Spring Security 6.5: marin-u-helidda isweydaarsiga koodhka oggolaanshaha OAuth iyada oo loo marayo proxy

Browser-ku wuxuu gaaraa bixiyaha aqoonsiga, ka dibna gelitaanku wuu guuldareystaa marka barnaamijku isweydaarsado koodhka oggolaanshaha la soo celiyay. Isweydaarsigaas waa codsi ka soo baxa server-ka barnaamijka, oo leh macmiilkiisa HTTP.

API-ga ku salaysan RestClient ee laga heli karo Spring Security 6.5, sii warshadda codsiyada ogeysiiyay proxy macmiilka jawaabta token-ka koodhka oggolaanshaha:

SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
factory.setProxy(new java.net.Proxy(
    java.net.Proxy.Type.HTTP,
    new java.net.InetSocketAddress("proxy.example", 8080)));
factory.setConnectTimeout(5000);
factory.setReadTimeout(15000);

RestClient tokenHttp = RestClient.builder()
    .requestFactory(factory)
    .messageConverters(converters -> {
        converters.clear();
        converters.add(new FormHttpMessageConverter());
        converters.add(new OAuth2AccessTokenResponseHttpMessageConverter());
    })
    .defaultStatusHandler(new OAuth2ErrorResponseErrorHandler())
    .build();

RestClientAuthorizationCodeTokenResponseClient tokenClient =
    new RestClientAuthorizationCodeTokenResponseClient();
tokenClient.setRestClient(tokenHttp);

Fasallada converter-ka iyo maareeyaha khaladaadka waxay ilaaliyaan habdhaqanka codsiga token-ka ee Spring Security ee la diiwaangeliyay. RestClient guud oo loo habeeyay kaliya JSON API aan xiriir la lahayn ma aha beddelka u dhigma.

Ku xir isla tokenClient habeynta amniga ee jirta:

http.oauth2Login(login -> login
    .tokenEndpoint(token -> token
        .accessTokenResponseClient(tokenClient)));

Kuwani waa qaybo habeyn ah barnaamij hore u lahaa diiwaangelinta macmiilka iyo SecurityFilterChain. Waxay doortaan proxy HTTP oo aan lahayn xaqiijin; proxy u baahan aqoonsi waxay u baahan tahay habeynta xaqiijinta ee u dhigma gaadiidka la doortay. Barta ugu dambeysa ee token-ka HTTPS ee si guud loo gaari karo waddo guud oo la ogolaaday, gelitaan HTTP oo ka socda liiska proxy-yada HTTP ayaa buuxin kara cinwaankaas proxy-ga aan akoonka lahayn.

Kala sooc host-ka proxy-ga iyo dekeddiisa iyo qaabka URL-ka. Ka tag URI-ga token-ka bixiyaha aqoonsiga oo ah meesha loo socdo. Tusaalahan ma beddelo xaqiijinta shahaadada.

Codsiyada dambe waxay u baahan yihiin hubin lahaansho u gaar ah. Helitaanka UserInfo, isweydaarsiga token-ka cusboonaysiinta, deeqaha client-credentials iyo wicitaannada API-da la ilaaliyay waxay isticmaali karaan walxo macmiil kale. Habee macmiilka la taageerayo ee u dhigma marka hawshaas sidoo kale u baahan tahay waddada. Habeynta qulqulka client_credentials ee falcelinta Spring Security 6.5, habee macmiilka token-ka falcelinta iyo bixiyaha deeqdiisa si gooni ah.

Tusaalooyinka hore ee isticmaala OAuth2RestTemplate iyo AccessTokenProvider waxay ka tirsan yihiin mashruuca Spring Security OAuth ee hore. Dooro API-ga uu isticmaalo barnaamijka la rakibay ka hor inta aadan waafajin koodhka; ha ku darin walxahaas habeyntan.