springBoot集成spring-security 自定义token实现

小灰灰 2022-09-03 06:25 278阅读 0赞

#### spring-security ####

基于session实现  
当用户登录后会在session中存储认证信息

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x6cTE5OTUyOA_size_16_color_FFFFFF_t_70_pic_center]

当用户访问接口时会从session中取出认证信息,放入SecurityContext中。  
放入SecurityContext 由 ThreadLocal 持有  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x6cTE5OTUyOA_size_16_color_FFFFFF_t_70_pic_center 1]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x6cTE5OTUyOA_size_16_color_FFFFFF_t_70_pic_center 2]

然后进行认证处理程序

#### 而我们要基于token实现就要抛弃session的实现 ####

1.  登录成功后将 token和认证信息另找地方存储
2.  当访问需要认证访问的接口时，根据token找到认证信息，将认证信息塞到SecurityContext中，SecurityContext由ThreadLocal持有
3.  源码

//
    // Source code recreated from a .class file by IntelliJ IDEA
    // (powered by Fernflower decompiler)
    //
    
    package org.springframework.security.core.context;
    
    import org.springframework.util.Assert;
    
    final class ThreadLocalSecurityContextHolderStrategy implements SecurityContextHolderStrategy { 
        private static final ThreadLocal<SecurityContext> contextHolder = new ThreadLocal();
    
        ThreadLocalSecurityContextHolderStrategy() { 
        }
    
        public void clearContext() { 
            contextHolder.remove();
        }
    
        public SecurityContext getContext() { 
            SecurityContext ctx = (SecurityContext)contextHolder.get();
            if (ctx == null) { 
                ctx = this.createEmptyContext();
                contextHolder.set(ctx);
            }
    
            return ctx;
        }
    
        public void setContext(SecurityContext context) { 
            Assert.notNull(context, "Only non-null SecurityContext instances are permitted");
            contextHolder.set(context);
        }
    
        public SecurityContext createEmptyContext() { 
            return new SecurityContextImpl();
        }
    }

##### 1. 引入开发包 #####

<dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-security</artifactId>
            </dependency>

#### 2. 配置security ####

package com.liuzhiqiang.security.token.confing;
    
    import com.fasterxml.jackson.databind.ObjectMapper;
    import com.liuzhiqiang.security.token.vo.AjaxResult;
    import lombok.extern.slf4j.Slf4j;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.beans.factory.annotation.Value;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.http.HttpStatus;
    import org.springframework.security.access.AccessDeniedException;
    import org.springframework.security.authentication.AuthenticationProvider;
    import org.springframework.security.authentication.DisabledException;
    import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UsernameNotFoundException;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.security.crypto.password.PasswordEncoder;
    import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
    
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    import java.io.PrintWriter;
    import java.util.Collection;
    import java.util.UUID;
    
    @Configuration
    // 启用Security
    @EnableWebSecurity
    // 启用方法级注解
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    @Slf4j
    public class SecurityConfig extends WebSecurityConfigurerAdapter { 
    
        @Autowired
        private UserDetailsServiceImpl userDetailsService;
        @Autowired
        private AuthorizationTokenFilter authenticationTokenFilter;
    
        @Value("${permitAll.url}")
        private String[] permitAllUrl;
    
        /** * 密码编码器 * * @return */
        @Bean
        PasswordEncoder passwordEncoder() { 
            return new BCryptPasswordEncoder(10);
        }
    
    
        /** * 配置身份验证程序 和密码验证方式 * * @param auth * @throws Exception */
        @Override
        public void configure(AuthenticationManagerBuilder auth) throws Exception { 
            // 第一种 dao 认证，由UserDetailsService 实现来返回认证西信息
    // auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
            // 第二种 在内存中创建好用户来匹配登录用户
    // auth.inMemoryAuthentication()
    // .passwordEncoder(passwordEncoder())
    // .withUser("admin")
    // .password(passwordEncoder().encode("123456"))
    // .authorities("admin");
            // 第三种 自定义实现身份认证
            auth.authenticationProvider(new AuthenticationProvider() { 
                @Override
                public Authentication authenticate(Authentication authentication) throws AuthenticationException { 
                    String username = authentication.getName();
                    String password = (String) authentication.getCredentials();
                    log.info("前端传过来的明文密码:{}", password);
                    UserDetails user = userDetailsService.loadUserByUsername(username);
                    if (user == null) { 
                        throw new UsernameNotFoundException("用户不存在");
                    }
                    if (!passwordEncoder().matches(password, user.getPassword())) { 
                        throw new DisabledException("密码错误");
                    }
    
