devbox
笔触狂放9
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

SpringSecurity

作者：笔触狂放9 | 2024-07-26 14:23:22

赞

踩

SpringSecurity

登录实战

前言

　　Spring Security 是 Spring 家族中的一个安全管理框架。相比与另外一个安全框架 Shiro，它提供了更丰富的功能，社区资源也比Shiro丰富。

　　一般来说中大型的项目都是使用SpringSecurity 来做安全框架。小项目有Shiro的比较多，因为相比与SpringSecurity，Shiro的上手更加的简单。

　　一般Web应用的主要进行 认证 和 授权。

　　认证：验证当前访问系统的是不是本系统的用户，并且要确认具体是哪个用户。

　　授权：经过认证后判断当前用户是否有权限进行某个操作。

　　而认证和授权也是 SpringSecurity 作为安全框架的核心功能。

登录流程：

　

 先进行登录，登录后带着生成的token进行访问，再给予对相应的权限进行操作。

  1. 在使用Spring Security构建的Web应用程序中，登录流程涉及多个关键组件，下面详细介绍这些组件及其在登录过程中扮演的角色：
  2.  
  3. 1. Filter Chain（过滤器链）
  4. SecurityContextPersistenceFilter：维护安全上下文，确保线程间的安全信息传递。
  5.  
  6. UsernamePasswordAuthenticationFilter：负责处理基于表单的登录请求，收集用户名和密码，调用AuthenticationManager进行验证。
  7.  
  8. ConcurrentSessionFilter：管理并发会话，避免同一账号多处登录。
  9.  
  10. ExceptionTranslationFilter：捕获并处理认证或授权失败的异常。
  11.  
  12. FilterSecurityInterceptor：执行访问决策，依据用户权限判断是否允许访问特定资源。
  13.  
  14. 2. AuthenticationManager（认证管理器）
  15. 负责处理认证请求，它接受一个Authentication对象（包含用户凭证），并返回一个经过完全填充的（已验证的或未经验证的）Authentication对象。对于基于用户名和密码的登录，Spring Security提供了DaoAuthenticationProvider，它使用UserDetailsService来检索用户信息。
  16.  
  17. 3. UserDetailsService（用户详情服务）
  18. 接口定义了一个方法loadUserByUsername(String username)，用于根据用户名加载用户信息。开发者需要实现这个接口，通常从数据库中查询用户信息。返回的是UserDetails对象，它包含用户的用户名、密码（通常是加密的）、权限等安全相关信息。
  19.  
  20. 4. UserDetails（用户详情）
  21. 表示用户安全信息的核心接口，包含用户名、密码、账号是否过期、凭证是否过期、账号是否锁定以及赋予用户的权限集合。一个典型的实现是org.springframework.security.core.userdetails.User。
  22.  
  23. 登录流程步骤（结合Spring Security组件）：
  24. 请求登录页面：用户访问登录页面，该页面由Spring Security默认或自定义的登录页面处理。
  25.  
  26. 提交登录信息：用户提交用户名和密码，这些信息通过UsernamePasswordAuthenticationFilter被封装成一个UsernamePasswordAuthenticationToken，并转发给AuthenticationManager。
  27.  
  28. 验证用户凭证：
  29.  
  30. AuthenticationManager委托给配置的AuthenticationProvider（如DaoAuthenticationProvider）处理。
  31.  
  32. DaoAuthenticationProvider调用实现UserDetailsService的服务来加载用户详情（UserDetails）。
  33.  
  34. 使用PasswordEncoder比较提交的密码与数据库中存储的密码哈希值，验证密码是否正确。
  35.  
  36. 认证成功：
  37.  
  38. 如果验证成功，AuthenticationProvider返回一个完全填充的Authentication对象，其中包含用户的角色和权限信息。
  39.  
  40. AuthenticationManager将此认证对象设置到安全上下文中，使得后续请求能够访问用户信息和权限。
  41.  
  42. 通常会生成一个会话或JWT，并将其发送给客户端，用于后续请求的认证。
  43.  
  44. 认证失败：
  45.  
  46. 认证失败时，抛出异常，由ExceptionTranslationFilter捕获并处理，可能重定向到登录页面显示错误消息，或响应HTTP 401 Unauthorized。
  47.  
  48. 访问控制：
  49.  
  50. 用户携带令牌访问受保护资源时，FilterSecurityInterceptor基于用户的角色和权限进行访问决策，决定是否允许访问。
  51.  
  52. 如上：Spring Security提供了一个强大且灵活的安全认证与授权框架，确保了登录过程的严谨性和安全性。

