SpringSecurity--验证码原理

淡淡的烟草味﹌ 2024-02-19 17:30 17阅读 0赞

验证码生成和发送：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzU0OTU3OA_size_16_color_FFFFFF_t_70][]

表单提交/短信登陆：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzU0OTU3OA_size_16_color_FFFFFF_t_70 1][]

SpringSecurity配置：

@Configuration
    public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter {
    
    	@Autowired
    	private DataSource dataSource;
    
    	@Autowired
    	private SmsCodeAuthenticationSecurityConfig smsCodeAuthenticationSecurityConfig;
    
    	@Autowired
    	private ValidateCodeSecurityConfig validateCodeSecurityConfig;
    
    	@Autowired
    	protected AuthenticationSuccessHandler authenticationSuccessHandler;
    
    	@Autowired
    	protected AuthenticationFailureHandler authenticationFailureHandler;
    
    
    	@Override
    	protected void configure(HttpSecurity http) throws Exception {
    
    		http.formLogin()
    				.loginPage("/authentication/require")//请求路径处理
    				.loginProcessingUrl("/authentication/form")//表单登陆提交路径
    				.successHandler(authenticationSuccessHandler)//认证成功
    				.failureHandler(authenticationFailureHandler);//认证失败
    
              
    		http.apply(validateCodeSecurityConfig)
    				.and()
    				.apply(smsCodeAuthenticationSecurityConfig)
    				.and()
    				.authorizeRequests().antMatchers("/authentication/mobile",
    				"/code/*","/authentication/require","/spring-signIn.html").permitAll()
    				.anyRequest().authenticated()
    				.and()
    				.csrf().disable();
    	}
    
    	/**
    	 * 记住我功能的token存取器配置
    	 * @return
    	 */
    	@Bean
    	public PersistentTokenRepository persistentTokenRepository() {
    		JdbcTokenRepositoryImpl tokenRepository = new JdbcTokenRepositoryImpl();
    		tokenRepository.setDataSource(dataSource);
    //		tokenRepository.setCreateTableOnStartup(true);
    		return tokenRepository;
    	}
    
    }

校验码相关安全配置：

/**
     * 校验码相关安全配置
     */
    @Component("validateCodeSecurityConfig")
    public class ValidateCodeSecurityConfig extends SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity> {
    
    	@Autowired
    	private Filter validateCodeFilter;
    
    	@Override
    	public void configure(HttpSecurity http) throws Exception {
    		http.addFilterBefore(validateCodeFilter, AbstractPreAuthenticatedProcessingFilter.class);
    	}
    
    }

短信登录配置: 自定义配置短信登陆路径，应为SpringSecurity没有提供短信登陆功能。

/**
     * 短信登录配置
     * 根据 SpringSocialConfigurer源码修改成自定义短信登陆配置
     */
    @Component
    public class SmsCodeAuthenticationSecurityConfig extends SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity> {
    
    	@Autowired
    	private AuthenticationSuccessHandler authenticationSuccessHandler;
    
    	@Autowired
    	private AuthenticationFailureHandler authenticationFailureHandler;
    
    	@Autowired
    	private UserDetailsService userDetailsService;
    
    	@Autowired
    	private PersistentTokenRepository persistentTokenRepository;
    
    	/* (non-Javadoc)
    	 * @see org.springframework.security.config.annotation.SecurityConfigurerAdapter#configure(org.springframework.security.config.annotation.SecurityBuilder)
    	 */
    	@Override
    	public void configure(HttpSecurity http) throws Exception {
            //自定义短信验证拦截器
    		SmsCodeAuthenticationFilter smsCodeAuthenticationFilter = new SmsCodeAuthenticationFilter();
    		//认证管理器
    		smsCodeAuthenticationFilter.setAuthenticationManager(http.getSharedObject(AuthenticationManager.class));
    		//认证处理器
    		smsCodeAuthenticationFilter.setAuthenticationSuccessHandler(authenticationSuccessHandler);
    		smsCodeAuthenticationFilter.setAuthenticationFailureHandler(authenticationFailureHandler);
    		//记住我
    		String key = UUID.randomUUID().toString();
    		smsCodeAuthenticationFilter.setRememberMeServices(new PersistentTokenBasedRememberMeServices(key, userDetailsService, persistentTokenRepository));
            //认证提供者
    		SmsCodeAuthenticationProvider smsCodeAuthenticationProvider = new SmsCodeAuthenticationProvider();
    		smsCodeAuthenticationProvider.setUserDetailsService(userDetailsService);
            //http封装认证信息
    		http.authenticationProvider(smsCodeAuthenticationProvider)
    			.addFilterAfter(smsCodeAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
    
    //
    
    	}
    
    }

短信登录过滤器:

