我有一个使用Spring Security的Spring MVC web应用程序。我想知道当前登录用户的用户名。我正在使用下面给出的代码片段。这是公认的方式吗?
我不喜欢在这个控制器中调用静态方法——恕我直言，这违背了Spring的全部目的。有没有一种方法来配置应用程序有当前的SecurityContext，或当前的认证，注入代替?
@RequestMapping(method = RequestMethod.GET)
public ModelAndView showResults(final HttpServletRequest request...) {
final String currentUser = SecurityContextHolder.getContext().getAuthentication().getName();
...
}
当前回答
我会这样做:
request.getRemoteUser();
其他回答
我会这样做:
request.getRemoteUser();
我同意必须为当前用户查询SecurityContext很糟糕，这似乎是一种非常非spring的处理这个问题的方式。
我写了一个静态的“助手”类来处理这个问题;它是脏的，因为它是一个全局和静态的方法，但我认为如果我们改变任何与安全相关的东西，至少我只需要改变一个地方的细节:
/**
* Returns the domain User object for the currently logged in user, or null
* if no User is logged in.
*
* @return User object for the currently logged in user, or null if no User
* is logged in.
*/
public static User getCurrentUser() {
Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal()
if (principal instanceof MyUserDetails) return ((MyUserDetails) principal).getUser();
// principal object is either null or represents anonymous user -
// neither of which our domain User object can represent - so return null
return null;
}
/**
* Utility method to determine if the current user is logged in /
* authenticated.
* <p>
* Equivalent of calling:
* <p>
* <code>getCurrentUser() != null</code>
*
* @return if user is logged in
*/
public static boolean isLoggedIn() {
return getCurrentUser() != null;
}
对于我写的上一个Spring MVC应用程序，我没有注入SecurityContext holder，但我确实有一个基本控制器，我有两个实用程序方法与此相关…isAuthenticated() & getUsername()。在内部，它们执行您所描述的静态方法调用。
至少在以后需要重构时，它只在一个地方。
Yes, statics are generally bad - generally, but in this case, the static is the most secure code you can write. Since the security context associates a Principal with the currently running thread, the most secure code would access the static from the thread as directly as possible. Hiding the access behind a wrapper class that is injected provides an attacker with more points to attack. They wouldn't need access to the code (which they would have a hard time changing if the jar was signed), they just need a way to override the configuration, which can be done at runtime or slipping some XML onto the classpath. Even using annotation injection in the signed code would be overridable with external XML. Such XML could inject the running system with a rogue principal. This is probably why Spring is doing something so un-Spring-like in this case.
您可以使用Spring AOP方法。 例如，如果你有一些服务，它需要知道当前的本金。您可以引入自定义注释，例如@Principal，它表明该服务应该是依赖于主体的。
public class SomeService {
private String principal;
@Principal
public setPrincipal(String principal){
this.principal=principal;
}
}
然后在您的通知中，我认为需要扩展MethodBeforeAdvice，检查特定的服务有@Principal注释并注入Principal名称，或者将其设置为'ANONYMOUS'。
