devbox
知新_RL
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

SpringSecurity安全框架_spring安全框架

作者：知新_RL | 2024-03-03 18:00:08

赞

踩

spring安全框架

目录

一、Spring Security介绍

1、框架介绍

2、认证与授权实现思路

二、整合Spring Security

1、在common下创建spring_security模块

2、在spring_security引入相关依赖

3.代码结构说明：

4、创建spring security核心配置类

5、创建认证授权相关的工具类

（1）DefaultPasswordEncoder：密码处理的方法

（2）TokenManager：token操作的工具类

（3）TokenLogoutHandler：退出实现

（4）UnauthorizedEntryPoint：未授权统一处理

6、创建认证授权实体类

7、创建认证和授权的filter

（1）TokenLoginFilter：认证的filter

一、Spring Security介绍

1、框架介绍

Spring 是一个非常流行和成功的 Java 应用开发框架。Spring Security 基于 Spring 框架，提供了一套 Web 应用安全性的完整解决方案。一般来说，Web 应用的安全性包括用户认证（Authentication）和用户授权（Authorization）两个部分。

（1）用户认证指的是：验证某个用户是否为系统中的合法主体，也就是说用户能否访问该系统。用户认证一般要求用户提供用户名和密码。系统通过校验用户名和密码来完成认证过程。

（2）用户授权指的是验证某个用户是否有权限执行某个操作。在一个系统中，不同用户所具有的权限是不同的。比如对一个文件来说，有的用户只能进行读取，而有的用户可以进行修改。一般来说，系统会为不同的用户分配不同的角色，而每个角色则对应一系列的权限。

Spring Security其实就是用filter，多请求的路径进行过滤。

（1）如果是基于Session，那么Spring-security会对cookie里的sessionid进行解析，找到服务器存储的sesion信息，然后判断当前用户是否符合请求的要求。

（2）如果是token，则是解析出token，然后将当前请求加入到Spring-security管理的权限信息中去

2、认证与授权实现思路

如果系统的模块众多，每个模块都需要就行授权与认证，所以我们选择基于token的形式进行授权与认证，用户根据用户名密码认证成功，然后获取当前用户角色的一系列权限值，并以用户名为key，权限列表为value的形式存入redis缓存中，根据用户名相关信息生成token返回，浏览器将token记录到cookie中，每次调用api接口都默认将token携带到header请求头中，Spring-security解析header头获取token信息，解析token获取当前用户名，根据用户名就可以从redis中获取权限列表，这样Spring-security就能够判断当前请求是否有权限访问

二、整合Spring Security

1、在common下创建spring_security模块

2、在spring_security引入相关依赖

<properties>
        <maven.compiler.source>8</maven.compiler.source>
        <maven.compiler.target>8</maven.compiler.target>
    </properties>
    <dependencies>
    <dependency>
        <groupId>com.xingchen</groupId>
        <artifactId>commentUtils</artifactId>
        <version>0.0.1-SNAPSHOT</version>
    </dependency>
    <!-- Spring Security依赖 -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>

    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt</artifactId>
    </dependency>
</dependencies>

