devbox
Li_阴宅
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

SpringBoot + SpringSecurity+JWT整合（微服务适用）

作者：Li_阴宅 | 2024-07-26 14:37:23

赞

踩

SpringBoot + SpringSecurity+JWT整合（微服务适用）

SpringSecurity基于表单的登录认证流程如下图：

大致过程是在UsernamePasswordAuthenticationFilter将username和password封装成UsernamePasswordAuthenticationToken，之后会在AuthenticationProvider（接口，需要自己实现）的authenticate方法中拿到且校验（一般是查数据库，对比账号密码），而校验成功则返回Authentication接口对象（一般情况是直接返回UsernamePasswordAuthenticationToken，该对象会默认记录在session以及SecurityContextHolder的SecurityContext中）随后走认证成功流程（一般会实现AuthenticationSuccessHandler接口），否则就抛异常走认证失败流程（一般会实现AuthenticationFailureHandler接口）。

以上是普通单体项目的认证过程，那么整合JWT或者说微服务则会有以下问题：

  1.  在哪里生成JWT？
  2. 如何解释前端传来的JWT字符串获取到用户信息？
  3. 认证成功后如何去除Session信息？（JWT是无状态的，不需要服务器端保存）JWT的详情参考

对于第一个问题，很好解决，在AuthenticationProvider认证成功后不返回UsernamePasswordAuthenticationToken，返回自定义的JwtAuthenticationToken，然后在自定义的LoginSuccessHandler返回给前端即可，代码如下：

