devbox
weixin_40725706
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

SpringBoot3+SpringSecurity整合_springboot3整合security

作者：weixin_40725706 | 2024-05-01 15:07:37

赞

踩

springboot3整合security
Security导包：
  1. <dependency>
  2.    <groupId>org.springframework.boot</groupId>
  3.    <artifactId>spring-boot-starter-security</artifactId>
  4. </dependency>
模拟Redis存储登录信息：
  1. public class CacheEntity implements Serializable {
  2.     private Object value;
  3.     /**
  4.      * 保存的时间戳
  5.      */
  6.     private long gmtModify;
  7.     /**
  8.      * 过期时间
  9.      */
  10.     private int expire;
  11.  
  12.     public Object getValue() {
  13.         return value;
  14.     }
  15.  
  16.     public void setValue(Object value) {
  17.         this.value = value;
  18.     }
  19.  
  20.     public long getGmtModify() {
  21.         return gmtModify;
  22.     }
  23.  
  24.     public void setGmtModify(long gmtModify) {
  25.         this.gmtModify = gmtModify;
  26.     }
  27.  
  28.     public int getExpire() {
  29.         return expire;
  30.     }
  31.  
  32.     public void setExpire(int expire) {
  33.         this.expire = expire;
  34.     }
  35.  
  36.     public CacheEntity(Object value, long gmtModify, int expire) {
  37.         this.value = value;
  38.         this.gmtModify = gmtModify;
  39.         this.expire = expire;
  40.     }
  41. }
  1. @Slf4j
  2. public class LocalCache {
  3.     /**
  4.      * 默认的缓存容量
  5.      */
  6.     private static final int DEFAULT_CAPACITY = 512;
  7.     /**
  8.      * 最大容量
  9.      */
  10.     private static final int MAX_CAPACITY = 100000;
  11.     /**
  12.      * 刷新缓存的频率
  13.      */
  14.     private static final int MONITOR_DURATION = 2;
  15.  
  16.     // 启动监控线程
  17.     static {
  18.         new Thread(new TimeoutTimerThread()).start();
  19.     }
  20.  
  21.     // 内部类方式实现单例
  22.     private static class LocalCacheInstance {
  23.         private static final LocalCache INSTANCE = new LocalCache();
  24.     }
  25.  
  26.     public static LocalCache getInstance() {
  27.         return LocalCacheInstance.INSTANCE;
  28.     }
  29.  
  30.     private LocalCache() {
  31.     }
  32.  
  33.     /**
  34.      * 使用默认容量创建一个Map
  35.      */
  36.     private static Map<String, CacheEntity> cache = new ConcurrentHashMap<>(DEFAULT_CAPACITY);
  37.  
  38.     /**
  39.      * 将key-value保存到本地缓存并制定该缓存的过期时间
  40.      *
  41.      * @param key
  42.      * @param value
  43.      * @param expireTime 过期时间，如果是-1 则表示永不过期
  44.      * @param <T>
  45.      * @return
  46.      */
  47.     public <T> boolean putValue(String key, T value, int expireTime) {
  48.         return putCloneValue(key, value, expireTime);
  49.     }
  50.  
  51.     /**
  52.      * 将值通过序列化clone 处理后保存到缓存中，可以解决值引用的问题
  53.      *
  54.      * @param key
  55.      * @param value
  56.      * @param expireTime
  57.      * @param <T>
  58.      * @return
  59.      */
  60.     private <T> boolean putCloneValue(String key, T value, int expireTime) {
  61.         try {
  62.             if (cache.size() >= MAX_CAPACITY) {
  63.                 return false;
  64.             }
  65.             // 序列化赋值
  66.             CacheEntity entityClone = clone(new CacheEntity(value, System.nanoTime(), expireTime));
  67.             cache.put(key, entityClone);
  68.             return true;
  69.         } catch (Exception e) {
  70.             log.error("添加缓存失败：{}", e.getMessage());
  71.         }
  72.         return false;
  73.     }
  74.  
