SpringBoot Security认证 Redis缓存用户信息【SpringBoot系列10】

拼搏现实的明天。 2023-09-25 20:44 11阅读 0赞

在用户的 login 接口中 Spring Security 认证通过后，获取到用户的详情，然后保存到 Redis 中，其中 token 为 Redis 缓存 用户的key .

@Slf4j
    @RestController
    @RequestMapping("/api/auth")
    public class AuthController {
    
        @Autowired
        private AuthenticationManager authenticationManager;
        @Autowired
        private JWTGenerator jwtGenerator;
    
        @Autowired
        private RedisTemplate redisTemplate;
    
        @PostMapping("login")
        public R login(@RequestBody LoginRequest loginDto){
            log.info("登录认证开始 {}",loginDto.toString());
            Authentication authentication = authenticationManager.authenticate(
                    new UsernamePasswordAuthenticationToken(
                            loginDto.getUserName(),
                            loginDto.getPassword()));
            // 认证成功存储认证信息到上下文
            SecurityContextHolder.getContext().setAuthentication(authentication);
    
            log.info("登录认证完成 {}",loginDto.toString());
            String token = jwtGenerator.generateToken(authentication);
            log.info("登录认证生成 token {}",token);
    
            String name = authentication.getName();
            //查询用户的详情
            UserInfo userInfo = userService.getByUsername(name);
            //保存用户信息到 redis 中
            ValueOperations<String, UserInfo> operations = redisTemplate.opsForValue();
            //保存用户信息到 redis 中
            operations.set(token, userInfo,7*24*3600, TimeUnit.SECONDS);
    
            return R.okData(token);
        }
     }
    复制代码

然后咱们在 Spring Security 配置的拦截器中，token 校验通过后，从 Redis 中查询缓存的用户信息，将用户信息的 UserId 配置到请求头中

import com.alibaba.fastjson.JSONObject;
    import com.biglead.demo.pojo.UserInfo;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.data.redis.core.RedisTemplate;
    import org.springframework.data.redis.core.ValueOperations;
    import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    import org.springframework.security.core.context.SecurityContextHolder;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
    import org.springframework.util.StringUtils;
    import org.springframework.web.filter.OncePerRequestFilter;
    
    import javax.servlet.FilterChain;
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    import java.util.HashMap;
    import java.util.Map;
    
    public class JWTAuthenticationFilter extends OncePerRequestFilter {
    
        @Autowired
        private JWTGenerator tokenGenerator;
        @Autowired
        private CustomUserDetailsService customUserDetailsService;
        @Autowired
        private RedisTemplate redisTemplate;
    
        @Override
        protected void doFilterInternal(HttpServletRequest request,
                                        HttpServletResponse response,
                                        FilterChain filterChain) throws ServletException, IOException {
            //获取请求头中的 token 信息
            String token = getJWTFromRequest(request);
            //校验token
            if(StringUtils.hasText(token) && tokenGenerator.validateToken(token)) {
                //解析 token 中的用户信息 （用户的唯一标识 ）
                String username = tokenGenerator.getUsernameFromJWT(token);
    
                UserDetails userDetails = customUserDetailsService.loadUserByUsername(username);
                UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(userDetails, null,
                        userDetails.getAuthorities());
                authenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(authenticationToken);
    
                //获取用户信息
                ValueOperations<String, UserInfo> operations = redisTemplate.opsForValue();
                UserInfo userInfo = operations.get(token);
                if(userInfo==null){
                    Map<String,Object> map = new HashMap<>();
                    map.put("code",403);
                    map.put("message","登录过期，重新登录");
                    response.getWriter().print(JSONObject.toJSONString(map));
                    return;
                }
                
                //自定义Request 
                HttpServletRequest req = (HttpServletRequest) request;
    
                XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(req);
                //添加自定义头
                xssRequest.putHeader("userId", userInfo.getUserId().toString());
                xssRequest.putHeader("userName", userInfo.getUserName().toString());
    
                filterChain.doFilter(xssRequest, response);
                return;
            }
            filterChain.doFilter(request, response);
        }
    
        /**
         * 就是校验请求头的一种格式 可以随便定义
         * 只要可以解析 就可以
         * @param request
         * @return
         */
        private String getJWTFromRequest(HttpServletRequest request) {
            String bearerToken = request.getHeader("Authorization");
            if(StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")) {
                return bearerToken.substring(7, bearerToken.length());
            }
            return null;
        }
    }
    复制代码

这里的核心实现 就是 XssHttpServletRequestWrapper

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
      
        private final Map<String, String> customHeaders;
    
        public XssHttpServletRequestWrapper(HttpServletRequest request) {
            super(request);
            this.customHeaders = new HashMap<String, String>();
        }
    
        public void putHeader(String name, String value) {
            this.customHeaders.put(name, value);
        }
    
        public String getHeader(String name) {
            // check the custom headers first
            String headerValue = customHeaders.get(name);
    
            if (headerValue != null) {
                return headerValue;
            }
            // else return from into the original wrapped object
            return ((HttpServletRequest) getRequest()).getHeader(name);
        }
    
        public Enumeration<String> getHeaderNames() {
            // create a set of the custom header names
            Set<String> set = new HashSet<String>(customHeaders.keySet());
    
            // now add the headers from the wrapped request object
            @SuppressWarnings("unchecked")
            Enumeration<String> e = ((HttpServletRequest) getRequest()).getHeaderNames();
            while (e.hasMoreElements()) {
                // add the names of the request headers into the list
                String n = e.nextElement();
                set.add(n);
            }
    
            // create an enumeration from the set and return
            return Collections.enumeration(set);
        }
    
        @Override
        public Enumeration<String> getHeaders(String name) {
            String values = getHeader(name);
            Set<String> set = Arrays.asList(values.split(",")).stream().collect(Collectors.toSet());
            if (customHeaders.containsKey(name)) {
                return Collections.enumeration(set);
            }
            return super.getHeaders(name);
        }
    }
    复制代码

这里是自定义的 HttpServletRequestWrapper ，本小节是对 请求Request 中的请求头的操作，后续咱们还会在这里 获取请求体中的参数

然后咱们在请求其他接口的时候 ，就可以通过 @RequestHeader 注解来获取对应的信息，如这里获取 设置的用户信息

@Api(tags="用户分类模块")
    @RestController()
    @RequestMapping("/auto/userCategory")
    @Slf4j
    public class UserCategoryController {
    
        @Resource
        IUserCategoryService userCategoryService;
        @GetMapping(value="/findPage")
        @ApiOperation(value = "分页查询")
        public Object findPage(
                @RequestHeader String userId,
                @RequestHeader String userName,
                @RequestParam(required = false,defaultValue = "1") Integer index,
                               @RequestParam(required = false,defaultValue = "10") Integer pageSize) {
            log.info("请求头 userId {} userName {}",userId,userName);
            Object page = userCategoryService.findPage(index, pageSize);
            return page;
        }
    }
    复制代码

本文章是系列文章 ，每节文章都有对应的代码，每节的源码都是在上一节的基础上配置而来，对应的视频讲解课程正在火速录制中。 项目源码在这里 ：[gitee.com/android.lon…][gitee.com_android.lon] 有兴趣可以关注一下公众号：biglead

作者：早起的年轻人  
链接：https://juejin.cn/post/7215895579464974392

[gitee.com_android.lon]: https://link.juejin.cn?target=https%3A%2F%2Fgitee.com%2Fandroid.long%2Fspring-boot-study%2Ftree%2Fmaster%2Fbiglead-api-08-security-redis