依赖

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  3.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  4.     <modelVersion>4.0.0</modelVersion>
  5.     <groupId>com.xinzhi</groupId>
  6.     <artifactId>SpringSecurityDemo2</artifactId>
  7.     <version>0.0.1-SNAPSHOT</version>
  8.     <name>SpringSecurityDemo2</name>
  9.     <description>SpringSecurityDemo2</description>
  10.     <properties>
  11.         <java.version>11</java.version>
  12.         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
  13.         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
  14.         <spring-boot.version>2.6.2</spring-boot.version>
  15.     </properties>
  16.     <dependencies>
  17.         <dependency>
  18.             <groupId>org.springframework.boot</groupId>
  19.             <artifactId>spring-boot-starter-security</artifactId>
  20.         </dependency>
  21.         <dependency>
  22.             <groupId>org.springframework.boot</groupId>
  23.             <artifactId>spring-boot-starter-web</artifactId>
  24.         </dependency>
  25.  
  26.         <!-- mysql驱动 -->
  27.         <dependency>
  28.             <groupId>mysql</groupId>
  29.             <artifactId>mysql-connector-java</artifactId>
  30.             <version>8.0.33</version>
  31.         </dependency>
  32.  
  33.         <!-- 连接池 -->
  34.         <dependency>
  35.             <groupId>com.alibaba</groupId>
  36.             <artifactId>druid-spring-boot-starter</artifactId>
  37.             <version>1.1.16</version>
  38.         </dependency>
  39.  
  40.         <!-- mybatis -->
  41.         <dependency>
  42.             <groupId>org.mybatis.spring.boot</groupId>
  43.             <artifactId>mybatis-spring-boot-starter</artifactId>
  44.             <version>2.0.1</version>
  45.         </dependency>
  46.  
  47.         <dependency>
  48.             <groupId>org.projectlombok</groupId>
  49.             <artifactId>lombok</artifactId>
  50.             <optional>true</optional>
  51.         </dependency>
  52.         <!--mybatis-plus的springboot支持-->
  53.         <dependency>
  54.             <groupId>com.baomidou</groupId>
  55.             <artifactId>mybatis-plus-boot-starter</artifactId>
  56.             <version>3.1.1</version>
  57.         </dependency>
  58.         <dependency>
  59.             <groupId>org.springframework.boot</groupId>
  60.             <artifactId>spring-boot-starter-test</artifactId>
  61.             <scope>test</scope>
  62.         </dependency>
  63.         <dependency>
  64.             <groupId>org.springframework.boot</groupId>
  65.             <artifactId>spring-boot-starter-thymeleaf</artifactId>
  66.         </dependency>
  67.         <dependency>
  68.             <groupId>org.springframework.security</groupId>
  69.             <artifactId>spring-security-test</artifactId>
  70.             <scope>test</scope>
  71.         </dependency>
  72.         <dependency>
  73.             <groupId>com.github.penggle</groupId>
  74.             <artifactId>kaptcha</artifactId>
  75.             <version>2.3.2</version>
  76.             <exclusions>
  77.                 <exclusion>
  78.                     <artifactId>javax.servlet-api</artifactId>
  79.                     <groupId>javax.servlet</groupId>
  80.                 </exclusion>
  81.             </exclusions>
  82.         </dependency>
  83.  
  84.         <dependency>
  85.             <groupId>io.jsonwebtoken</groupId>
  86.             <artifactId>jjwt</artifactId>
  87.             <version>0.9.0</version>
  88.         </dependency>
  89.  
  90.         <dependency>
  91.             <groupId>javax.xml.bind</groupId>
  92.             <artifactId>jaxb-api</artifactId>
  93.             <version>2.3.1</version>
  94.         </dependency>
  95.  
  96.         <dependency>
  97.             <groupId>org.aspectj</groupId>
  98.             <artifactId>aspectjweaver</artifactId>
  99.             <version>1.8.13</version>
  100.         </dependency>
  101.     </dependencies>
  102.     <dependencyManagement>
  103.         <dependencies>
  104.             <dependency>
  105.                 <groupId>org.springframework.boot</groupId>
  106.                 <artifactId>spring-boot-dependencies</artifactId>
  107.                 <version>${spring-boot.version}</version>
  108.                 <type>pom</type>
  109.                 <scope>import</scope>
  110.             </dependency>
  111.         </dependencies>
  112.     </dependencyManagement>
  113.  
  114.     <build>
  115.         <plugins>
  116.             <plugin>
  117.                 <groupId>org.apache.maven.plugins</groupId>
  118.                 <artifactId>maven-compiler-plugin</artifactId>
  119.                 <version>3.8.1</version>
  120.                 <configuration>
  121.                     <source>11</source>
  122.                     <target>11</target>
  123.                     <encoding>UTF-8</encoding>
  124.                 </configuration>
  125.             </plugin>
  126.         </plugins>
  127.     </build>
  128.  
  129. </project>

application.properties配置文件

  1. # ????
  2. spring.application.name=SpringSecurityDemo
  3.  
  4. # ???
  5. server.port=8081
  6.  
  7. #-----------------------------Mysql??
  8. spring.datasource.type=com.alibaba.druid.pool.DruidDataSource
  9. spring.datasource.driverClassName=com.mysql.cj.jdbc.Driver
  10. #mybatis.config-location=classpath:mybatis-config.xml
  11. mybatis-plus.type-aliases-package=com.xinzhi.model
  12. mybatis-plus.mapper-locations=classpath:mapper/*.xml
  13. mybatis-plus.configuration.log-impl=org.apache.ibatis.logging.stdout.StdOutImpl
  14. mybatis-plus.configuration.map-underscore-to-camel-case=true
  15.  
  16.  
  17. #-----------------------------Mysql
  18. spring.datasource.url=jdbc:mysql://localhost:3306/jdb?useUnicode=true&characterEncoding=utf-8&useSSL=false
  19. spring.datasource.username=root
  20. spring.datasource.password=123456
  21.  
  22. server.servlet.session.timeout=1m

