Spring Security 做token形式登录和动态权限管理_weixin_46135502_spring token管理

网络 02-07 2846

文章目录一、登录1.实现登录成功后处理器2.实现登录失败处理器3.实现未登录直接访问失败处理器4. 实现从数据库读取user ,实现UserDetailsService.loadUserByUsername5.实现jwt过滤器，重写BasicAuthenticationFilter6.实现Security 的配置类，重写WebSecurityConfigurerAdapter二、动态权限管理1. 实现获取当前url的权限标识，重写FilterInvocationSecurityMetadataSource2.实现自定义验证权限，重写AccessDecisionManager3.修改配置类，将重写类添加三、密码加密传输1.前端加密2.后端解密3.修改配置类

一、登录 1.实现登录成功后处理器 @Service("authenticationSuccessHandler") public class AuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler { @Autowired private JwtUtils jwtUtils; @Override public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response , Authentication authentication) throws IOException { logger.info("User: " + request.getParameter("username") + " Login successfully."); this.returnJson(response,authentication); } private void returnJson(HttpServletResponse response,Authentication authentication) throws IOException { String token = jwtUtils.generateToken(authentication); response.setStatus(HttpServletResponse.SC_OK); response.setCharacterEncoding("UTF-8"); response.setContentType("application/json"); response.getWriter().println("{\"exceptionId\":\"null\",\"messageCode\":\"200\"," + "\"message\": \"登录成功\",\"Authorization\": \"" + token + "\"}"); } } 2.实现登录失败处理器 @Service("authenticationFailHandler") public class AuthenticationFailHandler extends SimpleUrlAuthenticationFailureHandler { @Override public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException { this.returnJson(response, exception); } private void returnJson(HttpServletResponse response, AuthenticationException exception) throws IOException { response.setStatus(HttpServletResponse.SC_OK); response.setCharacterEncoding("UTF-8"); response.setContentType("application/json"); response.getWriter().println("{\"exceptionId\":\"null\",\"messageCode\":\"401\"," + "\"message\": \"" + "用户名或密码错误" + "\",\"serverTime\": " + System.currentTimeMillis() + "}"); } } 3.实现未登录直接访问失败处理器 @Slf4j @Service("authenticationEntryPointImpl") class AuthenticationEntryPointImpl implements AuthenticationEntryPoint { @Override public void commence(HttpServletRequest httpServletRequest, HttpServletResponse response, AuthenticationException e) throws IOException { log.error("Spring Securtiy异常", e); response.setCharacterEncoding("UTF-8"); response.setContentType("application/json; charset=utf-8"); PrintWriter out = response.getWriter(); out.print(JSON.toJSONString(Result.fail(402,"未登录，请先登录！",null))); } } 4. 实现从数据库读取user ,实现UserDetailsService.loadUserByUsername @Component public class DatabaseUserDetailsService implements UserDetailsService { @Resource private TbUserMapper TbUserMapper; @Override public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException { QueryWrapper<TbUser> queryWrapper = new QueryWrapper<>(); queryWrapper.eq("username",userName); TbUser user = TbUserMapper.selectOne(queryWrapper); if (user == null) { //throw exception inform front end not this user throw new UsernameNotFoundException("user + " + userName + "not found."); } List<String> roleIdList = TbUserMapper.queryUserOwnedRoleIds(userName); List<GrantedAuthority> authorities = roleIdList.stream().map(e -> new SimpleGrantedAuthority(e)).collect(Collectors.toList()); UserDetails userDetails = new org.springframework.security.core.userdetails.User( user.getUsername(),user.getPassword(),authorities); return userDetails; } public static void main(String[] args) { BCryptPasswordEncoder bCryptPasswordEncoder = new BCryptPasswordEncoder(); String encode = bCryptPasswordEncoder.encode("1234"); System.out.println(encode); } } 5.实现jwt过滤器，重写BasicAuthenticationFilter @Slf4j public class JWTAuthenticationFilter extends BasicAuthenticationFilter { public JWTAuthenticationFilter(AuthenticationManager authenticationManager) { super(authenticationManager); } @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException { JwtUtils jwtUtils = SpringContextUtil.getBean(JwtUtils.class); String jwt = request.getHeader("Authorization"); if (StrUtil.isBlankOrUndefined(jwt)) { chain.doFilter(request, response); return; } Claims claim = jwtUtils.getClaimByToken(jwt); if (claim == null) { throw new JwtException("token异常！"); } Date expiration = claim.getExpiration(); String username = claim.getSubject(); List<String> roleIdList = (List<String>) claim.get("roles"); if (jwtUtils.isTokenExpired(expiration)) { throw new JwtException("token已过期"); } List<GrantedAuthority> authorities = roleIdList.stream().map(e -> new SimpleGrantedAuthority(e)).collect(Collectors.toList()); UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(username, null , authorities); SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken); chain.doFilter(request, response); } } 6.实现Security 的配置类，重写WebSecurityConfigurerAdapter @Configuration @EnableWebSecurity @EnableGlobalMethodSecurity(prePostEnabled = true) public class MyWebSecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private DatabaseUserDetailsService userDetailsService; @Autowired @Qualifier("authenticationSuccessHandler") private AuthenticationSuccessHandler successHandler; @Autowired @Qualifier("authenticationFailHandler") private AuthenticationFailHandler failHandler; @Autowired @Qualifier("authenticationEntryPointImpl") private AuthenticationEntryPoint entryPoint; @Autowired private PasswordEncoder passwordEncoder; @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); // 使用 BCrypt 加密 } @Bean public AuthenticationProvider authenticationProvider() { DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider(); authenticationProvider.setUserDetailsService(userDetailsService); authenticationProvider.setPasswordEncoder(passwordEncoder); // 设置密码加密方式 return authenticationProvider; } @Override public void configure(HttpSecurity http) throws Exception { http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED) .and().csrf().disable().cors().and() .authorizeRequests().requestMatchers(CorsUtils::isPreFlightRequest).authenticated() //允许所有人访问knife4j .antMatchers("/doc.html", "/webjars/**", "/", "/img.icons/**", "/swagger-resources/**", "/login", "/v2/api-docs").permitAll() .anyRequest().authenticated() .and().formLogin().loginProcessingUrl("/login") .successHandler(successHandler) .failureHandler(failHandler) .and().logout().logoutSuccessUrl("/login") .and().exceptionHandling().authenticationEntryPoint(entryPoint); http.addFilterBefore(new JWTAuthenticationFilter(authenticationManager()), UsernamePasswordAuthenticationFilter.class); } @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(userDetailsService); auth.authenticationProvider(authenticationProvider()); } @Bean public AppFilterInvocationSecurityMetadataSource mySecurityMetadataSource(FilterInvocationSecurityMetadataSource filterInvocationSecurityMetadataSource) { AppFilterInvocationSecurityMetadataSource securityMetadataSource = new AppFilterInvocationSecurityMetadataSource(filterInvocationSecurityMetadataSource); return securityMetadataSource; } }