                    Collection<? extends GrantedAuthority> authorities = user.getAuthorities();
                    // 构建认证信息返回
                    return new UsernamePasswordAuthenticationToken(user, user.getPassword(), authorities);
                }
    
                @Override
                public boolean supports(Class<?> aClass) { 
                    return true;
                }
            });
        }
    
    
        /** * 配置 HttpSecurity 策略 * * @param http * @throws Exception */
        @Override
        public void configure(HttpSecurity http) throws Exception { 
            // 添加过滤器，在token访问时 将权限信息加入上下文中
            http.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
            // 添加异常处理器
            http.exceptionHandling()
                    .accessDeniedHandler(this::handle)
                    .authenticationEntryPoint(this::commence);
            // 请求访问策略
            http.authorizeRequests()
                    .antMatchers(permitAllUrl).permitAll()
                    .anyRequest().authenticated();
            // 启用Security 登录，登录处理策略
            http.formLogin()
                    // 定义登录接口 默认 login
                    .loginProcessingUrl("/login")
                    .permitAll()
                    // 登录失败处理
                    .failureHandler(this::failureHandler)
                    // 登录成功处理
                    .successHandler(this::successHandler)
                    .and()
                    // 退出处理
                    .logout().logoutUrl("/logout")
                    // 退出成功处理
                    .logoutSuccessHandler(this::logoutSuccessHandler);
    
            //开启跨域访问
            http.cors().disable();
            // 关闭csrf防护
            http.csrf().disable();
        }
    
        public void logoutSuccessHandler(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException { 
            log.info("退出");
            String token = request.getHeader("Authorization");
            TokenAndAuthentication.delete(token);
            response.setContentType("application/json;charset=utf-8");
            PrintWriter out;
            out = response.getWriter();
            out.write(new ObjectMapper().writeValueAsString(AjaxResult.success("退出成功")));
            out.flush();
            out.close();
        }
    
        /** * 登录成功处理 * * @param request * @param response * @param authentication */
        public void successHandler(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException { 
            log.info("登录成功处理");
            String token = UUID.randomUUID().toString();
            TokenAndAuthentication.setTokenAndAuthentication(token, authentication);
            response.setContentType("application/json;charset=utf-8");
            PrintWriter out;
            out = response.getWriter();
            out.write(new ObjectMapper().writeValueAsString(AjaxResult.successData(token)));
            out.flush();
            out.close();
    
        }
    
        /** * 抛出AccessDeniedException异常 * 没权限 * * @param request * @param response * @param accessDeniedException */
        public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException { 
            log.error("异常：{}", accessDeniedException.getMessage());
            accessDeniedException.printStackTrace();
            response.setContentType("application/json;charset=utf-8");
            PrintWriter out;
            out = response.getWriter();
            out.write(new ObjectMapper().writeValueAsString(AjaxResult.error(403, accessDeniedException.getMessage())));
            out.flush();
            out.close();
        }
    
        /** * 抛出AuthenticationException异常 * * @param request * @param response * @param authException */
        public void commence(HttpServletRequest request, HttpServletResponse response,
                             AuthenticationException authException) throws IOException { 
            log.error("异常：{}", authException.getMessage());
            authException.printStackTrace();
            response.setContentType("application/json;charset=utf-8");
            PrintWriter out;
            out = response.getWriter();
            out.write(new ObjectMapper().writeValueAsString(AjaxResult.error(HttpStatus.FORBIDDEN.value(), authException.getMessage())));
            out.flush();
            out.close();
        }
    
        private void failureHandler(HttpServletRequest request, HttpServletResponse response, AuthenticationException authenticationException) throws IOException { 
            log.error("异常：{}", authenticationException.getMessage());
            authenticationException.printStackTrace();
            response.setContentType("application/json;charset=utf-8");
            PrintWriter out;
            out = response.getWriter();
            out.write(new ObjectMapper().writeValueAsString(AjaxResult.error(HttpStatus.BAD_REQUEST.value(), "登录失败，用户名或密码不正确")));
            out.flush();
            out.close();
        }
    