  75.     /**
  76.      * 序列化 克隆处理
  77.      *
  78.      * @param object
  79.      * @param <E>
  80.      * @return
  81.      */
  82.     private <E extends Serializable> E clone(E object) {
  83.         E cloneObject = null;
  84.         try {
  85.             ByteArrayOutputStream baos = new ByteArrayOutputStream();
  86.             ObjectOutputStream oos = new ObjectOutputStream(baos);
  87.             oos.writeObject(object);
  88.             oos.close();
  89.             ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray());
  90.             ObjectInputStream ois = new ObjectInputStream(bais);
  91.             cloneObject = (E) ois.readObject();
  92.             ois.close();
  93.         } catch (Exception e) {
  94.             log.error("缓存序列化失败：{}", e.getMessage());
  95.         }
  96.         return cloneObject;
  97.     }
  98.  
  99.     /**
  100.      * 从本地缓存中获取key对应的值，如果该值不存则则返回null
  101.      *
  102.      * @param key
  103.      * @return
  104.      */
  105.     public Object getValue(String key) {
  106.         if (CollectionUtils.isEmpty(cache)) {
  107.             return null;
  108.         }
  109.         CacheEntity cacheEntity = cache.get(key);
  110.         if (ObjectUtils.isEmpty(cacheEntity)) {
  111.             return null;
  112.         }
  113.         return cacheEntity.getValue();
  114.     }
  115.  
  116.     public void remove(String key) {
  117.         if (CollectionUtils.isEmpty(cache)) {
  118.             return;
  119.         }
  120.         CacheEntity cacheEntity = cache.get(key);
  121.         if (ObjectUtils.isEmpty(cacheEntity)) {
  122.             return;
  123.         }
  124.         cache.remove(key);
  125.     }
  126.  
  127.     /**
  128.      * 清空所有
  129.      */
  130.     public void clear() {
  131.         cache.clear();
  132.     }
  133.  
  134.     /**
  135.      * 过期处理线程
  136.      */
  137.     static class TimeoutTimerThread implements Runnable {
  138.         @Override
  139.         public void run() {
  140.             while (true) {
  141.                 try {
  142.                     TimeUnit.SECONDS.sleep(MONITOR_DURATION);
  143.                     checkTime();
  144.                 } catch (Exception e) {
  145.                     log.error("过期缓存清理失败：{}", e.getMessage());
  146.                 }
  147.             }
  148.         }
  149.  
  150.         /**
  151.          * 过期缓存的具体处理方法  *  * @throws Exception
  152.          */
  153.         private void checkTime() throws Exception {
  154.             // 开始处理过期
  155.             for (String key : cache.keySet()) {
  156.                 CacheEntity tce = cache.get(key);
  157.                 long timoutTime = TimeUnit.NANOSECONDS.toSeconds(System.nanoTime() - tce.getGmtModify());
  158.                 // 过期时间 : timoutTime
  159.                 if (tce.getExpire() > timoutTime) {
  160.                     continue;
  161.                 }
  162.                 log.info(" 清除过期缓存 ：" + key);
  163.                 //清除过期缓存和删除对应的缓存队列
  164.                 cache.remove(key);
  165.             }
  166.         }
  167.     }
  168. }
权限枚举：
  1. //    权限值是将二进制与十进制相互转换来判断的
  2. public enum PermissionEnum {
  3.  
  4.     GET_DEPARTMENT(1, "单位获取", "ROLE_GET_DEPARTMENT", 0x0000000000000001L),
  5.     INSERT_DEPARTMENT(2, "单位增加", "ROLE_INSERT_DEPARTMENT", 0x0000000000000002L),
  6.     UPDATE_DEPARTMENT(3, "单位修改", "ROLE_UPDATE_DEPARTMENT", 0x0000000000000004L),
  7.     DELETE_DEPARTMENT(4, "单位删除", "ROLE_DELETE_DEPARTMENT", 0x0000000000000008L),
  8.     ;
  9.  
  10.     private int id;
  11.  
  12.     private String permissions;
  13.  
  14.     private String permissionNames;
  15.  
  16.     private Long value;
  17.  
  18.     PermissionEnum(int id, String permissions, String permissionNames, Long value) {
  19.         this.id = id;
  20.         this.permissions = permissions;
  21.         this.permissionNames = permissionNames;
  22.         this.value = value;
  23.     }
  24.  
  25.     public int getId() {
  26.         return id;
  27.     }
  28.  