  1. //JWT中荷载存储内容的实体类
  2. @Data
  3. public class UserDetails {
  4.     private String userId;
  5.     private String username;
  6.     private String portrait;
  7. }
  8. //用来生成和解释Token字符串，这里采用了单例模式，相当于JwtUtils
  9. public class UserTokenManager {
  10.     private final String SECRET = "happy-king";
  11.     private static volatile UserTokenManager userTokenManager;
  12.  
  13.     private UserTokenManager() {
  14.     }
  15.  
  16.     public static UserTokenManager getInstance() {
  17.         if (userTokenManager == null) {
  18.             synchronized (UserTokenManager.class) {
  19.                 if (userTokenManager == null) {
  20.                     userTokenManager = new UserTokenManager();
  21.                 }
  22.             }
  23.         }
  24.         return userTokenManager;
  25.     }
  26.  
  27.     @SuppressWarnings("unchecked")
  28.     public String generateToken(UserDetails userDetails, long timeout) {
  29.         long currentTimeMillis = System.currentTimeMillis();
  30.         return JWT.create()
  31.                 .withJWTId(UUID.randomUUID().toString())
  32.                 .withIssuedAt(new Date(currentTimeMillis))
  33.                 .withClaim("user_id", userDetails.getUserId())
  34.                 .withClaim("username", userDetails.getUsername())
  35.                 .withClaim("portrait", userDetails.getPortrait())
  36.                 .withExpiresAt(new Date(currentTimeMillis + timeout))
  37.                 .sign(Algorithm.HMAC256(SECRET));
  38.     }
  39.  
  40.     public String generateToken(UserDetails userDetails) {
  41.         return generateToken(userDetails, 1000 * 24 * 60 * 60L);
  42.     }
  43.  
  44.     public UserDetails parseToken(String token) {
  45.         try {
  46.             DecodedJWT decodedJWT =         JWT.require(Algorithm.HMAC256(SECRET)).build().verify(token);
  47.             Date issuedAt = decodedJWT.getIssuedAt();
  48.             if (issuedAt.before(new Date())) {
  49.                 String userId = decodedJWT.getClaim("user_id").asString();
  50.                 String username = decodedJWT.getClaim("username").asString();
  51.                 String portrait = decodedJWT.getClaim("portrait").asString();
  52.                 UserDetails userDetails = new UserDetails();
  53.                 userDetails.setUsername(username);
  54.                 userDetails.setUserId(userId);
  55.                 userDetails.setPortrait(portrait);
  56.                 return userDetails;
  57.             } else {
  58.                 return null;
  59.             }
  60.         } catch (Exception e) {
  61.             return null;
  62.         }
  63.     }
  64. }
  65. //自定义的Authentication类
  66. public class JwtAuthenticationToken  extends AbstractAuthenticationToken {
  67.     private final UserDetails userDetails;
  68.     private final UserTokenManager userTokenManager = UserTokenManager.getInstance();
  69.  
  70.     public JwtAuthenticationToken(UserDetails userDetails,
  71.             Collection<? extends GrantedAuthority> authorities) {
  72.         super(authorities);
  73.         this.userDetails = userDetails;
  74.     }
  75.  
  76.     @Override
  77.     public Object getCredentials() {
  78.         return null;
  79.     }
  80.  
  81.     @Override
  82.     public Object getPrincipal() {
  83.         return userDetails;
  84.     }
  85.  
  86.     public String generateJWT(){
  87.         return userTokenManager.generateToken(userDetails);
  88.     }
  89. }
  90. //登录认证主要逻辑类
  91. public class AuthenticationProvider implements org.springframework.security.authentication.AuthenticationProvider {
  92.     @Override
  93.     public Authentication authenticate(Authentication authentication) throws AuthenticationException {
  94.         UsernamePasswordAuthenticationToken token = (UsernamePasswordAuthenticationToken) authentication;
  95.         //获取账号密码
  96.         String username = (String) token.getPrincipal();
  97.         String password = (String) token.getCredentials();
  98.         //省略了查数据库以及对比流程
  99.  
  100.         UserDetails userDetails = new UserDetails();
  101.         userDetails.setUsername(username);
  102.         userDetails.setUserId(UUID.randomUUID().toString());
  103.         //在微服务中，角色和权限信息要保存在Redis中
  104.         SimpleGrantedAuthority simpleGrantedAuthority = new SimpleGrantedAuthority("ROLE_xx");
  105.          JwtAuthenticationToken jwtAuthenticationToken = new JwtAuthenticationToken(userDetails, Collections.singleton(simpleGrantedAuthority));
  106.         //必须设置为认证成功
  107.         jwtAuthenticationToken.setAuthenticated(true);
  108.         return jwtAuthenticationToken;
  109.     }
  110.  
  111.     @Override
  112.     public boolean supports(Class<?> authentication) {
  113.         return authentication == JwtAuthenticationToken.class || authentication == UsernamePasswordAuthenticationToken.class;
  114.     }
  115. }
  116. //然后登录成功直接写token响应到前端即可
  117. public class LoginSuccessHandler implements AuthenticationSuccessHandler {
  118.     private final ObjectMapper objectMapper;
  119.     public LoginSuccessHandler(ObjectMapper objectMapper){
  120.         this.objectMapper = objectMapper;
  121.     }
  122.  
  123.     @Override
  124.     public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
  125.         JwtAuthenticationToken jwtAuthenticationToken = (JwtAuthenticationToken) authentication;
  126.         response.setContentType("application/json;charset=utf-8");
  127.         HashMap<String, Object> map = new HashMap<>();
  128.         map.put("token", jwtAuthenticationToken.generateJWT());
  129.         String result = objectMapper.writeValueAsString(map);
  130.         response.getWriter().write(result);
  131.     }
  132. }

需要注意必须执行以下代码：

JwtAuthenticationToken jwtAuthenticationToken = new JwtAuthenticationToken(userDetails, Collections.singleton(simpleGrantedAuthority));
jwtAuthenticationToken.setAuthenticated(true);

因为除了认证接口外，其他所有需要授权（）的接口都会被AbstractSecurityInterceptor拦截，里面有一个authenticateIfRequired方法，如果没有调用

jwtAuthenticationToken.setAuthenticated(true);则会重新进行用户认证。源码如下：

  1. private Authentication authenticateIfRequired() {
  2. 		Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
  3. 		if (authentication.isAuthenticated() && !this.alwaysReauthenticate) {
  4. 			if (this.logger.isTraceEnabled()) {
  5. 				this.logger.trace(LogMessage.format("Did not re-authenticate %s before authorizing", authentication));
  6. 			}
  7. 			return authentication;
  8. 		}
  9. 		authentication = this.authenticationManager.authenticate(authentication);
  10. 		// Don't authenticated.setAuthentication(true) because each provider does that
  11. 		if (this.logger.isDebugEnabled()) {
  12. 			this.logger.debug(LogMessage.format("Re-authenticated %s before authorizing", authentication));
  13. 		}
  14. 		SecurityContextHolder.getContext().setAuthentication(authentication);
  15. 		return authentication;
  16. 	}