3.代码结构说明：

4、创建spring security核心配置类

Spring Security的核心配置就是继承WebSecurityConfigurerAdapter并注解@EnableWebSecurity的配置。

这个配置指明了用户名密码的处理方式、请求路径的开合、登录登出控制等和安全相关的配置

  1. package com.xingchen.sercurity.config;
  2.  
  3.  
  4. import com.xingchen.sercurity.filter.TokenAuthenticationFilter;
  5. import com.xingchen.sercurity.filter.TokenLoginFilter;
  6. import com.xingchen.sercurity.security.DefaultPasswordEncoder;
  7. import com.xingchen.sercurity.security.TokenLogoutHandler;
  8. import com.xingchen.sercurity.security.TokenManager;
  9. import com.xingchen.sercurity.security.UnauthorizedEntryPoint;
  10. import org.springframework.beans.factory.annotation.Autowired;
  11. import org.springframework.context.annotation.Configuration;
  12. import org.springframework.data.redis.core.RedisTemplate;
  13. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  14. import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
  15. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  16. import org.springframework.security.config.annotation.web.builders.WebSecurity;
  17. import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  18. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  19. import org.springframework.security.core.userdetails.UserDetailsService;
  20.  
  21.  
  22. /**
  23.  * @author xing'chen
  24.  */
  25. @Configuration
  26. @EnableWebSecurity
  27. @EnableGlobalMethodSecurity(prePostEnabled = true)
  28. public class TokenWebSecurityConfig extends WebSecurityConfigurerAdapter {
  29.  
  30.     private UserDetailsService userDetailsService;
  31.     private TokenManager tokenManager;
  32.     private DefaultPasswordEncoder defaultPasswordEncoder;
  33.     private RedisTemplate redisTemplate;
  34.  
  35.     @Autowired
  36.     public TokenWebSecurityConfig(UserDetailsService userDetailsService, DefaultPasswordEncoder defaultPasswordEncoder,
  37.                                   TokenManager tokenManager, RedisTemplate redisTemplate) {
  38.         this.userDetailsService = userDetailsService;
  39.         this.defaultPasswordEncoder = defaultPasswordEncoder;
  40.         this.tokenManager = tokenManager;
  41.         this.redisTemplate = redisTemplate;
  42.     }
  43.  
  44.     /**
  45.      * 配置设置
  46.      * @param http
  47.      * @throws Exception
  48.      */
  49.     @Override
  50.     protected void configure(HttpSecurity http) throws Exception {
  51.         http.exceptionHandling()
  52.                 .authenticationEntryPoint(new UnauthorizedEntryPoint())
  53.                 .and().csrf().disable()
  54.                 .authorizeRequests()
  55.                 .anyRequest().authenticated()
  56.                 .and().logout().logoutUrl("/admin/acl/index/logout")
  57.                 .addLogoutHandler(new TokenLogoutHandler(tokenManager,redisTemplate)).and()
  58.                 .addFilter(new TokenLoginFilter(authenticationManager(), tokenManager, redisTemplate))
  59.                 .addFilter(new TokenAuthenticationFilter(authenticationManager(), tokenManager, redisTemplate)).httpBasic();
  60.     }
  61.  
  62.     /**
  63.      * 密码处理
  64.      * @param auth
  65.      * @throws Exception
  66.      */
  67.     @Override
  68.     public void configure(AuthenticationManagerBuilder auth) throws Exception {
  69.         auth.userDetailsService(userDetailsService).passwordEncoder(defaultPasswordEncoder);
  70.     }
  71.  
  72.     /**
  73.      * 配置哪些请求不拦截
  74.      * @param web
  75.      * @throws Exception
  76.      */
  77.     @Override
  78.     public void configure(WebSecurity web) throws Exception {
  79. //        web.ignoring().antMatchers("/api/**",
  80. //                "/swagger-resources/**", "/webjars/**", "/v2/**", "/swagger-ui.html/**"
  81. //               );
  82.         web.ignoring().antMatchers("/*/**"
  83.         );
  84.     }
  85. }

5、创建认证授权相关的工具类

（1）DefaultPasswordEncoder：密码处理的方法

  1. package com.xingchen.sercurity.security;
  2.  
  3.  
  4. import com.xingchen.utils.MD5;
  5. import org.springframework.security.crypto.password.PasswordEncoder;
  6. import org.springframework.stereotype.Component;
  7.  
  8.  
  9. /**
  10.  * @author xing'chen
  11.  * 
  12.  *  * t密码的处理方法类型
  13.  */
  14. @Component
  15. public class DefaultPasswordEncoder implements PasswordEncoder {
  16.  
  17.     public DefaultPasswordEncoder() {
  18.         this(-1);
  19.     }
  20.  
  21.     /**
  22.      * @param strength
  23.      *            the log rounds to use, between 4 and 31
  24.      */
  25.     public DefaultPasswordEncoder(int strength) {
  26.  
  27.     }
  28.  
  29.     @Override
  30.     public String encode(CharSequence rawPassword) {
  31.         return MD5.encrypt(rawPassword.toString());
  32.     }
  33.  
  34.     @Override
  35.     public boolean matches(CharSequence rawPassword, String encodedPassword) {
  36.         return encodedPassword.equals(MD5.encrypt(rawPassword.toString()));
  37.     }
  38. }

（2）TokenManager：token操作的工具类

  1. package com.xingchen.sercurity.security;
  2.  
  3. import io.jsonwebtoken.CompressionCodecs;
  4. import io.jsonwebtoken.Jwts;
  5. import io.jsonwebtoken.SignatureAlgorithm;
  6. import org.springframework.stereotype.Component;
  7.  
  8. import java.util.Date;
  9.  
  10. /**
  11.  * @author xing'chen
  12.  *  * token管理
  13.  */
  14. @Component
  15. public class TokenManager {
  16.  
  17.     private long tokenExpiration = 24*60*60*1000;
  18.     private String tokenSignKey = "123456";
  19.  
  20.     public String createToken(String username) {
  21.         String token = Jwts.builder().setSubject(username)
  22.                 .setExpiration(new Date(System.currentTimeMillis() + tokenExpiration))
  23.                 .signWith(SignatureAlgorithm.HS512, tokenSignKey).compressWith(CompressionCodecs.GZIP).compact();
  24.         return token;
  25.     }
  26.  
  27.     public String getUserFromToken(String token) {
  28.         String user = Jwts.parser().setSigningKey(tokenSignKey).parseClaimsJws(token).getBody().getSubject();
  29.         return user;
  30.     }
  31.  
  32.     public void removeToken(String token) {
  33.         //jwttoken无需删除，客户端扔掉即可。
  34.     }
  35.  
  36. }