建表

  1. SET NAMES utf8mb4;
  2. SET FOREIGN_KEY_CHECKS = 0;
  3.  
  4. -- ----------------------------
  5. -- Table structure for menu
  6. -- ----------------------------
  7. DROP TABLE IF EXISTS `menu`;
  8. CREATE TABLE `menu`  (
  9.   `id` int(11) NOT NULL AUTO_INCREMENT,
  10.   `pattern` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
  11.   PRIMARY KEY (`id`) USING BTREE
  12. ) ENGINE = InnoDB AUTO_INCREMENT = 4 CHARACTER SET = utf8mb4 COLLATE = utf8mb4_general_ci ROW_FORMAT = Compact;
  13.  
  14. -- ----------------------------
  15. -- Records of menu
  16. -- ----------------------------
  17. INSERT INTO `menu` VALUES (1, '/admin/**');
  18. INSERT INTO `menu` VALUES (2, '/user/**');
  19. INSERT INTO `menu` VALUES (3, '/guest/**');
  20.  
  21. -- ----------------------------
  22. -- Table structure for menu_role
  23. -- ----------------------------
  24. DROP TABLE IF EXISTS `menu_role`;
  25. CREATE TABLE `menu_role`  (
  26.   `id` int(11) NOT NULL AUTO_INCREMENT,
  27.   `rid` int(11) NULL DEFAULT NULL,
  28.   `mid` int(11) NULL DEFAULT NULL,
  29.   PRIMARY KEY (`id`) USING BTREE
  30. ) ENGINE = InnoDB AUTO_INCREMENT = 5 CHARACTER SET = utf8mb4 COLLATE = utf8mb4_general_ci ROW_FORMAT = Compact;
  31.  
  32. -- ----------------------------
  33. -- Records of menu_role
  34. -- ----------------------------
  35. INSERT INTO `menu_role` VALUES (1, 1, 1);
  36. INSERT INTO `menu_role` VALUES (2, 1, 2);
  37. INSERT INTO `menu_role` VALUES (3, 2, 2);
  38. INSERT INTO `menu_role` VALUES (4, 3, 3);
  39.  
  40. -- ----------------------------
  41. -- Table structure for role
  42. -- ----------------------------
  43. DROP TABLE IF EXISTS `role`;
  44. CREATE TABLE `role`  (
  45.   `id` int(11) NOT NULL AUTO_INCREMENT,
  46.   `name` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
  47.   `content` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
  48.   PRIMARY KEY (`id`) USING BTREE
  49. ) ENGINE = InnoDB AUTO_INCREMENT = 4 CHARACTER SET = utf8mb4 COLLATE = utf8mb4_general_ci ROW_FORMAT = Compact;
  50.  
  51. -- ----------------------------
  52. -- Records of role
  53. -- ----------------------------
  54. INSERT INTO `role` VALUES (1, 'product', '商品管理员');
  55. INSERT INTO `role` VALUES (2, 'admin', '系统管理员');
  56. INSERT INTO `role` VALUES (3, 'user', '用户管理员');
  57.  
  58. -- ----------------------------
  59. -- Table structure for user
  60. -- ----------------------------
  61. DROP TABLE IF EXISTS `user`;
  62. CREATE TABLE `user`  (
  63.   `id` int(11) NOT NULL AUTO_INCREMENT,
  64.   `username` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
  65.   `password` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
  66.   `enabled` tinyint(1) NULL DEFAULT NULL,
  67.   `accountNonExpired` tinyint(1) NULL DEFAULT NULL,
  68.   `accountNonLocked` tinyint(1) NULL DEFAULT NULL,
  69.   `credentialsNonExpired` tinyint(1) NULL DEFAULT NULL,
  70.   PRIMARY KEY (`id`) USING BTREE
  71. ) ENGINE = InnoDB AUTO_INCREMENT = 4 CHARACTER SET = utf8mb4 COLLATE = utf8mb4_general_ci ROW_FORMAT = Compact;
  72.  
  73. -- ----------------------------
  74. -- Records of user
  75. -- ----------------------------
  76. INSERT INTO `user` VALUES (1, 'root', '$2a$10$YeilFczw8sQ1RBthIFLRW.pI/KkdbDofOmZ0w5Wfq9mMMyL3ylC/.', 1, 1, 1, 1);
  77. INSERT INTO `user` VALUES (2, 'admin', '$2a$10$YeilFczw8sQ1RBthIFLRW.pI/KkdbDofOmZ0w5Wfq9mMMyL3ylC/.', 1, 1, 1, 1);
  78. INSERT INTO `user` VALUES (3, 'han', '$2a$10$YeilFczw8sQ1RBthIFLRW.pI/KkdbDofOmZ0w5Wfq9mMMyL3ylC/.', 1, 1, 1, 1);
  79.  
  80. -- ----------------------------
  81. -- Table structure for user_role
  82. -- ----------------------------
  83. DROP TABLE IF EXISTS `user_role`;
  84. CREATE TABLE `user_role`  (
  85.   `id` int(11) NOT NULL AUTO_INCREMENT,
  86.   `uid` int(11) NULL DEFAULT NULL,
  87.   `rid` int(11) NULL DEFAULT NULL,
  88.   PRIMARY KEY (`id`) USING BTREE
  89. ) ENGINE = InnoDB AUTO_INCREMENT = 5 CHARACTER SET = utf8mb4 COLLATE = utf8mb4_general_ci ROW_FORMAT = Compact;
  90.  
  91. -- ----------------------------
  92. -- Records of user_role
  93. -- ----------------------------
  94. INSERT INTO `user_role` VALUES (1, 1, 1);
  95. INSERT INTO `user_role` VALUES (2, 1, 2);
  96. INSERT INTO `user_role` VALUES (3, 2, 2);
  97. INSERT INTO `user_role` VALUES (4, 3, 3);
  98.  
  99. SET FOREIGN_KEY_CHECKS = 1;

实体类

权限表

package com.xinzhi.model;

import java.util.List;

/**
* 权限表
*/
public class Menu {

private Integer id;

private String pattern;

private List<Role> roles;

public Integer getId() {
return id;
}

public void setId(Integer id) {
this.id = id;
}

public String getPattern() {
return pattern;
}

public void setPattern(String pattern) {
this.pattern = pattern;
}

public List<Role> getRoles() {
return roles;
}

public void setRoles(List<Role> roles) {
this.roles = roles;
}
}

result

package com.xinzhi.model;



import java.io.Serializable;


public class Result<T> implements Serializable {

private static final long serialVersionUID = 1L;

/**
* 成功标志
*/
private boolean success = true;

/**
* 返回处理消息
*/
private String message = "操作成功！";

/**
* 返回代码
*/
private Integer code = 0;

