在Spring Security应用中，认证失败日志的记录对于安全监控和问题排查至关重要。本文将详细介绍如何配置和查看Spring Security的认证失败日志。
基础配置
首先，在application.yml中添加以下配置：
logging:
level:
org.springframework.security: DEBUG
org.springframework.security.web.authentication: DEBUG
自定义失败处理器
通过实现AuthenticationFailureHandler接口，可以自定义认证失败时的日志记录：
@Component
public class CustomAuthenticationFailureHandler implements AuthenticationFailureHandler {
private static final Logger logger = LoggerFactory.getLogger(CustomAuthenticationFailureHandler.class);
@Override
public void onAuthenticationFailure(HttpServletRequest request,
HttpServletResponse response,
AuthenticationException exception) {
String username = request.getParameter("username");
logger.warn("Authentication failed for user: {}", username);
logger.warn("Failure reason: {}", exception.getMessage());
// 重定向或返回JSON响应
}
}
配置集成
在SecurityConfig中注册失败处理器：
@Configuration
@EnableWebSecurity
class SecurityConfig {
@Autowired
private CustomAuthenticationFailureHandler failureHandler;
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.formLogin(form -> form
.failureHandler(failureHandler)
.permitAll()
)
.logout(logout -> logout.permitAll());
return http.build();
}
}
日志输出示例
当认证失败时，日志会显示类似内容：
2024-01-15 10:30:45.123 WARN 12345 --- [nio-8080-exec-1] com.example.CustomAuthenticationFailureHandler : Authentication failed for user: admin
2024-01-15 10:30:45.124 WARN 12345 --- [nio-8080-exec-1] com.example.CustomAuthenticationFailureHandler : Failure reason: Bad credentials
安全建议
- 避免在日志中记录敏感信息
- 设置合理的日志级别，避免生产环境日志过载
- 考虑添加IP限制和频率控制机制
讨论