（3）TokenLogoutHandler：退出实现

  1. package com.xingchen.sercurity.security;
  2.  
  3.  
  4. import com.xingchen.utils.*;
  5. import org.springframework.data.redis.core.RedisTemplate;
  6. import org.springframework.security.core.Authentication;
  7. import org.springframework.security.web.authentication.logout.LogoutHandler;
  8.  
  9. import javax.servlet.http.HttpServletRequest;
  10. import javax.servlet.http.HttpServletResponse;
  11.  
  12.  
  13. /**
  14.  * @author xing'chen
  15.  *  * 登出业务逻辑类
  16.  */
  17. public class TokenLogoutHandler implements LogoutHandler {
  18.  
  19.     private TokenManager tokenManager;
  20.     private RedisTemplate redisTemplate;
  21.  
  22.     public TokenLogoutHandler(TokenManager tokenManager, RedisTemplate redisTemplate) {
  23.         this.tokenManager = tokenManager;
  24.         this.redisTemplate = redisTemplate;
  25.     }
  26.  
  27.     @Override
  28.     public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {
  29.         String token = request.getHeader("token");
  30.         if (token != null) {
  31.             tokenManager.removeToken(token);
  32.  
  33.             //清空当前用户缓存中的权限数据
  34.             String userName = tokenManager.getUserFromToken(token);
  35.             redisTemplate.delete(userName);
  36.         }
  37.         ResponseUtil.out(response, R.ok());
  38.     }
  39.  
  40. }

（4）UnauthorizedEntryPoint：未授权统一处理

  1. package com.xingchen.sercurity.security;
  2.  
  3.  
  4. import com.xingchen.utils.R;
  5. import com.xingchen.utils.ResponseUtil;
  6. import org.springframework.security.core.AuthenticationException;
  7. import org.springframework.security.web.AuthenticationEntryPoint;
  8.  
  9. import javax.servlet.ServletException;
  10. import javax.servlet.http.HttpServletRequest;
  11. import javax.servlet.http.HttpServletResponse;
  12. import java.io.IOException;
  13.  
  14.  
  15. /**
  16.  * @author xing'chen
  17.  *
  18.  *  * 未授权的统一处理方式
  19.  */
  20. public class UnauthorizedEntryPoint implements AuthenticationEntryPoint {
  21.  
  22.     @Override
  23.     public void commence(HttpServletRequest request, HttpServletResponse response,
  24.                          AuthenticationException authException) throws IOException, ServletException {
  25.  
  26.         ResponseUtil.out(response, R.error());
  27.     }
  28. }

6、创建认证授权实体类

（1）SecutityUser

  1. package com.xingchen.sercurity.entity;
  2.  
  3. import lombok.Data;
  4. import lombok.extern.slf4j.Slf4j;
  5. import org.springframework.security.core.GrantedAuthority;
  6. import org.springframework.security.core.authority.SimpleGrantedAuthority;
  7. import org.springframework.security.core.userdetails.UserDetails;
  8. import org.springframework.util.StringUtils;
  9.  
  10. import java.util.ArrayList;
  11. import java.util.Collection;
  12. import java.util.List;
  13.  
  14. /**
  15.  * @author xingchen
  16.  *  * 安全认证用户详情信息
  17.  */
  18. @Data
  19. @Slf4j
  20. public class SecurityUser implements UserDetails {
  21.  
  22.     //当前登录用户
  23.     private transient User currentUserInfo;
  24.  
  25.     //当前权限
  26.     private List<String> permissionValueList;
  27.  
  28.     public SecurityUser() {
  29.     }
  30.  
  31.     public SecurityUser(User user) {
  32.         if (user != null) {
  33.             this.currentUserInfo = user;
  34.         }
  35.     }
  36.  
  37.     @Override
  38.     public Collection<? extends GrantedAuthority> getAuthorities() {
  39.         Collection<GrantedAuthority> authorities = new ArrayList<>();
  40.         for(String permissionValue : permissionValueList) {
  41.             if(StringUtils.isEmpty(permissionValue)) continue;
  42.             SimpleGrantedAuthority authority = new SimpleGrantedAuthority(permissionValue);
  43.             authorities.add(authority);
  44.         }
  45.  
  46.         return authorities;
  47.     }
  48.  
  49.     @Override
  50.     public String getPassword() {
  51.         return currentUserInfo.getPassword();
  52.     }
  53.  
  54.     @Override
  55.     public String getUsername() {
  56.         return currentUserInfo.getUsername();
  57.     }
  58.  
  59.     @Override
  60.     public boolean isAccountNonExpired() {
  61.         return true;
  62.     }
  63.  
  64.     @Override
  65.     public boolean isAccountNonLocked() {
  66.         return true;
  67.     }
  68.  
  69.     @Override
  70.     public boolean isCredentialsNonExpired() {
  71.         return true;
  72.     }
  73.  
  74.     @Override
  75.     public boolean isEnabled() {
  76.         return true;
  77.     }
  78. }

