SpringBoot集成Security实现权限控制_springboot security权限控制

作者：码创造者 | 2024-07-01 00:22:47

踩

springboot security权限控制

SpringSecurity简介

认证+授权

主要有两个主要功能：“认证”，是建立一个他声明的主体的过程（一个“主体”一般是指用户，设备或一些可以在你的应用程序中执行动作的其他系统)，通俗点说就是系统认为用户是否能登录。一般在拦截器中进行拦截用户信息进行认证。 “授权"指确定一个主体是否允许在你的应用程序执行一个动作的过程，一般是在Security中进行接口权限配置，查看用户是否具有对应接口权限。通俗点讲就是系统判断用户是否有权限去做某些事情。

相应语法：

.successForwardUrl()登录成功后跳转地址

.loginPage()登录页面

.loginProcessingurl登录页面表单提交地址，此地址可以不真实存在。

antMatchers():匹配内容permitAll():允许

1. 添加依赖

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

2. 认证

SpringSecurty提供了多种验证方法，本次采用用户名/密码的方式进行验证。所以需要实现UserDetailsService接口中的loadUserByUserName方法，从数据库中查找对应的数据然后与用户输入数据进行对比，所以需要返回一个UserDetails对象。

2.1. 实现UserDetails和UserDetailsService接口

本项目中使用student作为用户表，同时使用type作为权限标识

2.1.1 将student用户类继承UserDetails接口


import com.baomidou.mybatisplus.annotation.IdType;
import com.baomidou.mybatisplus.annotation.TableId;
import lombok.Data;
import lombok.EqualsAndHashCode;
import lombok.experimental.Accessors;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
 
import java.util.ArrayList;
import java.util.Collection;
import java.util.Date;
import java.util.List;
 
@Data
@EqualsAndHashCode(callSuper = false)
@Accessors(chain = true)
public class Student implements UserDetails {
 
    @TableId(value = "id", type = IdType.AUTO)
    private Integer id;
 
    private String studentName;
 
    private String studentSex;
 
    private String studentSubject;
 
    private String username;
 
    private String password;
 
    private String salt;
 
    private String email;
 
    private Integer type;
 
    private Integer status;
 
    private String activationCode;
 
    private String headerUrl;
 
    private Date createTime;
 
    private String studentPhone;
    // true: 账号未过期.
    @Override
    public boolean isAccountNonExpired() {
        return true;
    }
 
    // true: 账号未锁定.
    @Override
    public boolean isAccountNonLocked() {
        return true;
    }
 
    // true: 凭证未过期.
    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }
 
    // true: 账号可用.
    @Override
    public boolean isEnabled() {
        return true;
    }
 
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        List<GrantedAuthority> list = new ArrayList<>();
        list.add(new GrantedAuthority() {
            @Override
            public String getAuthority() {
                switch (type) {
                    case 1:
                        return "ADMIN";
                    default:
                        return "USER";
                }
            }
        });
        return list;
    }
 
}

2.1.2 同时StudentService继承UserDetailsService

创建getAuthorities方法获取用户权限，同时Type的字段值代表了用户的权限

自定义实现验证权限类型


public interface StudentService extends IService<Student>, UserDetailsService {
 
   
 
    Collection<? extends GrantedAuthority> getAuthorities(Integer id);
}


@Service
public class StudentServiceImpl extends ServiceImpl<StudentMapper, Student> implements StudentService {    
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities(Integer id) {
        Student student = this.findStudentById(id);
 
        List<GrantedAuthority> list = new ArrayList<>();
        list.add(new GrantedAuthority() {
            @Override
            public String getAuthority() {
                switch (student.getType()) {
                    case 1:
                        return AUTHORITY_ADMIN;
                    case 2:
                        return AUTHORITY_MODERATOR;
                    default:
                        return AUTHORITY_USER;
                }
            }
        });
        return list;
    }
}

2.2 创建CommunityConstant接口返回权限类型

可以自定义也可以不使用这一步


 
public interface CommunityConstant {
 
    /**
     权限:普通用户ID
     **/
    String AUTHORITY_USER="user";
 
    /**
     权限:管理员ID
     **/
    String AUTHORITY_ADMIN="admin";
 
    /**
     权限:管理员ID
     **/
    String AUTHORITY_MODERATOR="moderator";
 
}

2.3 认证步骤

将student中的用户信息导入到Security中，使得安全配置生效

//构建用户认证结果，并存入SecurityContext，以便于Security进行授权
Authentication authentication=new UsernamePasswordAuthenticationToken(
student,student.getPassword(),studentService.getAuthorities(student.getId()));