/**
* 返回数据对象 data
*/
private T result;

public static long getSerialVersionUID() {
return serialVersionUID;
}

public boolean isSuccess() {
return success;
}

public void setSuccess(boolean success) {
this.success = success;
}

public String getMessage() {
return message;
}

public void setMessage(String message) {
this.message = message;
}

public Integer getCode() {
return code;
}

public void setCode(Integer code) {
this.code = code;
}

public T getResult() {
return result;
}

public void setResult(T result) {
this.result = result;
}

public long getTimestamp() {
return timestamp;
}

public void setTimestamp(long timestamp) {
this.timestamp = timestamp;
}

/**
* 时间戳
*/
private long timestamp = System.currentTimeMillis();

public Result() {

}

public Result<T> success(String message) {
this.message = message;
this.code = 200;
this.success = true;
return this;
}


public static Result<Object> ok() {
Result<Object> r = new Result<Object>();
r.setSuccess(true);
r.setCode(200);
r.setMessage("成功");
return r;
}

public static Result<Object> ok(String msg) {
Result<Object> r = new Result<Object>();
r.setSuccess(true);
r.setCode(200);
r.setMessage(msg);
return r;
}

public static Result<Object> ok(Object data) {
Result<Object> r = new Result<Object>();
r.setSuccess(true);
r.setCode(200);
r.setResult(data);
return r;
}

public static Result<Object> error(String msg) {
return error(500, msg);
}

public static Result<Object> error(int code, String msg) {
Result<Object> r = new Result<Object>();
r.setCode(code);
r.setMessage(msg);
r.setSuccess(false);
return r;
}

public Result<T> error500(String message) {
this.message = message;
this.code = 500;
this.success = false;
return this;
}
/**
* 无权限访问返回结果
*/
public static Result<Object> noauth(String msg) {
return error(555, msg);
}
}

角色信息表

package com.xinzhi.model;

/**
* 角色信息
*/
public class Role {
/**
* id
*/
private Integer id;
/**
* 角色名
*/
private String name;
/**
* 角色说明
*/
private String content;

public Integer getId() {
return id;
}

public void setId(Integer id) {
this.id = id;
}

public String getName() {
return name;
}

public void setName(String name) {
this.name = name == null ? null : name.trim();
}

public String getContent() {
return content;
}

public void setContent(String content) {
this.content = content == null ? null : content.trim();
}
}

用户信息表

package com.xinzhi.model;

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;

import java.util.Collection;

/**
* 用户信息
*/
public class User implements UserDetails {

private Integer id;
private String username; //用户名
private String password; //密码
private boolean accountNonExpired; //是否没过期
private boolean accountNonLocked; //是否没被锁定
private boolean credentialsNonExpired; //密码是否没过期
private boolean enabled; //账号是否可用
private Collection<? extends GrantedAuthority> authorities; //用户的权限集合


public Integer getId() {
return id;
}

public void setId(Integer id) {
this.id = id;
}

public void setPassword(String password) {
this.password = password;
}

public void setUsername(String username) {
this.username = username;
}

public void setAccountNonExpired(boolean accountNonExpired) {
this.accountNonExpired = accountNonExpired;
}

public void setAccountNonLocked(boolean accountNonLocked) {
this.accountNonLocked = accountNonLocked;
}

public void setCredentialsNonExpired(boolean credentialsNonExpired) {
this.credentialsNonExpired = credentialsNonExpired;
}

public void setEnabled(boolean enabled) {
this.enabled = enabled;
}

public void setAuthorities(Collection<? extends GrantedAuthority> authorities) {
this.authorities = authorities;
}

@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return authorities;
}

@Override
public String getPassword() {
return password;
}

@Override
public String getUsername() {
return username;
}

@Override
public boolean isAccountNonExpired() {
return true; //暂时未用到，直接返回true，表示账户未过期
}

@Override
public boolean isAccountNonLocked() {
return true; //暂时未用到，直接返回true，表示账户未被锁定
}

@Override
public boolean isCredentialsNonExpired() {
return true; //暂时未用到，直接返回true，表示账户密码未过期
}

@Override
public boolean isEnabled() {
return enabled;
}
}

dao接口

  1. package com.xinzhi.dao;
  2.  
  3. import com.baomidou.mybatisplus.core.mapper.BaseMapper;
  4. import com.xinzhi.model.Menu;
  5. import com.xinzhi.model.Role;
  6. import com.xinzhi.model.User;
  7. import org.apache.ibatis.annotations.Mapper;
  8. import org.apache.ibatis.annotations.Param;
  9.  
  10. import java.util.List;
  11.  
  12. @Mapper
  13. public interface UserMapper extends BaseMapper<User> {
  14.  
  15.     User selectByUsername(String username);
  16.  
  17.     List<Role> selectRolesByUserId(Integer id);
  18.  
  19.     Integer updatePassword(@Param("username") String username, @Param("password") String password);
  20.  
  21.     List<Menu> selectMenuByRoleIds(@Param("roleIds")List<Integer> roleIds);
  22.  
  23. }

usermapper

  1. <?xml version="1.0" encoding="UTF-8" ?>
  2. <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" >
  3. <mapper namespace="com.xinzhi.dao.UserMapper" >
  4.  
  5.     <sql id="Base_Column_List" >
  6.         id, username, password, enabled, accountNonExpired, accountNonLocked, credentialsNonExpired
  7.     </sql>
  8.     <update id="updatePassword">
  9.         update user set password=#{password} where username=#{username}
  10.     </update>
  11.  
  12.     <select id="selectByUsername" resultType="com.xinzhi.model.User">
  13.         select
  14.         <include refid="Base_Column_List" />
  15.         from user
  16.         where username = #{username}
  17.     </select>
  18.     <select id="selectRolesByUserId" resultType="com.xinzhi.model.Role">
  19.         select
  20.             r.name,r.id,r.content
  21.         from
  22.             role r
  23.                 left join
  24.             user_role ur
  25.             on r.id = ur.rid
  26.         where ur.uid=#{uid}
  27.     </select>
  28.     <select id="selectMenuByRoleIds" resultType="com.xinzhi.model.Menu">
  29.         select
  30.         m.id,m.pattern
  31.         from menu m
  32.         left join menu_role rm on m.id=rm.mid
  33.         where
  34.         <foreach collection="roleIds" open="rm.rid in(" item="id" close=")" separator=",">
  35.             #{id}
  36.         </foreach>
  37.     </select>
  38.  
  39. </mapper>