  29.     public void setId(int id) {
  30.         this.id = id;
  31.     }
  32.  
  33.     public String getPermissions() {
  34.         return permissions;
  35.     }
  36.  
  37.     public void setPermissions(String permissions) {
  38.         this.permissions = permissions;
  39.     }
  40.  
  41.     public String getPermissionNames() {
  42.         return permissionNames;
  43.     }
  44.  
  45.     public void setPermissionNames(String permissionNames) {
  46.         this.permissionNames = permissionNames;
  47.     }
  48.  
  49.     public Long getValue() {
  50.         return value;
  51.     }
  52.  
  53.     public void setValue(Long value) {
  54.         this.value = value;
  55.     }
  56.  
  57.     public static List<GrantedAuthority> fromCode(Long code) {
  58.         List<GrantedAuthority> list = new ArrayList<>();
  59.         PermissionEnum[] codes = PermissionEnum.values();
  60.         for (PermissionEnum state : codes) {
  61.             if ((state.getValue() & code) > 0) {
  62.                 list.add(new SimpleGrantedAuthority(state.getPermissionNames()));
  63.             }
  64.         }
  65.         return list;
  66.     }
  67.  
  68.     public static List<PermissionEnum> getAuthList(Long code) {
  69.         List<PermissionEnum> list = new ArrayList<>();
  70.         PermissionEnum[] codes = PermissionEnum.values();
  71.         for (PermissionEnum state : codes) {
  72.             if ((state.getValue() & code) > 0) {
  73.                 list.add(state);
  74.             }
  75.         }
  76.         return list;
  77.     }
  78.  
  79.     //  获取权限值
  80.     public static Long getPermissionCode(Integer[] auths) {
  81.         Long code = 0x0000000000000000L;
  82.         PermissionEnum[] codes = PermissionEnum.values();
  83.         for (Integer auth : auths) {
  84.             for (PermissionEnum permissionCode : codes) {
  85.                 if (auth.equals(permissionCode.getId())) {
  86.                     code += permissionCode.getValue();
  87.                     break;
  88.                 }
  89.             }
  90.         }
  91.         return code;
  92.     }
  93.  
  94.     //    获取权限数组
  95.     public static String[] getAuths(Long code) {
  96.         List<String> lists = new ArrayList<>();
  97.         PermissionEnum[] codes = PermissionEnum.values();
  98.         for (PermissionEnum state : codes) {
  99.             if ((state.getValue() & code) > 0) {
  100.                 lists.add(state.getPermissions());
  101.             }
  102.         }
  103.         return lists.toArray(new String[lists.size()]);
  104.     }
  105.  
  106.     //    获取权限值
  107.     public static Long getPermissionCode(String[] auths) {
  108.         Long code = 0x0000000000000000L;
  109.         PermissionEnum[] codes = PermissionEnum.values();
  110.         for (String auth : auths) {
  111.             for (PermissionEnum permissionCode : codes) {
  112.                 if (auth.equals(permissionCode.getPermissions())) {
  113.                     code += permissionCode.getValue();
  114.                     break;
  115.                 }
  116.             }
  117.         }
  118.         return code;
  119.     }
  120. }
User实体类：
  1. @Data
  2. @Accessors(chain = true)
  3. public class Users implements Serializable {
  4.     private Long userID;
  5.     private String userName;
  6.     private String userPassword;
  7.     private String userPhone;
  8.     private String userAddress;
  9.     private Integer userAllowErrCount;
  10.     private Integer userErrCount;
  11.     private Date userLastErrTime;
  12.     private Long userRoleID;
  13.     private Roles roles;
  14.     private Long userDepID;
  15.     private Department department;
  16.     private boolean userEnable;
  17. }
权限反序列化：
  1. public class CustomAuthorityDeserializer extends JsonDeserializer {
  2.     @Override
  3.     public Object deserialize(
  4.             JsonParser p, DeserializationContext deserializationContext
  5.     ) throws IOException, JacksonException {
  6.         ObjectMapper mapper = (ObjectMapper) p.getCodec();
  7.         JsonNode jsonNode = mapper.readTree(p);
  8.         LinkedList<GrantedAuthority> grantedAuthorities = new LinkedList<>();
  9.         Iterator<JsonNode> elements = jsonNode.elements();
  10.         while (elements.hasNext()) {
  11.             JsonNode next = elements.next();
  12.             JsonNode authority = next.get("authority");
  13.             //将得到的值放入链表 最终返回该链表
  14.             grantedAuthorities.add(new SimpleGrantedAuthority(authority.asText()));
  15.         }
  16.         return grantedAuthorities;
  17.     }
  18. }

用户详情类：

  1. @JsonIgnoreProperties({"enabled", "accountNonExpired", "accountNonLocked", "credentialsNonExpired",
  2.         "username", "password"})
  3. public class MyUserDetail extends Users implements UserDetails, Serializable {
  4.     List<? extends GrantedAuthority> authorities;
  5.  