（2）User

  1. package com.xingchen.sercurity.entity;
  2.  
  3. import io.swagger.annotations.ApiModel;
  4. import io.swagger.annotations.ApiModelProperty;
  5. import lombok.Data;
  6.  
  7. import java.io.Serializable;
  8.  
  9.  
  10. /**
  11.  * @author xing'chen
  12.  * 
  13.  *  * 用户实体类
  14.  */
  15. @Data
  16. @ApiModel(description = "用户实体类")
  17. public class User implements Serializable {
  18.  
  19. 	private static final long serialVersionUID = 1L;
  20.  
  21. 	@ApiModelProperty(value = "微信openid")
  22. 	private String username;
  23.  
  24. 	@ApiModelProperty(value = "密码")
  25. 	private String password;
  26.  
  27. 	@ApiModelProperty(value = "昵称")
  28. 	private String nickName;
  29.  
  30. 	@ApiModelProperty(value = "用户头像")
  31. 	private String salt;
  32.  
  33. 	@ApiModelProperty(value = "用户签名")
  34. 	private String token;
  35.  
  36. }

7、创建认证和授权的filter

（1）TokenLoginFilter：认证的filter

  1. package com.xingchen.sercurity.filter;
  2.  
  3.  
  4. import com.fasterxml.jackson.databind.ObjectMapper;
  5. import com.xingchen.sercurity.entity.SecurityUser;
  6. import com.xingchen.sercurity.entity.User;
  7. import com.xingchen.sercurity.security.TokenManager;
  8. import com.xingchen.utils.R;
  9. import com.xingchen.utils.ResponseUtil;
  10. import org.springframework.data.redis.core.RedisTemplate;
  11. import org.springframework.security.authentication.AuthenticationManager;
  12. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  13. import org.springframework.security.core.Authentication;
  14. import org.springframework.security.core.AuthenticationException;
  15. import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
  16. import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
  17.  
  18. import javax.servlet.FilterChain;
  19. import javax.servlet.ServletException;
  20. import javax.servlet.http.HttpServletRequest;
  21. import javax.servlet.http.HttpServletResponse;
  22. import java.io.IOException;
  23. import java.util.ArrayList;
  24.  
  25. /**
  26.  * @author xingchen
  27.  *  * 登录过滤器，继承UsernamePasswordAuthenticationFilter，对用户名密码进行登录校验
  28.  */
  29. public class TokenLoginFilter extends UsernamePasswordAuthenticationFilter {
  30.  
  31.     private AuthenticationManager authenticationManager;
  32.     private TokenManager tokenManager;
  33.     private RedisTemplate redisTemplate;
  34.  
  35.     public TokenLoginFilter(AuthenticationManager authenticationManager, TokenManager tokenManager, RedisTemplate redisTemplate) {
  36.         this.authenticationManager = authenticationManager;
  37.         this.tokenManager = tokenManager;
  38.         this.redisTemplate = redisTemplate;
  39.         this.setPostOnly(false);
  40.         this.setRequiresAuthenticationRequestMatcher(new AntPathRequestMatcher("/admin/acl/login","POST"));
  41.     }
  42.  
  43.     @Override
  44.     public Authentication attemptAuthentication(HttpServletRequest req, HttpServletResponse res)
  45.             throws AuthenticationException {
  46.         try {
  47.             User user = new ObjectMapper().readValue(req.getInputStream(), User.class);
  48.  
  49.             return authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.getUsername(), user.getPassword(), new ArrayList<>()));
  50.         } catch (IOException e) {
  51.             throw new RuntimeException(e);
  52.         }
  53.  
  54.     }
  55.  
  56.     /**
  57.      * 登录成功
  58.      * @param req
  59.      * @param res
  60.      * @param chain
  61.      * @param auth
  62.      * @throws IOException
  63.      * @throws ServletException
  64.      */
  65.     @Override
  66.     protected void successfulAuthentication(HttpServletRequest req, HttpServletResponse res, FilterChain chain,
  67.                                             Authentication auth) throws IOException, ServletException {
  68.         SecurityUser user = (SecurityUser) auth.getPrincipal();
  69.         String token = tokenManager.createToken(user.getCurrentUserInfo().getUsername());
  70.         redisTemplate.opsForValue().set(user.getCurrentUserInfo().getUsername(), user.getPermissionValueList());
  71.  
  72.         ResponseUtil.out(res, R.ok().data("token", token));
  73.     }
  74.  
  75.     /**
  76.      * 登录失败
  77.      * @param request
  78.      * @param response
  79.      * @param e
  80.      * @throws IOException
  81.      * @throws ServletException
  82.      */
  83.     @Override
  84.     protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response,
  85.                                               AuthenticationException e) throws IOException, ServletException {
  86.         ResponseUtil.out(response, R.error());
  87.     }
  88. }

