HttpServletResponse.SC_OK);
    }
}

步骤3：配置HTTPBasic认证关联处理器 #

根据你使用的Spring Security版本，选择对应的配置方式：

方式1：Spring Security 5.x（基于WebSecurityConfigurerAdapter） #

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomBasicAuthFailureHandler basicAuthFailureHandler;
    
    @Autowired
    private CustomBasicAuthSuccessHandler basicAuthSuccessHandler;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .anyRequest().authenticated() // 所有请求需认证
                .and()
            .httpBasic() // 启用HTTPBasic认证
                .failureHandler(basicAuthFailureHandler) // 绑定失败处理器
                .successHandler(basicAuthSuccessHandler); // 绑定成功处理器
    }
}

方式2：Spring Security 6.x（基于SecurityFilterChain，WebSecurityConfigurerAdapter已废弃） #

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Autowired
    private CustomBasicAuthFailureHandler basicAuthFailureHandler;
    
    @Autowired
    private CustomBasicAuthSuccessHandler basicAuthSuccessHandler;

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            )
            .httpBasic(basic -> basic
                .failureHandler(basicAuthFailureHandler)
                .successHandler(basicAuthSuccessHandler)
            );
        return http.build();
    }
}

注意事项 #

• 自定义处理器中必须保留HTTPBasic的默认响应行为（失败返回401，成功返回200或继续请求），否则会导致认证流程异常。
• 日志内容可根据需求扩展，比如添加时间戳、请求路径等信息。

内容的提问来源于stack exchange，提问作者Jason Chan