  6.     public MyUserDetail() {
  7.     }
  8.  
  9.     public MyUserDetail(Users users, List<? extends GrantedAuthority> authList) {
  10.         this.setUserID(users.getUserID());
  11.         this.setUserName(users.getUserName());
  12.         this.setUserPassword(users.getUserPassword());
  13.         this.setUserDepID(users.getUserDepID());
  14.         this.setUserRoleID(users.getUserRoleID());
  15.         this.authorities = authList;
  16.     }
  17.  
  18.     @Override
  19.     @JsonDeserialize(using = CustomAuthorityDeserializer.class)
  20.     public Collection<? extends GrantedAuthority> getAuthorities() {
  21.         return this.authorities;
  22.     }
  23.  
  24.     @Override
  25.     public String getPassword() {
  26.         return this.getUserPassword();
  27.     }
  28.  
  29.     @Override
  30.     public String getUsername() {
  31.         return this.getUserName();
  32.     }
  33.  
  34.     @Override
  35.     public boolean isAccountNonExpired() {
  36.         return true;
  37.     }
  38.  
  39.     @Override
  40.     public boolean isAccountNonLocked() {
  41.         return true;
  42.     }
  43.  
  44.     @Override
  45.     public boolean isCredentialsNonExpired() {
  46.         return true;
  47.     }
  48.  
  49.     @Override
  50.     public boolean isEnabled() {
  51.         return true;
  52.     }
  53. }
用户详情实现类：
  1. @Component
  2. public class MyUserDetailServiceImpl implements UserDetailsService {
  3.  
  4.     //    操作数据库，根据用户名称查询用户信息
  5.     private final UserMapper userMapper;
  6.  
  7.     public MyUserDetailServiceImpl(UserMapper userMapper) {
  8.         this.userMapper = userMapper;
  9.     }
  10.  
  11.     @Override
  12.     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
  13.         Users users = userMapper.getUserByName(username);
  14.         Optional.ofNullable(users).orElseThrow(() -> {
  15.             //    自定义的异常返回类和枚举
  16.             throw new CommonException(YIXGResultEnum.USER_NOT_EXIST.getCode(),
  17.                     YIXGResultEnum.USER_NOT_EXIST.getMessage());
  18.         });
  19.         if (ObjectUtils.isEmpty(users.getUserRoleID())) {
  20.             throw new CommonException(YIXGResultEnum.USER_ROLE_NOT_EXIST.getCode(),
  21.                     YIXGResultEnum.USER_ROLE_NOT_EXIST.getMessage());
  22.         }
  23.         List<GrantedAuthority> authorityList = PermissionEnum.fromCode(users.getRoles().getRolePermission());
  24.         return new MyUserDetail(users, authorityList);
  25.     }
  26. }
拦截未登录请求：
  1. /**
  2.  * 用户发起未登录的请求会被AuthorizationFilter拦截，并抛出AccessDeniedException异常。异常被AuthenticationEntryPoint
  3.  * 处理，默认会触发重定向到登录页。Spring Security开放了配置，允许我们自定义AuthenticationEntryPoint。
  4.  * 那么我们就通过自定义AuthenticationEntryPoint来取消重定向行为，将接口改为返回JSON信息。
  5.  */
  6. public class MyAuthenticationEntryPoint implements AuthenticationEntryPoint {
  7.     @Override
  8.     public void commence(
  9.             HttpServletRequest request, HttpServletResponse response, AuthenticationException authException
  10.     ) throws IOException, ServletException {
  11.         CommonResult commonResult = new CommonResult();
  12.         ObjectMapper objectMapper = new ObjectMapper();
  13.         commonResult.setCode(YIXGResultEnum.LOGIN_INVALID.getCode())
  14.                     .setMessage(YIXGResultEnum.LOGIN_INVALID.getMessage());
  15.         response.setContentType("application/json;charset=UTF-8");
  16.         response.getWriter().write(objectMapper.writeValueAsString(commonResult));
  17.         response.getWriter().flush();
  18.         response.getWriter().close();
  19.     }
  20. }
拦截没权限的请求：
