无服务器会话的Wicket应用用户认证方案咨询

Absolutely! Using signed cookies for stateless authentication in Wicket is totally feasible—let me walk you through exactly how to implement this, plus some critical best practices to keep your app secure and aligned with your stateless goals.

First, you need to turn off Wicket's built-in session handling since we're going stateless. Update your Application class to skip session creation and disable the default authentication strategy:

@Override
protected void init() {
    super.init();
    // Skip Wicket's session-based auth
    getSecuritySettings().setAuthenticationStrategy(new NoOpAuthenticationStrategy());
    // Prevent Wicket from auto-creating sessions
    getSessionSettings().setCreateSession(false);
}

Next, you'll handle authentication via signed tokens stored in cookies. Here's how to structure this:

Generate a Signed Token on Login #

When a user successfully logs in, create a signed token (I recommend using JWT for this—it's standard and handles signing/expiry out of the box) and set it as a secure cookie:

// After validating user credentials
String userId = authenticatedUser.getId();
String jwtToken = Jwts.builder()
    .setSubject(userId)
    .setExpiration(Date.from(Instant.now().plusHours(24))) // 24-hour expiry
    .signWith(SignatureAlgorithm.HS256, "your-strong-secret-key") // Use a secure, environment-stored key
    .compact();

// Set the cookie with strict security settings
WebResponse response = getRequestCycle().getWebResponse();
Cookie authCookie = new Cookie("AUTH_TOKEN", jwtToken);
authCookie.setHttpOnly(true); // Block JS access to prevent XSS
authCookie.setSecure(true); // Only send over HTTPS (mandatory in production)
authCookie.setPath("/");
response.addCookie(authCookie);

Validate the Token on Every Request #

Use a Wicket IRequestCycleListener to intercept each incoming request, validate the cookie's signature, and load the user's context:

public class AuthRequestCycleListener implements IRequestCycleListener {
    private static final String SECRET_KEY = "your-strong-secret-key"; // Pull from env vars in production

    @Override
    public void onBeginRequest(RequestCycle cycle) {
        WebRequest request = (WebRequest) cycle.getRequest();
        Cookie authCookie = request.getCookie("AUTH_TOKEN");

        if (authCookie != null) {
            try {
                // Validate the JWT signature and expiry
                Claims claims = Jwts.parser()
                    .setSigningKey(SECRET_KEY)
                    .parseClaimsJws(authCookie.getValue())
                    .getBody();

                if (!claims.getExpiration().before(new Date())) {
                    // Load user from your database using the user ID in the token
                    User currentUser = userRepository.findById(claims.getSubject());
                    // Store the user in the request cycle's metadata for easy access
                    cycle.setMetaData(UserMetaKey.INSTANCE, currentUser);
                } else {
                    // Token expired—clear the cookie
                    invalidateAuthCookie(cycle.getWebResponse());
                }
            } catch (JwtException e) {
                // Invalid signature—clear the cookie and reject the request
                invalidateAuthCookie(cycle.getWebResponse());
            }
        }
    }

    private void invalidateAuthCookie(WebResponse response) {
        Cookie authCookie = new Cookie("AUTH_TOKEN", "");
        authCookie.setHttpOnly(true);
        authCookie.setSecure(true);
        authCookie.setPath("/");
        authCookie.setMaxAge(0); // Delete the cookie
        response.addCookie(authCookie);
    }
}

Then register this listener in your Application class:

@Override
protected void init() {
    super.init();
    getRequestCycleListeners().add(new AuthRequestCycleListener());
    // ... your earlier session configuration
}

Make sure every page in your app is marked as stateless to avoid accidental session creation. You can do this with the @StatelessComponent annotation:

@StatelessComponent
public class DashboardPage extends WebPage {
    public DashboardPage() {
        // Retrieve the authenticated user from the request cycle
        User currentUser = getRequestCycle().getMetaData(UserMetaKey.INSTANCE);
        
        // Redirect to login if no valid user is found
        if (currentUser == null) {
            setResponsePage(LoginPage.class);
            return;
        }

        // Build your page components using the user context
        add(new Label("welcomeMessage", "Welcome back, " + currentUser.getUsername()));
        // ... add other stateless components
    }
}

Alternatively, you can call setStatelessHint(true) in the page constructor if you prefer not to use annotations.

If you don't want to build the entire cookie flow from scratch, Wicket has a StatelessAuthenticationStrategy that you can extend to handle signing. This strategy stores the username in a cookie, but you'll need to add your own signing logic to prevent tampering:

getSecuritySettings().setAuthenticationStrategy(new StatelessAuthenticationStrategy("AUTH_TOKEN") {
    @Override
    protected String encrypt(String plainText) {
        // Sign the username with JWT to prevent tampering
        return Jwts.builder()
            .setSubject(plainText)
            .signWith(SignatureAlgorithm.HS256, SECRET_KEY)
            .compact();
    }

    @Override
    protected String decrypt(String encryptedText) {
        // Validate the signature before returning the username
        try {
            return Jwts.parser()
                .setSigningKey(SECRET_KEY)
                .parseClaimsJws(encryptedText)
                .getBody()
                .getSubject();
        } catch (JwtException e) {
            return null;
        }
    }
});

You'll still need to use a request listener to load the full user context from the username, just like in the previous approach.

• Never hardcode secrets: Store your JWT signing key in environment variables or a secure secrets manager, not in your codebase.
• Short token expiry: Use a reasonable expiry window (like 24 hours) and implement a refresh token flow if you need longer sessions without forcing re-login.
• Validate all requests: Always check for a valid user context before rendering protected pages—don't assume the cookie is valid.
• Test edge cases: Make sure expired/tampered cookies trigger redirects to login, and that logout properly clears the cookie.

内容的提问来源于stack exchange，提问作者rvange