/**
     * 短信登录过滤器
     * 根据 UsernamePasswordAuthenticationFilter 源码编写的短信登录过滤器
     */
    public class SmsCodeAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
        //请求参数
    	private String mobileParameter = SecurityConstants.DEFAULT_PARAMETER_NAME_MOBILE;
    	private boolean postOnly = true;
    	public SmsCodeAuthenticationFilter() {
    		//请求路径
    		super(new AntPathRequestMatcher("/authentication/mobile", "POST"));
    	}
    
    	public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
    			throws AuthenticationException {
    		if (postOnly && !request.getMethod().equals("POST")) {
    			throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
    		}
            //获取表单提交上来的电话号码
    		String mobile = obtainMobile(request);
    
    		if (mobile == null) {
    			mobile = "";
    		}
    
    		mobile = mobile.trim();
            //封装认证token
    		SmsCodeAuthenticationToken authRequest = new SmsCodeAuthenticationToken(mobile);
    
    		// Allow subclasses to set the "details" property
    		setDetails(request, authRequest);
            //认证管理
    		return this.getAuthenticationManager().authenticate(authRequest);
    	}
    
    
    	/**
    	 * 获取手机号
    	 */
    	protected String obtainMobile(HttpServletRequest request) {
    		return request.getParameter(mobileParameter);
    	}
    
    	...............................
    }

短信登录验证逻辑:

/**
     * 短信登录验证逻辑
     *
     * 由于短信验证码的验证在过滤器里已完成，这里直接读取用户信息即可。
     *
     * 根据SocialAuthenticationProvider源码改造的
     *
     */
    public class SmsCodeAuthenticationProvider implements AuthenticationProvider {
    
    	private UserDetailsService userDetailsService;
    
    	@Override
    	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
            //获取认证token
    		SmsCodeAuthenticationToken authenticationToken = (SmsCodeAuthenticationToken) authentication;
            //获取用户信息
    		UserDetails user = userDetailsService.loadUserByUsername((String) authenticationToken.getPrincipal());
    
    		if (user == null) {
    			throw new InternalAuthenticationServiceException("无法获取用户信息");
    		}
            
    		SmsCodeAuthenticationToken authenticationResult = new SmsCodeAuthenticationToken(user, user.getAuthorities());
    
    		authenticationResult.setDetails(authenticationToken.getDetails());
    
    		return authenticationResult;
    	}
    	...................................
    }

短信登录验证信息封装类:

/**
     * 短信登录验证信息封装类
     *
     * 根据 UsernamePasswordAuthenticationToken源码改造的
     */
    public class SmsCodeAuthenticationToken extends AbstractAuthenticationToken {
    
    	private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
    
    	
    	private final Object principal;
    
    	
    	public SmsCodeAuthenticationToken(String mobile) {
    		super(null);
    		this.principal = mobile;
    		setAuthenticated(false);
    	}
    
    	
    	public SmsCodeAuthenticationToken(Object principal,
    			Collection<? extends GrantedAuthority> authorities) {
    		super(authorities);
    		this.principal = principal;
    		super.setAuthenticated(true); // must use super, as we override
    	}
    
    	。。。。。。。。。。。。。。。。。。。。
    }

验证码生成和发送：

/**
     * 生成校验码的请求处理器
     */
    @RestController
    public class ValidateCodeController {
    
    	@Autowired
    	private ValidateCodeProcessorHolder validateCodeProcessorHolder;
    
    	/**
    	 * 创建验证码，根据验证码类型不同，调用不同的 {@link ValidateCodeProcessor}接口实现
    	 *
    	 * @param request
    	 * @param response
    	 * @param type
    	 * @throws Exception
    	 */
    	@GetMapping(""/code/{type}")
    	public void createCode(HttpServletRequest request, HttpServletResponse response, @PathVariable String type)
    			throws Exception {
    		validateCodeProcessorHolder.findValidateCodeProcessor(type).create(new ServletWebRequest(request, response));
    	}
    
    }

校验码处理器:

/**
     * 校验码处理器，封装不同校验码的处理逻辑
     */
    public interface ValidateCodeProcessor {
    
    	/**
    	 * 创建校验码
    	 *
    	 * @param request
    	 * @throws Exception
    	 */
    	void create(ServletWebRequest request) throws Exception;
    
    	/**
    	 * 校验验证码
    	 *
    	 * @param servletWebRequest
    	 * @throws Exception
    	 */
    	void validate(ServletWebRequest servletWebRequest);
    
    }

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzU0OTU3OA_size_16_color_FFFFFF_t_70]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/f5cff067ef8748928405fd377a46976d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzU0OTU3OA_size_16_color_FFFFFF_t_70 1]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/5bbaad6a2c054f5e90294915a851c9a5.png