  1. public class MyAccessDeniedHandler implements AccessDeniedHandler {
  2.     @Override
  3.     public void handle(
  4.             HttpServletRequest request, HttpServletResponse response,
  5.             AccessDeniedException accessDeniedException
  6.     ) throws IOException, ServletException {
  7.         ObjectMapper objectMapper = new ObjectMapper();
  8.         CommonResult commonResult = new CommonResult();
  9.         commonResult.setCode(YIXGResultEnum.NO_PERMISSION.getCode())
  10.                     .setMessage(YIXGResultEnum.NO_PERMISSION.getMessage());
  11.         response.setContentType("application/json;charset=UTF-8");
  12.         response.getWriter().write(objectMapper.writeValueAsString(commonResult));
  13.         response.getWriter().flush();
  14.         response.getWriter().close();
  15.     }
  16. }
自定义拦截器，验证token信息：
  1. public class MyAuthenticationTokenFilter extends OncePerRequestFilter {
  2.     @Override
  3.     protected void doFilterInternal(
  4.             HttpServletRequest request, HttpServletResponse response, FilterChain filterChain
  5.     ) throws ServletException, IOException {
  6.         //  从header中获取验证信息
  7.         String authHeader = request.getHeader(GlobalUtil.AUTHORIZATION);
  8.         if (ObjectUtils.isEmpty(authHeader)) {
  9.             filterChain.doFilter(request, response);
  10.             return;
  11.         }
  12.         this.doParse(request, response, filterChain, authHeader);
  13.     }
  14.  
  15.     private void doParse(
  16.             HttpServletRequest request, HttpServletResponse response, FilterChain chain, String authHeader
  17.     ) throws ServletException, IOException {
  18.         ObjectMapper objectMapper = new ObjectMapper();
  19.         //  如果认证码  以规定值开头
  20.         if (authHeader.startsWith(GlobalUtil.GRANT_TYPE)) {
  21.             // 提取token值
  22.             String token = authHeader.substring(GlobalUtil.GRANT_TYPE.length());
  23.             if (ObjectUtils.isEmpty(token)) {
  24.                 chain.doFilter(request, response);
  25.                 return;
  26.             }
  27.             //  通过token值从缓存中取用户信息
  28.             String userJson = (String) LocalCache.getInstance().getValue(token);
  29.             //  转换JSON对象
  30.  
  31.             //JSONObject userJsonObject = JSON.parseObject(userJson);
  32.             //  判断是否空值
  33.             if (ObjectUtils.isEmpty(userJson)) {
  34. //                throw new CommonException(YIXGResultEnum.INVALID_TOKEN.getCode(),
  35. //                        YIXGResultEnum.INVALID_TOKEN.getMsg());
  36.                 chain.doFilter(request, response);
  37.                 return;
  38.             }
  39.             //  转换MyUserDetail对象
  40.             MyUserDetail user = objectMapper.readValue(userJson, MyUserDetail.class);
  41.             //MyUserDetail user = JSON.toJavaObject(userJsonObject, MyUserDetail.class);
  42. //                MyUserDetail user = JSONObject.toJavaObject(userJsonObject, MyUserDetail.class);
  43.             //  转换 UP 对象放到上下文中
  44.             UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken =
  45.                     new UsernamePasswordAuthenticationToken(
  46.                             user, user.getPassword(), user.getAuthorities());
  47.             SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
  48.         }
  49.         chain.doFilter(request, response);
  50.     }
  51. }
密码加密：
  1. public class MyPasswordEncoder implements PasswordEncoder {
  2.     @Override
  3.     public String encode(CharSequence rawPassword) {
  4.         return MD5Util.md5((String) rawPassword);
  5.     }
  6.  