Service层

  1. package com.xinzhi.service;
  2.  
  3. import com.xinzhi.dao.UserMapper;
  4. import com.xinzhi.model.Menu;
  5. import com.xinzhi.model.Role;
  6. import com.xinzhi.model.User;
  7. import lombok.extern.slf4j.Slf4j;
  8. import org.springframework.beans.factory.annotation.Autowired;
  9. import org.springframework.security.core.authority.AuthorityUtils;
  10. import org.springframework.security.core.userdetails.UserDetails;
  11. import org.springframework.security.core.userdetails.UserDetailsService;
  12. import org.springframework.security.core.userdetails.UsernameNotFoundException;
  13. import org.springframework.stereotype.Service;
  14.  
  15. import java.util.Collections;
  16. import java.util.List;
  17. import java.util.stream.Collectors;
  18.  
  19. /**
  20.  * 权限
  21.  */
  22. @Service
  23. @Slf4j
  24.  
  25. public class SpringUserDetailsService implements UserDetailsService {
  26.  
  27.     @Autowired
  28.     private UserMapper userMapper;
  29.  
  30.  
  31.     @Override
  32.     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
  33.         User user = userMapper.selectByUsername(username);
  34. //        判断用户是否存在
  35.         if (user == null){
  36.             throw new UsernameNotFoundException("用户不存在");
  37.         }
  38. //       根据用户ID查找用户的角色列表
  39.         List<Role> roles = userMapper.selectRolesByUserId(user.getId());
  40. //      获取角色ID列表
  41.         List<Integer> roleIds = roles.stream().map(s -> s.getId()).collect(Collectors.toList());
  42. //      根据角色ID列表查找权限
  43.         List<Menu> menus = userMapper.selectMenuByRoleIds(roleIds);
  44. //     获取角色名称列表并加上前缀 "ROLE_"
  45.         List<String> collect = roles.stream().map(s -> "ROLE_" + s.getName()).collect(Collectors.toList());
  46. //     获取菜单权限模式
  47.         List<String> collect1 = menus.stream().map(m -> m.getPattern()).collect(Collectors.toList());
  48. //     合并菜单权限和角色权限
  49.         Collections.addAll(collect1,collect.stream().toArray(String[] ::new));
  50. //        将权限列表设置到用户对象中
  51.         user.setAuthorities(AuthorityUtils.commaSeparatedStringToAuthorityList(String.join(",",collect1)));
  52. //        返回包含用户详情的User对象
  53.         return user;
  54.  
  55.     }
  56. }