    }

1.  登录成功处理. 将认证信息和token进行存储

public void successHandler(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException { 
            log.info("登录成功处理");
            String token = UUID.randomUUID().toString();
            TokenAndAuthentication.setTokenAndAuthentication(token, authentication);
            response.setContentType("application/json;charset=utf-8");
            PrintWriter out;
            out = response.getWriter();
            out.write(new ObjectMapper().writeValueAsString(AjaxResult.successData(token)));
            out.flush();
            out.close();
    
        }

1.  添加过滤器，拦截请求，将认证信息添加至SecurityContext中

http.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);

package com.liuzhiqiang.security.token.confing;
    
    import com.fasterxml.jackson.databind.ObjectMapper;
    import com.liuzhiqiang.security.token.vo.AjaxResult;
    import lombok.extern.slf4j.Slf4j;
    import org.apache.commons.lang3.ArrayUtils;
    import org.apache.commons.lang3.StringUtils;
    import org.springframework.beans.factory.annotation.Value;
    import org.springframework.http.HttpStatus;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.context.SecurityContextHolder;
    import org.springframework.stereotype.Component;
    import org.springframework.web.filter.OncePerRequestFilter;
    
    import javax.servlet.FilterChain;
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    import java.io.PrintWriter;
    
    @Component
    @Slf4j
    public class AuthorizationTokenFilter extends OncePerRequestFilter { 
    
        @Value("${permitAll.url}")
        private String[] permitAllUrl;
    
        @Override
        protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException { 
            if (!ArrayUtils.contains(permitAllUrl, httpServletRequest.getRequestURI())) { 
                String token = httpServletRequest.getHeader("Authorization");
                if (StringUtils.isNotEmpty(token)) { 
                    // 从redis中取出用户信息,没有集成redis,这块最好使用redis。后期可以集群共享
                    Authentication authentication = TokenAndAuthentication.getAuthentication(token);
                    if (authentication == null) { 
                        commence(httpServletResponse, AjaxResult.error(HttpStatus.FORBIDDEN.value(), "令牌不可用"));
                    } else { 
                        // 添加至上下文中
                       SecurityContextHolder.getContext().setAuthentication(authentication);
                        filterChain.doFilter(httpServletRequest, httpServletResponse);
                    }
                } else { 
                    commence(httpServletResponse, AjaxResult.error(HttpStatus.FORBIDDEN.value(), "未携带令牌"));
                }
            } else { 
                filterChain.doFilter(httpServletRequest, httpServletResponse);
            }
        }
    
        public void commence(HttpServletResponse response, AjaxResult ajaxResult) throws IOException { 
            log.error("异常：{}", ajaxResult.getMsg());
            response.setContentType("application/json;charset=utf-8");
            PrintWriter out;
            out = response.getWriter();
            out.write(new ObjectMapper().writeValueAsString(ajaxResult));
            out.flush();
            out.close();
        }
    }

1.  退出清空 token对应的认证信息

public void logoutSuccessHandler(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException { 
            log.info("退出");
            String token = request.getHeader("Authorization");
            TokenAndAuthentication.delete(token);
            response.setContentType("application/json;charset=utf-8");
            PrintWriter out;
            out = response.getWriter();
            out.write(new ObjectMapper().writeValueAsString(AjaxResult.success("退出成功")));
            out.flush();
            out.close();
        }

### [源码][Link 1] ###

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x6cTE5OTUyOA_size_16_color_FFFFFF_t_70_pic_center]: /images/20220829/3aab60dce5474e05a1ae051cd094a3d0.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x6cTE5OTUyOA_size_16_color_FFFFFF_t_70_pic_center 1]: /images/20220829/62bfa9e14d0c422683ca23c39ca0debd.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x6cTE5OTUyOA_size_16_color_FFFFFF_t_70_pic_center 2]: /images/20220829/9a86351e0ee24907b662c0f9c700666a.png
[Link 1]: https://gitee.com/lzq199528/springboot/tree/master/spring-security-token-demo