（2）TokenAuthenticationFilter：

授权filter

  1. package com.xingchen.sercurity.filter;
  2.  
  3.  
  4. import com.xingchen.sercurity.security.TokenManager;
  5. import com.xingchen.utils.R;
  6. import com.xingchen.utils.ResponseUtil;
  7. import org.springframework.data.redis.core.RedisTemplate;
  8. import org.springframework.security.authentication.AuthenticationManager;
  9. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  10. import org.springframework.security.core.GrantedAuthority;
  11. import org.springframework.security.core.authority.SimpleGrantedAuthority;
  12. import org.springframework.security.core.context.SecurityContextHolder;
  13. import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
  14. import org.springframework.util.StringUtils;
  15.  
  16. import javax.servlet.FilterChain;
  17. import javax.servlet.ServletException;
  18. import javax.servlet.http.HttpServletRequest;
  19. import javax.servlet.http.HttpServletResponse;
  20. import java.io.IOException;
  21. import java.util.ArrayList;
  22. import java.util.Collection;
  23. import java.util.List;
  24.  
  25. /**
  26.  * @author xingchen
  27.  *  * 访问过滤器
  28.  */
  29. public class TokenAuthenticationFilter extends BasicAuthenticationFilter {
  30.     private TokenManager tokenManager;
  31.     private RedisTemplate redisTemplate;
  32.  
  33.     public TokenAuthenticationFilter(AuthenticationManager authManager, TokenManager tokenManager,RedisTemplate redisTemplate) {
  34.         super(authManager);
  35.         this.tokenManager = tokenManager;
  36.         this.redisTemplate = redisTemplate;
  37.     }
  38.  
  39.     @Override
  40.     protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain)
  41.             throws IOException, ServletException {
  42.         logger.info("================="+req.getRequestURI());
  43.         if(req.getRequestURI().indexOf("admin") == -1) {
  44.             chain.doFilter(req, res);
  45.             return;
  46.         }
  47.  
  48.         UsernamePasswordAuthenticationToken authentication = null;
  49.         try {
  50.             authentication = getAuthentication(req);
  51.         } catch (Exception e) {
  52.             ResponseUtil.out(res, R.error());
  53.         }
  54.  
  55.         if (authentication != null) {
  56.             SecurityContextHolder.getContext().setAuthentication(authentication);
  57.         } else {
  58.             ResponseUtil.out(res, R.error());
  59.         }
  60.         chain.doFilter(req, res);
  61.     }
  62.  
  63.     private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request) {
  64.         // token置于header里
  65.         String token = request.getHeader("token");
  66.         if (token != null && !"".equals(token.trim())) {
  67.             String userName = tokenManager.getUserFromToken(token);
  68.  
  69.             List<String> permissionValueList = (List<String>) redisTemplate.opsForValue().get(userName);
  70.             Collection<GrantedAuthority> authorities = new ArrayList<>();
  71.             for(String permissionValue : permissionValueList) {
  72.                 if(StringUtils.isEmpty(permissionValue)) {
  73.                     continue;
  74.                 }
  75.                 SimpleGrantedAuthority authority = new SimpleGrantedAuthority(permissionValue);
  76.                 authorities.add(authority);
  77.             }
  78.  
  79.             if (!StringUtils.isEmpty(userName)) {
  80.                 return new UsernamePasswordAuthenticationToken(userName, token, authorities);
  81.             }
  82.             return null;
  83.         }
  84.         return null;
  85.     }
  86. }

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/知新_RL/article/detail/185301
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号