  7.     @Override
  8.     public boolean matches(CharSequence rawPassword, String encodedPassword) {
  9.         return encodedPassword.equalsIgnoreCase(MD5Util.md5((String) rawPassword));
  10.     }
  11. }
登录成功：
  1. @Component
  2. public class MyAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
  3.     private final ObjectMapper objectMapper;
  4.  
  5.     private final LogService logService;
  6.  
  7.     private final UserService userService;
  8.  
  9.     public MyAuthenticationSuccessHandler(
  10.             ObjectMapper objectMapper, LogService logService,
  11.             UserService userService
  12.     ) {
  13.         this.objectMapper = objectMapper;
  14.         this.logService = logService;
  15.         this.userService = userService;
  16.     }
  17.  
  18.     @Override
  19.     public void onAuthenticationSuccess(
  20.             HttpServletRequest request, HttpServletResponse response, FilterChain chain,
  21.             Authentication authentication
  22.     ) throws IOException, ServletException {
  23.         AuthenticationSuccessHandler.super.onAuthenticationSuccess(request, response, chain, authentication);
  24.     }
  25.  
  26.     @Override
  27.     public void onAuthenticationSuccess(
  28.             HttpServletRequest request, HttpServletResponse response, Authentication authentication
  29.     ) throws IOException, ServletException {
  30.         MyUserDetail user = (MyUserDetail) authentication.getPrincipal();
  31.         //  获取随机token 并存到Redis中
  32.         String token = UUID.randomUUID().toString().replaceAll("-", "");
  33.         LocalCache.getInstance().putValue(token, objectMapper.writeValueAsString(user), 60 * 60);
  34.         UserVO userVO = new UserVO();
  35.         userVO.setUserName(user.getUserName())
  36.               .setUserErrCount("0")
  37.               .setUserLastErrTime(null);
  38.         userService.updateUserErrCount(userVO);
  39.  
  40.         LogVO logVO = new LogVO();
  41.         logVO.setLogOperateUser(user.getUserName())
  42.              .setLogContent("登录成功")
  43.              .setLogType("登录日志");
  44.         logService.addLog(logVO);
  45.  
  46.         CommonResult commonResult = new CommonResult();
  47.         commonResult.setCode(YIXGResultEnum.OPERATE_SUCCESS.getCode())
  48.                     .setMessage(YIXGResultEnum.OPERATE_SUCCESS.getMessage())
  49.                     .setToken(token)
  50.                     .setCurrentUser(user.getUserName())
  51.                     .setCurrentUserId(user.getUserID());
  52.  
  53.         response.setContentType("application/json;charset=UTF-8");
  54.         response.getWriter().write(objectMapper.writeValueAsString(commonResult));
  55.         response.getWriter().flush();
  56.         response.getWriter().close();
  57.     }
  58. }
登录失败：
  1. @Component
  2. @Slf4j
  3. public class MyAuthenticationFailureHandler implements AuthenticationFailureHandler {
  4.     private final ObjectMapper objectMapper;
  5.  
  6.     private final UserService userService;
  7.  
  8.     public MyAuthenticationFailureHandler(ObjectMapper objectMapper, UserService userService) {
  9.         this.objectMapper = objectMapper;
  10.         this.userService = userService;
  11.     }
  12.  
  13.     @Override
  14.     public void onAuthenticationFailure(
  15.             HttpServletRequest request, HttpServletResponse response, AuthenticationException exception
  16.     ) throws IOException, ServletException {
  17.         SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
  18.         CommonResult result = userService.getUserByUserName(
  19.                 new UserVO().setUserName(request.getParameter("username")));
  20.         Users users = (Users) result.getObjectData();
  21.  
  22.         if (Objects.equals(result.getCode(), YIXGResultEnum.OPERATE_SUCCESS.getCode())) {
  23.             UserVO userVO = new UserVO();
  24.             userVO.setUserName(users.getUserName())
  25.                   .setUserErrCount(String.valueOf((users.getUserErrCount() + 1)))
  26.                   .setUserLastErrTime(sdf.format(new Date()));
  27.             userService.updateUserErrCount(userVO);
  28.         }
  29.         