二、动态权限管理 1. 实现获取当前url的权限标识，重写FilterInvocationSecurityMetadataSource public class AppFilterInvocationSecurityMetadataSource implements org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource { @Autowired private TbRoleService tbRoleService; private FilterInvocationSecurityMetadataSource superMetadataSource; private final AntPathMatcher antPathMatcher = new AntPathMatcher(); @Override public Collection<ConfigAttribute> getAllConfigAttributes() { return null; } public AppFilterInvocationSecurityMetadataSource(FilterInvocationSecurityMetadataSource expressionBasedFilterInvocationSecurityMetadataSource){ this.superMetadataSource = expressionBasedFilterInvocationSecurityMetadataSource; } @Override public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException { FilterInvocation fi = (FilterInvocation) object; String url = fi.getRequestUrl(); // TODO 从数据库加载权限配置 List<PathRoleName> pathRoleNameList=tbRoleService.findPathAndRoleName(); for (PathRoleName pathRoleName : pathRoleNameList) { if (antPathMatcher.match(pathRoleName.getPath(),url)){ return SecurityConfig.createList(pathRoleName.getRoleName()); } } // 返回代码定义的默认配置 return SecurityConfig.createList("ROLE_LOGIN"); } @Override public boolean supports(Class<?> clazz) { return FilterInvocation.class.isAssignableFrom(clazz); } } 2.实现自定义验证权限，重写AccessDecisionManager @Component public class UrlAccessDecisionManager implements AccessDecisionManager { @Override public void decide(Authentication authentication, Object o, Collection<ConfigAttribute> collection) throws AccessDeniedException, InsufficientAuthenticationException { Iterator<ConfigAttribute> iterator = collection.iterator(); while (iterator.hasNext()) { ConfigAttribute ca = iterator.next(); //当前请求需要的权限 String needRole = ca.getAttribute(); if ("ROLE_LOGIN".equals(needRole)) { if (authentication instanceof AnonymousAuthenticationToken) { throw new BadCredentialsException("未登录"); } else { return; } } //当前用户所具有的权限 Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities(); for (GrantedAuthority authority : authorities) { if (authority.getAuthority().equals(needRole)) { return; } } } throw new AccessDeniedException("权限不足!"); } @Override public boolean supports(ConfigAttribute configAttribute) { return true; } @Override public boolean supports(Class<?> aClass) { return true; } } 3.修改配置类，将重写类添加 @Override public void configure(HttpSecurity http) throws Exception { http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED) .and().csrf().disable().cors().and() .authorizeRequests().requestMatchers(CorsUtils::isPreFlightRequest).authenticated() //允许所有人访问knife4j .antMatchers("/doc.html", "/webjars/**", "/", "/img.icons/**", "/swagger-resources/**", "/login", "/v2/api-docs").permitAll() .anyRequest().authenticated() .and().formLogin().loginProcessingUrl("/login") .successHandler(successHandler) .failureHandler(failHandler) .and().logout().logoutSuccessUrl("/login") .and().exceptionHandling().authenticationEntryPoint(entryPoint) .and().authorizeRequests()// 自定义FilterInvocationSecurityMetadataSource .withObjectPostProcessor(new ObjectPostProcessor<FilterSecurityInterceptor>() { @Override public <O extends FilterSecurityInterceptor> O postProcess( O fsi) { fsi.setSecurityMetadataSource(mySecurityMetadataSource(fsi.getSecurityMetadataSource())); fsi.setAccessDecisionManager(urlAccessDecisionManager); return fsi; } }); http.addFilterBefore(new JWTAuthenticationFilter(authenticationManager()), UsernamePasswordAuthenticationFilter.class); }

