SpringSecurity之授权鉴权

旧城等待， 2023-07-04 08:52 14阅读 0赞

一般系统中区分账号角色即可，除了后台管理这类对权限要求比较复杂的。

*  权限表达式：  
    ![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n_size_16_color_FFFFFF_t_70]
 *  使用  
    一般在类上或者方法上添加注解使用（不需要对每一个接口配置权限，一般小项目用不到，只要数据库是逻辑删除可恢复这种简单的就可以使用）  
    ![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n_size_16_color_FFFFFF_t_70 1]  
    在启动类上添加注解：  
    `@EnableGlobalMethodSecurity(securedEnabled = true, jsr250Enabled = true, prePostEnabled = true)`
 *  配置资源服务器  
    依赖：
    
        <dependencies>
        	<dependency>
        		<groupId>org.springframework.boot</groupId>
        		<artifactId>spring-boot-starter-security</artifactId>
        	</dependency>
        	<dependency>
        		<groupId>org.springframework.cloud</groupId>
        		<artifactId>spring-cloud-starter-oauth2</artifactId>
        	</dependency>
        	<dependency>
        		<groupId>io.undertow</groupId>
        		<artifactId>undertow-servlet</artifactId>
        	</dependency>
        </dependencies>
    
    EnableResourceServer:
    
        package com.cong.security;
        
        import org.springframework.context.annotation.Configuration;
        import org.springframework.http.HttpMethod;
        import org.springframework.security.config.annotation.web.builders.HttpSecurity;
        import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
        import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
        import org.springframework.web.cors.CorsUtils;
        
        @Configuration
        @EnableResourceServer
        public class MyResourceServerConfig extends ResourceServerConfigurerAdapter { 
        
        	@Override
        	public void configure(HttpSecurity http) throws Exception { 
        
        		http.authorizeRequests().antMatchers(HttpMethod.OPTIONS).permitAll();// 放行预请求
        
        		http.authorizeRequests().requestMatchers(CorsUtils::isPreFlightRequest).permitAll()// 解决浏览器端预请求直接放过,不作处理
        				.and().csrf().disable();// 跨站请求访问
        	}
        }
    
    JWT配置
    
        package com.cong.security;
        
        import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
        import org.springframework.context.annotation.Bean;
        import org.springframework.context.annotation.Configuration;
        import org.springframework.security.oauth2.provider.token.TokenStore;
        import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
        import org.springframework.security.oauth2.provider.token.store.JwtTokenStore;
        
        @Configuration
        public class TokenStoreConfig { 
        
        	/** * prefix---检查的配置项的前缀<br> * name---配置文件中prefix串后面的参数名<br> * havingValue---值对应此配置参数的时候，当前类的所有配置生效<br> * matchIfMissing---设置为true等同于如果配置文件中不设置任何属性，配置文件生效<br> */
        	@Configuration
        	@ConditionalOnProperty(prefix = "my.security.oAuth2", name = "storeType", havingValue = "jwt", matchIfMissing = true)
        	public static class JwtTokenConfig { 
        
        		/** * 处理token存储 */
        		@Bean
        		public TokenStore jwtTokenStore() { 
        			return new JwtTokenStore(jwtAccessTokenConverter());
        		}
        
        		/** * 处理token生成逻辑 */
        		@Bean
        		public JwtAccessTokenConverter jwtAccessTokenConverter() { 
        			JwtAccessTokenConverter accessTokenConverter = new JwtAccessTokenConverter();
        			// 设置签名密钥
        			accessTokenConverter.setSigningKey("mydev");
        			return accessTokenConverter;
        		}
        	}
        }
    
    CORS简单配置：
    
        package com.cong.security;
        
        import java.util.Arrays;
        import java.util.List;
        import org.springframework.core.Ordered;
        import org.springframework.core.annotation.Order;
        import org.springframework.http.HttpHeaders;
        import org.springframework.stereotype.Component;
        import org.springframework.web.cors.CorsConfiguration;
        import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
        import org.springframework.web.filter.CorsFilter;
        
        @Component
        @Order(Ordered.HIGHEST_PRECEDENCE)
        public class MyCorsFilter extends CorsFilter { 
        	
        	public MyCorsFilter() { 
        		super(configurationSource());
        	}
        
        	public static UrlBasedCorsConfigurationSource configurationSource() { 
        		CorsConfiguration corsConfig = new CorsConfiguration();
        		List<String> allowedHeaders = Arrays.asList("Authorization", "Access-Control-Allow-Origin",
        				"Access-Control-Request-Headers", "Access-Control-Request-Method", "x-auth-token", "content-type",
        				"X-Requested-With", "XMLHttpRequest");
        		List<String> exposedHeaders = Arrays.asList("Authorization", "Access-Control-Allow-Origin",
        				"Access-Control-Request-Headers", "Access-Control-Request-Method", "x-auth-token", "content-type",
        				"X-Requested-With", "XMLHttpRequest");
        		List<String> allowedMethods = Arrays.asList("POST", "GET", "DELETE", "PUT", "OPTIONS");
        		corsConfig.setAllowedHeaders(allowedHeaders);
        		corsConfig.setAllowedMethods(allowedMethods);
        		// 配置跨域请求
        		corsConfig.addExposedHeader(HttpHeaders.SET_COOKIE);
        		corsConfig.setExposedHeaders(exposedHeaders);
        		corsConfig.setMaxAge(36000L);
        		corsConfig.setAllowCredentials(true);
        		corsConfig.addAllowedOrigin("*");
        		UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        		source.registerCorsConfiguration("/**", corsConfig);
        		return source;
        	}
        }
    
    将上面三个类提取出来到一个单独的模块中，这样使用JWT无状态登录即可实现模块拆分，方便业务扩展。

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200209202110150.jpg?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200209202530854.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n,size_16,color_FFFFFF,t_70