Spring 如果删除过滤器中的@component class，引导过滤器不会被调用

Question

我有两个端点，/health 和 /save。我不想为 /health 端点调用 MyFilter。下面是代码

@Component
public class MyFilter implements Filter {

    @Autowired
    private JwtConfig jwtConfig;

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
            throws IOException, ServletException {
        HttpServletResponse response = (HttpServletResponse) servletResponse;
        HttpServletRequest request = (HttpServletRequest) servletRequest;

        // do something

        filterChain.doFilter(servletRequest, servletResponse);
    }
}

@Configuration
@Order(2)
public class WebSecurityConfig extends DefaultSecurityConfig {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        http.cors().and().csrf().disable().addFilterAfter(new MyFilter(), BasicAuthenticationFilter.class)
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }
    
    @Override
    public void configure(WebSecurity webSecurity) throws Exception {
        super.configure(webSecurity);
        webSecurity.ignoring().antMatchers("/health/**");
    }

    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", new CorsConfiguration().applyPermitDefaultValues());
        return source;
    }
}

问题是，如果我从 MyFilter 中删除 @component，则不会为任何端点调用过滤器，如果我将其放回原位，则会在两个端点中调用它。如何使其仅适用于 /health 端点？

Answer 1

在 // do something 部分，检查请求的 url 是否是指标，如果不是，则只执行您的操作。该信息在 HttpServletRequest 对象中很容易获得。

我不确定是否有更直接的方法来做到这一点。使用 FilterRegistrationBean 将只允许您添加 urls 以包含，而不是 urls 以排除。

如果您确实认为您将只有这两个端点，您当然可以使用 FilterRegistrationBean 只添加您的保存端点：

@Bean
public FilterRegistrationBean<MyFilter> myFilter() {
    FilterRegistrationBean<MyFilter> registrationBean = new FilterRegistrationBean<>();
    registrationBean.setFilter(new MyFilter());
    registrationBean.addUrlPatterns("/save");
    return registrationBean;
}

在这种情况下，您可以删除组件注释。

Spring 如果删除过滤器中的@component class，引导过滤器不会被调用

Spring Boot Filter is not getting invoked if remove @component in filter class

spring

spring-security

servlet-filters

spring-boot