SecurityContextHolder.setContext(new SecurityContextImpl(authentication));

本次采用拦截器的形式来进行构建用户认证结果，并存入SecurityContext，以便于Security进行授权，如果loadUserByName验证通过，则此处没有问题，即可验证通过。


@Component
public class LoginInterceptor implements HandlerInterceptor {
    @Autowired
    private HostHolder hostHolder;
 
    @Autowired
    private StudentService studentService;
 
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
 
        String ticket = CookieUtil.getValue(request, "ticket");  //调用存在cookie里的数据
 
        if (ticket != null) {
            // 查询凭证
            LoginTicket loginTicket = studentService.findLoginTicket(ticket);
            // 检查凭证是否有效
            if (loginTicket != null && loginTicket.getStatus() == 0 && loginTicket.getExpired().after(new Date())) {
 
                // 根据凭证查询用户
                Student student = studentService.findStudentById(loginTicket.getUserId());
                // 在本次请求中持有用户
                hostHolder.setStudent(student);
 
                //构建用户认证结果，并存入SecurityContext，以便于Security进行授权
                Authentication authentication=new UsernamePasswordAuthenticationToken(
                        student,student.getPassword(),studentService.getAuthorities(student.getId()));
 
                SecurityContextHolder.setContext(new SecurityContextImpl(authentication));
                return true;
            }else{
                response.sendRedirect(request.getContextPath()+"/login");   //转发请求 到request.getContextPath() + "/login";
            }
        }else {
            response.sendRedirect(request.getContextPath()+"/login");   //request.getContextPath()为请求目录  localhost:8080/sushe/
        }
        return false;
    }
 
    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
        Student student = hostHolder.getStudent();
        if (student != null && modelAndView != null) {
            modelAndView.addObject("loginStudent", student);
        }
    }
 
    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
        hostHolder.clear();
    }
}

3. 授权

在认证通过之后我们可以在security配置中进行用户，管理员等不同角色对接口的访问限制。

.antMatcher{} 对应相关接口

.hasAnyAuthority{} 对应相关用户


package com.example.sushe.config;
 
 
import com.example.sushe.util.CommunityConstant;
import com.example.sushe.util.CommunityUtil;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.access.AccessDeniedHandler;
 
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;
 
 
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter implements CommunityConstant {
 
    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/resources/**");
    }
 
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //授权
        http.authorizeRequests()
                .antMatchers(
                        "/person/findAll"
                )
                .hasAnyAuthority(
                        AUTHORITY_USER,
                        AUTHORITY_ADMIN,
                        AUTHORITY_MODERATOR
                )
                .antMatchers(
                        "/person/add/*","/person/update/*","/person/updatePerson","/person/delete","/subject/*"
                )
                .hasAnyAuthority(
                        AUTHORITY_ADMIN
                )
                .anyRequest().permitAll()
                .and().csrf().disable();
 
 
        //权限不够时的出理
        http.exceptionHandling()
                .authenticationEntryPoint(new AuthenticationEntryPoint() {
                    //没有登陆
                    @Override
                    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException e) throws IOException, ServletException {
                        String xRequestedWith = request.getHeader("x-requested-with");
                        if("XMLHttpRequest".equals(xRequestedWith)){
                            response.setContentType("application/plain/character=utf-8");
                            PrintWriter writer=response.getWriter();
                            writer.write((CommunityUtil.getJSONString(403,"你还没有登录呕")));
                        }else{
                            response.sendRedirect(request.getContextPath()+"/login");
                        }
                    }
                })
                .accessDeniedHandler(new AccessDeniedHandler() {
                    //权限不足
                    @Override
                    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException e) throws IOException, ServletException {
                        String xRequestedWith = request.getHeader("x-requested-with");
                        if("XMLHttpRequest".equals(xRequestedWith)){
                            response.setContentType("application/plain/character=utf-8");
                            PrintWriter writer=response.getWriter();
                            writer.write((CommunityUtil.getJSONString(403,"没有访问此页面的权限")));
                        }else{
                            response.sendRedirect(request.getContextPath()+"/error");
                        }
                    }
                });
 
        //Security底层会默认拦截/logout请求，进行退出处理
        //覆盖它原来的逻辑
        http.logout().logoutUrl("/Securitylogout");
    }
}

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/码创造者/article/detail/774488