三、密码加密传输 1.前端加密 $.ajax({ type: "post", url: "/login", data: { "username": username, "password": encrypt(password) }, success: function(res) { } }); 2.后端解密 import org.springframework.http.HttpMethod; import org.springframework.lang.Nullable; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; import org.springframework.security.web.util.matcher.AntPathRequestMatcher; import org.springframework.web.filter.OncePerRequestFilter; import javax.servlet.FilterChain; import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequestWrapper; import javax.servlet.http.HttpServletResponse; import java.io.IOException; public class SignInPasswordDecryptionFilter extends OncePerRequestFilter { private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER = new AntPathRequestMatcher("/login", HttpMethod.POST.name()); @Override protected void doFilterInternal( HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { if (DEFAULT_ANT_PATH_REQUEST_MATCHER.matcher(request).isMatch()) { filterChain.doFilter(new FormContentRequestWrapper(request), response); } else { filterChain.doFilter(request, response); } } private static class FormContentRequestWrapper extends HttpServletRequestWrapper { public FormContentRequestWrapper(HttpServletRequest request) { super(request); } @Override @Nullable public String getParameter(String name) { String queryStringValue = super.getParameter(name); if (UsernamePasswordAuthenticationFilter.SPRING_SECURITY_FORM_PASSWORD_KEY.equals(name)) { // 解密操作 queryStringValue = "123456"; } return queryStringValue; } } } 3.修改配置类 http.addFilterBefore(new SignInPasswordDecryptionFilter(), UsernamePasswordAuthenticationFilter.class);