  30.         CommonResult commonResult = new CommonResult();
  31.         commonResult.setCode(YIXGResultEnum.PASSWORD_OR_USERNAME_ERROR.getCode())
  32.                     .setMessage(YIXGResultEnum.PASSWORD_OR_USERNAME_ERROR.getMessage());
  33.         response.setContentType("application/json");
  34.         response.setCharacterEncoding("UTF-8");
  35.         response.getWriter().write(objectMapper.writeValueAsString(commonResult));
  36.         response.getWriter().flush();
  37.         response.getWriter().close();
  38.     }
  39. }
登出成功：
  1. @Component
  2. public class MyLogoutSuccessHandler implements LogoutSuccessHandler {
  3.     private final ObjectMapper objectMapper;
  4.  
  5.     private final LogService logService;
  6.  
  7.     public MyLogoutSuccessHandler(ObjectMapper objectMapper, LogService logService) {
  8.         this.objectMapper = objectMapper;
  9.         this.logService = logService;
  10.     }
  11.  
  12.     @Override
  13.     public void onLogoutSuccess(
  14.             HttpServletRequest request, HttpServletResponse response, Authentication authentication
  15.     ) throws IOException, ServletException {
  16.         String authHeader = request.getHeader(GlobalUtil.AUTHORIZATION);
  17.         String authToken = authHeader.substring(GlobalUtil.GRANT_TYPE.length());
  18.  
  19.         String userJson = (String) LocalCache.getInstance().getValue(authToken);
  20.         if (ObjectUtils.isEmpty(userJson)) {
  21.             CommonResult commonResult = new CommonResult();
  22.             commonResult.setCode(YIXGResultEnum.OPERATE_FAILURE.getCode())
  23.                         .setMessage(YIXGResultEnum.OPERATE_FAILURE.getMessage());
  24.             response.setContentType("application/json;charset=UTF-8");
  25.             response.getWriter().write(objectMapper.writeValueAsString(commonResult));
  26.             response.getWriter().flush();
  27.             response.getWriter().close();
  28.             return;
  29.         }
  30.         
  31.         MyUserDetail user = objectMapper.readValue(userJson, MyUserDetail.class);
  32.  
  33.         LocalCache.getInstance().putValue(authToken, "", 1);
  34.  
  35.         LogVO logVO = new LogVO();
  36.         logVO.setLogOperateUser(user.getUserName())
  37.              .setLogContent("登出成功")
  38.              .setLogType("登录日志");
  39.         logService.addLog(logVO);
  40.  
  41.         CommonResult commonResult = new CommonResult();
  42.         commonResult.setCode(YIXGResultEnum.OPERATE_SUCCESS.getCode())
  43.                     .setMessage(YIXGResultEnum.OPERATE_SUCCESS.getMessage());
  44.         response.setContentType("application/json;charset=UTF-8");
  45.         response.getWriter().write(objectMapper.writeValueAsString(commonResult));
  46.         response.getWriter().flush();
  47.         response.getWriter().close();
  48.     }
  49. }
Security核心配置：
  1. @Configuration
  2. @EnableWebSecurity
  3. public class SecurityConfig {
  4.  
  5.     private final MyAuthenticationSuccessHandler myAuthenticationSuccessHandler;
  6.  
  7.     private final MyAuthenticationFailureHandler myAuthenticationFailureHandler;
  8.  
  9.     private final MyLogoutSuccessHandler myLogoutSuccessHandler;
  10.  
  11.     private final UserDetailsService userDetailsService;
  12.  
  13.     public SecurityConfig(
  14.             MyAuthenticationSuccessHandler myAuthenticationSuccessHandler,
  15.             MyAuthenticationFailureHandler myAuthenticationFailureHandler,
  16.             MyLogoutSuccessHandler myLogoutSuccessHandler, UserDetailsService userDetailsService
  17.     ) {
  18.         this.myAuthenticationSuccessHandler = myAuthenticationSuccessHandler;
  19.         this.myAuthenticationFailureHandler = myAuthenticationFailureHandler;
  20.         this.myLogoutSuccessHandler = myLogoutSuccessHandler;
  21.         this.userDetailsService = userDetailsService;
  22.     }
  23.  