config配置类

  1. package com.xinzhi.config;
  2.  
  3. import com.fasterxml.jackson.databind.ObjectMapper;
  4. import com.xinzhi.filter.CaptchaCodeFilter;
  5. import com.xinzhi.service.SpringUserDetailsService;
  6. import org.springframework.beans.factory.annotation.Autowired;
  7. import org.springframework.context.annotation.Bean;
  8. import org.springframework.context.annotation.Configuration;
  9. import org.springframework.security.authentication.AuthenticationManager;
  10. import org.springframework.security.authorization.AuthorizationDecision;
  11. import org.springframework.security.config.BeanIds;
  12. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  13. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  14. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  15. import org.springframework.security.config.http.SessionCreationPolicy;
  16. import org.springframework.security.core.GrantedAuthority;
  17. import org.springframework.security.core.authority.SimpleGrantedAuthority;
  18. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  19. import org.springframework.security.crypto.password.PasswordEncoder;
  20. import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
  21. import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
  22. import org.springframework.web.cors.CorsConfiguration;
  23. import org.springframework.web.cors.CorsConfigurationSource;
  24.  
  25. import javax.annotation.Resource;
  26. import java.util.Arrays;
  27. import java.util.Collection;
  28. import java.util.HashMap;
  29.  
  30. @Configuration
  31. public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
  32.     @Autowired
  33.     private CaptchaCodeFilter captchaCodeFilter;
  34.  
  35.     @Override
  36.     protected void configure(HttpSecurity http) throws Exception {
  37.         // 表单认证
  38.         http.formLogin()
  39.                 .loginProcessingUrl("/login")
  40. //                .successForwardUrl("/index")
  41. //                .failureForwardUrl("/fail") //登录失败跳转地址
  42.                 //认证成功处理
  43.                 .successHandler(((request, response, authentication) -> {
  44.                     HashMap<String, Object> map = new HashMap<>();
  45.                     map.put("msg", "认证成功");
  46.                     map.put("status", 200);
  47.                     map.put("用户信息", authentication.getPrincipal());
  48.                     response.setContentType("application/json;charset=UTF-8");
  49.                     String s = new ObjectMapper().writeValueAsString(map);
  50.                     response.getWriter().println(s);
  51.                 }))
  52.                 // 认证失败处理
  53.                 .failureHandler(((request, response, exception) -> {
  54.                     HashMap<String, Object> map = new HashMap<>();
  55.                     map.put("msg", "认证失败");
  56.                     map.put("status", 500);
  57.                     map.put("异常信息", exception.getMessage());
  58.                     response.setContentType("application/json;charset=UTF-8");
  59.                     String s = new ObjectMapper().writeValueAsString(map);
  60.                     response.getWriter().println(s);
  61.                 }))
  62.                 .loginPage("/login.html");
  63.  
  64.         // 拦截
  65.         http.authorizeHttpRequests()
  66.                 .antMatchers("/login.html", "/kaptcha", "/authentication", "/refreshtoken").permitAll()
  67.                 .antMatchers("/fail.html").permitAll()    //fail.html 不需要被认证
  68.                 .antMatchers("/invalidSession.html").permitAll()
  69.                 .anyRequest().access((authenticationSupplier, requestAuthorizationContext) -> {
  70.                     Collection<? extends GrantedAuthority> authorities = authenticationSupplier.get().getAuthorities();
  71.                     String requestURI = requestAuthorizationContext.getRequest().getRequestURI();
  72.                     SimpleGrantedAuthority simpleGrantedAuthority
  73.                             = new SimpleGrantedAuthority(requestURI);
  74.                     boolean contains = authorities.contains(simpleGrantedAuthority);
  75.                     return new AuthorizationDecision(contains);
  76.                 });
  77. //                .antMatchers("/user/detail").hasAuthority("/user/**")
  78. //                .antMatchers("/index.html").hasRole("super")
  79. //                .anyRequest().authenticated();
  80.  
  81.         // 异常处理
  82.         http.exceptionHandling()
  83.                 .accessDeniedHandler(((request, response, accessDeniedException) -> {
  84.                     HashMap<String, Object> map = new HashMap<>();
  85.                     map.put("msg", "禁止访问");
  86.                     map.put("status", 403);
  87.                     map.put("异常信息", accessDeniedException.getMessage());
  88.                     response.setContentType("application/json;charset=UTF-8");
  89.                     String s = new ObjectMapper().writeValueAsString(map);
  90.                     response.getWriter().println(s);
  91.                 }));
  92.         // session管理
  93.         http.sessionManagement()
  94.                 .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
  95.                 //.invalidSessionUrl("/invalidSession.html")    //非法超时session跳转页面
  96.                 .maximumSessions(1) // 允许登录的最多用户数量
  97.                 .maxSessionsPreventsLogin(false) // true表示已经登录就不予许再次登录， false表示允许再次登录但是之前的登录账户会被踢下线
  98.                 .expiredSessionStrategy(new CustomExpiredSessionStrategy());
  99.  
  100.         /**
  101.          * 退出登录
  102.          */
  103.         http.logout().logoutSuccessHandler(((request, response, authentication) -> {
  104.             HashMap<String, Object> map = new HashMap<>();
  105.             map.put("msg", "退出成功");
  106.             map.put("status", 200);
  107.             response.setContentType("application/json;charset=UTF-8");
  108.             String s = new ObjectMapper().writeValueAsString(map);
  109.             response.getWriter().println(s);
  110.         }));
  111. //        验证码
  112.         http.addFilterBefore(captchaCodeFilter, UsernamePasswordAuthenticationFilter.class);
  113. //
  114.         /**
  115.          * 记住我
  116.          */
  117.         http.rememberMe().tokenValiditySeconds(7 * 24 * 3600);
  118. //跨域
  119.         http.csrf().disable();
  120. //        跨域
  121. //        http.cors(c -> {
  122. //            CorsConfigurationSource source = request -> {
  123. //                CorsConfiguration config = new CorsConfiguration();
  124. //                config.setAllowedOrigins(Arrays.asList("*"));
  125. //                config.setAllowedMethods(Arrays.asList("*"));
  126. //                config.addAllowedHeader("*");
  127. //                return config;
  128. //            };
  129. //            c.configurationSource(source);
  130. //        });
  131. // CSRF 跨站攻击
  132. //        http.csrf()
  133. //                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
  134. //                .ignoringAntMatchers("/authentication");
  135.     }
  136.  
  137.  
  138.  
  139.     /**
  140.      * 注入加密类
  141.      * @return
  142.      */
  143.     @Bean("passwordEncoder")
  144.     public PasswordEncoder passwordEncoder(){
  145.         return new BCryptPasswordEncoder();
  146.     }
  147.  
  148.     @Resource
  149.     private SpringUserDetailsService userDetailsService;
  150.     @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
  151.     @Override
  152.     protected AuthenticationManager authenticationManager() throws Exception {
  153.         return super.authenticationManager();
  154.     }
  155.  
  156.     @Override
  157.     protected void configure(AuthenticationManagerBuilder builder) throws Exception {
  158.         // 加密方式认证
  159.         builder.userDetailsService(userDetailsService)
  160.                 .passwordEncoder(passwordEncoder());
  161.     }
  162.  
  163. }

Controller层

  1. package com.xinzhi.controller;
  2.  
  3. import org.springframework.stereotype.Controller;
  4. import org.springframework.web.bind.annotation.GetMapping;
  5. import org.springframework.web.bind.annotation.PostMapping;
  6. import org.springframework.web.bind.annotation.RequestMapping;
  7. import org.springframework.web.bind.annotation.ResponseBody;
  8.  
  9.  
  10. @Controller
  11. @RequestMapping("/user")
  12. public class TestController {
  13.  
  14.     @RequestMapping("/hello")
  15.     @ResponseBody
  16.     public String test(){
  17.         return "security";
  18.     }
  19.  
  20.  
  21.     @RequestMapping("/index")
  22.     public String index(){
  23.         return "redirect:/index.html";
  24.     }
  25.  
  26.     @PostMapping("/fail")
  27.     public String fail(){
  28.         return "redirect:/fail.html";
  29.     }
  30.  
  31.     @GetMapping("/detail")
  32.  
  33.     public String detail(){
  34.         return "detail";
  35.     }
  36.  
  37.     @GetMapping("/add")
  38.     @ResponseBody
  39.     public String add(){
  40.         return "add";
  41.     }
  42.  
  43.     @GetMapping("/delete")
  44.     @ResponseBody
  45.     public String delete(){
  46.         return "delete";
  47.     }
  48.  
  49.  
  50.     @GetMapping("/update")
  51.     @ResponseBody
  52.     public String update(){
  53.         return "update";
  54.     }
  55.  
  56.     @GetMapping("/select")
  57.     @ResponseBody
  58.     public String select(){
  59.         return "select";
  60.     }
  61.  
  62.  
  63. }

