spring-security之TokenStore键值简介

缺乏、安全感 2023-05-21 07:07 23阅读 0赞

使用spring-security作权限控制时，登陆成功会创建对应授权信息，然后通过对应的TokenStore实现把对应的授权信息保存起来，当显示用户访问对应保护接口时就会根据客户端传入的token获取认证信息，我们先看下TokenStore接口定义：

public interface TokenStore {
    
    	/**
    	 * Read the authentication stored under the specified token value.
    	 * 
    	 * @param token The token value under which the authentication is stored.
    	 * @return The authentication, or null if none.
    	 */
    	OAuth2Authentication readAuthentication(OAuth2AccessToken token);
    
    	/**
    	 * Read the authentication stored under the specified token value.
    	 * 
    	 * @param token The token value under which the authentication is stored.
    	 * @return The authentication, or null if none.
    	 */
    	OAuth2Authentication readAuthentication(String token);
    
    	/**
    	 * Store an access token.
    	 * 
    	 * @param token The token to store.
    	 * @param authentication The authentication associated with the token.
    	 */
    	void storeAccessToken(OAuth2AccessToken token, OAuth2Authentication authentication);
    
    	/**
    	 * Read an access token from the store.
    	 * 
    	 * @param tokenValue The token value.
    	 * @return The access token to read.
    	 */
    	OAuth2AccessToken readAccessToken(String tokenValue);
    
    	/**
    	 * Remove an access token from the store.
    	 * 
    	 * @param token The token to remove from the store.
    	 */
    	void removeAccessToken(OAuth2AccessToken token);
    
    	/**
    	 * Store the specified refresh token in the store.
    	 * 
    	 * @param refreshToken The refresh token to store.
    	 * @param authentication The authentication associated with the refresh token.
    	 */
    	void storeRefreshToken(OAuth2RefreshToken refreshToken, OAuth2Authentication authentication);
    
    	/**
    	 * Read a refresh token from the store.
    	 * 
    	 * @param tokenValue The value of the token to read.
    	 * @return The token.
    	 */
    	OAuth2RefreshToken readRefreshToken(String tokenValue);
    
    	/**
    	 * @param token a refresh token
    	 * @return the authentication originally used to grant the refresh token
    	 */
    	OAuth2Authentication readAuthenticationForRefreshToken(OAuth2RefreshToken token);
    
    	/**
    	 * Remove a refresh token from the store.
    	 * 
    	 * @param token The token to remove from the store.
    	 */
    	void removeRefreshToken(OAuth2RefreshToken token);
    
    	/**
    	 * Remove an access token using a refresh token. This functionality is necessary so refresh tokens can't be used to
    	 * create an unlimited number of access tokens.
    	 * 
    	 * @param refreshToken The refresh token.
    	 */
    	void removeAccessTokenUsingRefreshToken(OAuth2RefreshToken refreshToken);
    
    	/**
    	 * Retrieve an access token stored against the provided authentication key, if it exists.
    	 * 
    	 * @param authentication the authentication key for the access token
    	 * 
    	 * @return the access token or null if there was none
    	 */
    	OAuth2AccessToken getAccessToken(OAuth2Authentication authentication);
    
    	/**
    	 * @param clientId the client id to search
    	 * @param userName the user name to search
    	 * @return a collection of access tokens
    	 */
    	Collection<OAuth2AccessToken> findTokensByClientIdAndUserName(String clientId, String userName);
    
    	/**
    	 * @param clientId the client id to search
    	 * @return a collection of access tokens
    	 */
    	Collection<OAuth2AccessToken> findTokensByClientId(String clientId);
    
    }

场景的TokenStore实现有InMemoryTokenStore（保存本地内存）、JdbcTokenStore（保存到数据库）、JwkTokenStore（全部信息返回到客户端）以及RedisTokenStore（保存到redis），由于认证调用的频率，一般推荐使用RedisTokenStore或者JwkTokenStore两种，本文仅简单介绍下RedisTokenStore保存的内容，

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2pvaG4xMzM3_size_16_color_FFFFFF_t_70][]

上面5个键值是跟accessToken相关的，

auth_to_access:这个键值在OAuth2AccessToken getAccessToken(OAuth2Authentication authentication)方法用到，通过认证信息获取到OAuth2AccessToken对象

client_id_to_access:这个键值在Collection<OAuth2AccessToken> findTokensByClientId(String clientId)方法中会用到

uname_to_access:在Collection<OAuth2AccessToken> findTokensByClientIdAndUserName(String clientId, String userName)方法中用到

auth:在OAuth2Authentication readAuthentication(String token)方法中用到

PS：

Spring-security实现的RedisTokenStore没有使用Redis连接池，笔者在实际使用中对其进行了改造。

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2pvaG4xMzM3_size_16_color_FFFFFF_t_70]: /images/20230521/8e9e2d413c7546748f0ac6bca0e6187a.png