第二个问题则需要用到SpringSecurity中的拦截器，我们需要自定义一个JwtFilter，并且将其加入到UsernamePasswordAuthenticationFilter之后，代码如下：

  1. public final class JwtFilter  extends GenericFilterBean {
  2.     private final static String BEARER = "bearer";
  3.  
  4.     private final UserTokenManager userTokenManager = UserTokenManager.getInstance();
  5.  
  6.     @Override
  7.     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
  8.             throws IOException, ServletException {
  9.         doFilter((HttpServletRequest) request, (HttpServletResponse) response, chain);
  10.     }
  11.  
  12.     /**
  13. *以下抛出的异常你可以改为写出JSON响应
  14. **/
  15.     private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
  16.         Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
  17.         if (authentication != null) {
  18.             chain.doFilter(request, response);
  19.             return;
  20.         }
  21.         String bearer = request.getHeader(BEARER);
  22.         if (bearer == null || bearer.isEmpty()){
  23.             bearer = request.getParameter(BEARER);
  24.         }
  25.         if (bearer == null || bearer.isEmpty()){
  26.             //没有登录
  27.             throw new AuthenticationCredentialsNotFoundException("没有用户凭证");
  28.         }else{
  29.             UserDetails userDetails = userTokenManager.parseToken(bearer);
  30.             if (userDetails == null){
  31.                 throw new CredentialsExpiredException("用户凭证失效");
  32.             }
  33.             //微服务项目角色权限信息需要重Redis中获取，这里只是模拟
  34.             SimpleGrantedAuthority simpleGrantedAuthority = new SimpleGrantedAuthority("ROLE_xx");
  35.             JwtAuthenticationToken jwtAuthenticationToken = new JwtAuthenticationToken(userDetails, Collections.singleton(simpleGrantedAuthority));
  36.             jwtAuthenticationToken.setAuthenticated(true);
  37.             //注意要将解释出来的JwtAuthenticationToken信息保存到SecurityContext中
  38.             SecurityContextHolder
  39.                     .getContext()
  40.                     .setAuthentication(jwtAuthenticationToken);
  41.         }
  42.         chain.doFilter(request, response);
  43.     }
  44. }

至此单体项目整合SpringSecurit 和JWT登录已经完成，用户登录成功后，SecurityContextPersistenceFilter中的SecurityContextRepository（默认实现是HttpSessionSecurityContextRepository）会将JwtAuthenticationToken写到session中。但是因为JWT用于分布式系统或者微服务的，所以我们不能用Session来管理，只需要修改默认的HttpSessionSecurityContextRepository为NullSecurityContextRepository并关闭session管理即可。

代码如下：

  1.  @Override
  2.     protected void configure(HttpSecurity http) throws Exception {
  3.             //移除默认登录页面
  4.         http.removeConfigurer(DefaultLoginPageConfigurer.class);
  5.         //关闭csrf
  6.         http.csrf().disable()
  7. //关闭请求缓存
  8.                 .requestCache().disable()
  9. //关闭session管理
  10.                 .sessionManagement().disable()
  11. //修改SecurityContextRepository
  12. .securityContext().securityContextRepository(new NullSecurityContextRepository()).and()
  13.                 .addFilterAfter(new JwtFilter(), UsernamePasswordAuthenticationFilter.class)
  14.                 
  15.                 .authorizeRequests().anyRequest().permitAll().and()
  16.                 .formLogin()
  17.                 .loginPage("/login")
  18.                 .failureHandler(new LoginFailureHandler(objectMapper))
  19.                 .successHandler(new LoginSuccessHandler(objectMapper))
  20.                 .permitAll()
  21.                 .and()
  22.                 .httpBasic();
  23.     }

 至此，整合工作已经完毕，下面提供了代码下载地址，以上流程和WebSecurityConfigurerAdapter的实现配置用于用户微服务，然后在不同的服务下定义不同的WebSecurityConfigurerAdapter然后设置formLogin().disable()即可

示例代码下载

 

 

 

 

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/Li_阴宅/article/detail/885796
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号