页面

static

login.heml

  1. <!DOCTYPE html>
  2. <html lang="en">
  3. <head>
  4.     <meta charset="UTF-8">
  5.     <title>登录</title></head>
  6. <body>
  7. <!--不想要jwt是把authentication换成login就是普通的了-->
  8. <form action="/authentication" method="post">
  9.     用户名：<input type="text" name="username"/> <br>
  10.     密码： <input type="password" name="password"/> <br>
  11.     验证码：<input type="text" name="captchaCode"/><img src="/kaptcha" id="kaptcha" width="110px" height="40px"/> <br>
  12.     <input type="checkbox" name="remember-me" value="on"/>记住密码 <br>
  13.     <input type="submit" value="提交"/>
  14. </form>
  15. <script>
  16.     window.onload=function(){
  17.         var kaptchaImg = document.getElementById("kaptcha");
  18.         kaptchaImg.onclick = function(){
  19.             kaptchaImg.src = "/kaptcha?" + Math.floor(Math.random() * 100)
  20.         }
  21.     }
  22. </script>
  23. </body>
  24. </html>

templates

detail.html 退出页面

  1. <!DOCTYPE html>
  2. <html lang="en">
  3. <head>
  4.     <meta charset="UTF-8">
  5.     <title>Title</title>
  6. </head>
  7. <body>
  8. <a href="/logout" >退出</a>
  9. 详情页
  10. </body>
  11. </html>

fail.html 超时页面

  1. <!DOCTYPE html>
  2. <html lang="en">
  3. <head>
  4.   <meta charset="UTF-8">
  5.   <title>error</title>
  6. </head>
  7. <body>
  8. 操作失败，请重新登录. <a href="/login.html">跳转</a>
  9. </body>
  10. </html>

index.html

  1. <!DOCTYPE html>
  2. <html lang="en">
  3. <head>
  4.     <meta charset="UTF-8">
  5.     <title>Title</title>
  6. </head>
  7. <body>
  8.   首页
  9. </body>
  10. </html>

测试（页面上）

http://localhost:8080/login.html

记住我

在配置类里有相对应的配置类就可已了直接用就好了

在login页面里也有先对应的代码直接用就好了

退出登录

退出页面有相对应的代码

配置文件也有对应的代码

验证码

pom有对应的依赖了他的依赖是

  1. <dependency>
  2.     <groupId>com.github.penggle</groupId>
  3.     <artifactId>kaptcha</artifactId>
  4.     <version>2.3.2</version>
  5.     <exclusions>
  6.         <exclusion>
  7.             <artifactId>javax.servlet-api</artifactId>
  8.             <groupId>javax.servlet</groupId>
  9.         </exclusion>
  10.     </exclusions>
  11. </dependency>

实体类

创建一个vo

CaptchaImageVO

  1. package com.xinzhi.model.vo;
  2.  
  3. import lombok.Data;
  4.  
  5. import java.time.LocalDateTime;
  6.  
  7. /**
  8.  * 验证码的实体类
  9.  */
  10. @Data
  11. public class CaptchaImageVO {
  12.  
  13.     //验证码文字
  14.     private String code;
  15.     //验证码失效时间
  16.     private LocalDateTime expireTime;
  17.  
  18.     public CaptchaImageVO(String code, int expireAfterSeconds){
  19.         this.code = code;
  20.         this.expireTime = LocalDateTime.now().plusSeconds(expireAfterSeconds);
  21.     }
  22.  
  23.     //验证码是否失效
  24.     public boolean isExpried() {
  25.         return LocalDateTime.now().isAfter(expireTime);
  26.     }
  27.  
  28.     public String getCode() {
  29.         return code;
  30.     }
  31. }

kaptcha.properties配置文件

  1. #????????
  2. kaptcha.border=no
  3. kaptcha.border.color=105,179,90
  4. kaptcha.image.width=100
  5. kaptcha.image.height=45
  6. kaptcha.session.key=code
  7. kaptcha.textproducer.font.color=blue
  8. kaptcha.textproducer.font.size=35
  9. kaptcha.textproducer.char.length=4
  10. kaptcha.textproducer.font.names=??,??,????

配置类CaptchaConfig

  1. package com.xinzhi.config;
  2.  
  3. import com.google.code.kaptcha.impl.DefaultKaptcha;
  4. import com.google.code.kaptcha.util.Config;
  5. import org.springframework.beans.factory.annotation.Value;
  6. import org.springframework.context.annotation.Bean;
  7. import org.springframework.context.annotation.PropertySource;
  8. import org.springframework.stereotype.Component;
  9.  
  10. import java.util.Properties;
  11. //验证码的配置文件
  12. @Component
  13. @PropertySource(value = {"classpath:kaptcha.properties"})
  14. public class CaptchaConfig {
  15.  
  16.     @Value("${kaptcha.border}")
  17.     private String border;
  18.     @Value("${kaptcha.border.color}")
  19.     private String borderColor;
  20.     @Value("${kaptcha.textproducer.font.color}")
  21.     private String fontColor;
  22.     @Value("${kaptcha.image.width}")
  23.     private String imageWidth;
  24.     @Value("${kaptcha.image.height}")
  25.     private String imageHeight;
  26.     @Value("${kaptcha.textproducer.char.length}")
  27.     private String charLength;
  28.     @Value("${kaptcha.textproducer.font.names}")
  29.     private String fontNames;
  30.     @Value("${kaptcha.textproducer.font.size}")
  31.     private String fontSize;
  32.     @Value("${kaptcha.session.key}")
  33.     private String sessionKey;
  34.  
  35.     @Bean(name = "captchaProducer")
  36.     public DefaultKaptcha getKaptchaBean() {
  37.         DefaultKaptcha defaultKaptcha = new DefaultKaptcha();
  38.         Properties properties = new Properties();
  39.         properties.setProperty("kaptcha.border", border);
  40.         properties.setProperty("kaptcha.border.color", borderColor);
  41.         properties.setProperty("kaptcha.textproducer.font.color", fontColor);
  42.         properties.setProperty("kaptcha.image.width", imageWidth);
  43.         properties.setProperty("kaptcha.image.height", imageHeight);
  44.         properties.setProperty("kaptcha.session.key", sessionKey);
  45.         properties.setProperty("kaptcha.textproducer.char.length", charLength);
  46.         properties.setProperty("kaptcha.textproducer.font.names", fontNames);
  47.         properties.setProperty("kaptcha.textproducer.font.size",fontSize);
  48.         Config config = new Config(properties);
  49.         defaultKaptcha.setConfig(config);
  50.         return defaultKaptcha;
  51.     }
  52.  
  53. }