  24.     @Bean
  25.     public AuthenticationManager authenticationManager(
  26.             AuthenticationConfiguration authenticationConfiguration
  27.     ) throws Exception {
  28.         return authenticationConfiguration.getAuthenticationManager();
  29.     }
  30.  
  31.     @Bean
  32.     public PasswordEncoder passwordEncoder() {
  33.         return new MyPasswordEncoder();
  34.     }
  35.  
  36.     @Bean
  37.     public MyAuthenticationTokenFilter myAuthenticationTokenFilter() {
  38.         return new MyAuthenticationTokenFilter();
  39.     }
  40.  
  41.     @Bean
  42.     SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception {
  43.         return httpSecurity
  44.                 //  禁用basic明文验证
  45.                 .httpBasic(Customizer.withDefaults())
  46.                 //  基于 token ，不需要 csrf
  47.                 .csrf(AbstractHttpConfigurer::disable)
  48.                 //  禁用默认登录页
  49.                 .formLogin(fl -> fl.loginProcessingUrl("/login")
  50.                                    .usernameParameter("username")
  51.                                    .passwordParameter("password")
  52.                                    .successHandler(myAuthenticationSuccessHandler)
  53.                                    .failureHandler(myAuthenticationFailureHandler)
  54.                                    .permitAll())
  55.                 //  禁用默认登出页
  56.                 .logout(lt -> lt.logoutSuccessHandler(myLogoutSuccessHandler))
  57.                 //  基于 token ， 不需要 session
  58.                 .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
  59.                 //  设置 处理鉴权失败、认证失败
  60.                 .exceptionHandling(
  61.                         exceptions -> exceptions.authenticationEntryPoint(new MyAuthenticationEntryPoint())
  62.                                                 .accessDeniedHandler(new MyAccessDeniedHandler())
  63.                 )
  64.                 //  下面开始设置权限
  65.                 .authorizeHttpRequests(authorizeHttpRequest -> authorizeHttpRequest
  66.                         //  允许所有 OPTIONS 请求
  67.                         .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
  68.                         //  允许直接访问 授权登录接口
  69.                         .requestMatchers(HttpMethod.POST, "/web/authenticate").permitAll()
  70.                         //  允许 SpringMVC 的默认错误地址匿名访问
  71.                         .requestMatchers("/error").permitAll()
  72.                         //  其他所有接口必须有Authority信息，Authority在登录成功后的UserDetailImpl对象中默认设置“ROLE_USER”
  73.                         //.requestMatchers("/**").hasAnyAuthority("ROLE_USER")
  74.                         .requestMatchers("/heartBeat/**", "/main/**").permitAll()
  75.                         //  允许任意请求被已登录用户访问，不检查Authority
  76.                         .anyRequest().authenticated()
  77.                 )
  78.                 //  添加过滤器
  79.                 .addFilterBefore(myAuthenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class)
  80.                 .build();
  81.     }
  82.  
  83.     @Bean
  84.     public UserDetailsService userDetailsService() {
  85.         return userDetailsService::loadUserByUsername;
  86.     }
  87.  
  88.     /**
  89.      * 调用loadUserByUserName获取userDetail信息，在AbstractUserDetailsAuthenticationProvider里执行用户状态检查
  90.      *
  91.      * @return
  92.      */
  93.     @Bean
  94.     public AuthenticationProvider authenticationProvider() {
  95.         DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
  96.         authProvider.setUserDetailsService(userDetailsService);
  97.         authProvider.setPasswordEncoder(passwordEncoder());
  98.         return authProvider;
  99.     }
  100.  
  101. //    @Bean
  102. //    public WebSecurityCustomizer webSecurityCustomizer() {
  103. //        return (web) -> web.ignoring().requestMatchers();
  104. //    }
  105.  
  106.     /**
  107.      * 配置跨源访问(CORS)
  108.      *
  109.      * @return
  110.      */
  111.     @Bean
  112.     CorsConfigurationSource corsConfigurationSource() {
  113.         UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
  114.         source.registerCorsConfiguration("/**", new CorsConfiguration().applyPermitDefaultValues());
  115.         return source;
  116.     }
  117.  
  118. }

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/weixin_40725706/article/detail/519370
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号