Controller层里

CaptchaController

  1. ​
  2. ​
  3. package com.xinzhi.controller;
  4.  
  5. import com.google.code.kaptcha.impl.DefaultKaptcha;
  6. import com.xinzhi.model.vo.CaptchaImageVO;
  7. import org.springframework.web.bind.annotation.RequestMapping;
  8. import org.springframework.web.bind.annotation.RequestMethod;
  9. import org.springframework.web.bind.annotation.RestController;
  10.  
  11. import javax.annotation.Resource;
  12. import javax.imageio.ImageIO;
  13. import javax.servlet.ServletOutputStream;
  14. import javax.servlet.http.HttpServletResponse;
  15. import javax.servlet.http.HttpSession;
  16. import java.awt.image.BufferedImage;
  17.  
  18. /**
  19.  * 获取验证码
  20.  */
  21. @RestController
  22. public class CaptchaController extends Throwable {
  23.  
  24.     @Resource
  25.     DefaultKaptcha captchaProducer;
  26.     /**
  27.      * 获取验证码
  28.      */
  29.     @RequestMapping(value = "/kaptcha", method = RequestMethod.GET)
  30.     public void kaptcha(HttpSession session, HttpServletResponse response) throws Exception {
  31.  
  32.         response.setDateHeader("Expires", 0);
  33.         response.setHeader("Cache-Control", "no-store, no-cache, must-revalidate");
  34.         response.addHeader("Cache-Control", "post-check=0, pre-check=0");
  35.         response.setHeader("Pragma", "no-cache");
  36.         response.setContentType("image/jpeg");
  37.  
  38.         String capText = captchaProducer.createText();
  39.         System.out.println(capText);
  40.         CaptchaImageVO captchaImageVO = new CaptchaImageVO(capText,2 * 60);
  41.         //将验证码存到session
  42.         session.setAttribute("code", capText);
  43.         //将图片返回给前端
  44.         try(ServletOutputStream out = response.getOutputStream();) {
  45.             BufferedImage bi = captchaProducer.createImage(capText);
  46.             ImageIO.write(bi, "jpg", out);
  47.             out.flush();
  48.         }//使用try-with-resources不用手动关闭流
  49.     }
  50. }
  51.  
  52. ​
  53.  
  54. ​

创建一个Filter包

  1. package com.xinzhi.filter;
  2.  
  3. import com.alibaba.druid.util.StringUtils;
  4. import com.fasterxml.jackson.databind.ObjectMapper;
  5. import org.springframework.stereotype.Component;
  6. import org.springframework.web.bind.ServletRequestBindingException;
  7. import org.springframework.web.bind.ServletRequestUtils;
  8. import org.springframework.web.context.request.ServletWebRequest;
  9. import org.springframework.web.filter.OncePerRequestFilter;
  10.  
  11. import javax.servlet.FilterChain;
  12. import javax.servlet.ServletException;
  13. import javax.servlet.http.HttpServletRequest;
  14. import javax.servlet.http.HttpServletResponse;
  15. import javax.servlet.http.HttpSession;
  16. import java.io.IOException;
  17. import java.util.HashMap;
  18.  
  19. /**
  20.  * 验证码
  21.  */
  22. @Component
  23. public class CaptchaCodeFilter extends OncePerRequestFilter {
  24.  
  25.     @Override
  26.     protected void doFilterInternal(HttpServletRequest request,
  27.                                     HttpServletResponse response,
  28.                                     FilterChain filterChain)
  29.             throws ServletException, IOException {
  30.         // 必须是登录的post请求才能进行验证，其他的直接放行
  31.         if(StringUtils.equals("/login",request.getRequestURI())
  32.                 && StringUtils.equalsIgnoreCase(request.getMethod(),"post")){
  33.  
  34.             //1.验证谜底与用户输入是否匹配
  35.             if (!validate(new ServletWebRequest(request), response)){
  36.                 return;
  37.             }
  38.         }
  39.         //通过校验，就放行
  40.         filterChain.doFilter(request,response);
  41.  
  42.     }
  43.  
  44.     private Boolean validate(ServletWebRequest request,HttpServletResponse response) throws ServletRequestBindingException, IOException {
  45.  
  46.         HttpSession session = request.getRequest().getSession();
  47.         //获取用户登录界面输入的captchaCode
  48.         String codeInRequest = ServletRequestUtils.getStringParameter(
  49.                 request.getRequest(),"captchaCode");
  50.         if(StringUtils.isEmpty(codeInRequest)){
  51.             HashMap<String, Object> map = new HashMap<>();
  52.             map.put("msg", "验证码不能为空");
  53.             map.put("status", 500);
  54.             response.setContentType("application/json;charset=UTF-8");
  55.             String s = new ObjectMapper().writeValueAsString(map);
  56.             response.getWriter().println(s);
  57.             return false;
  58.         }
  59.  
  60.         // 获取session池中的验证码谜底
  61.         String codeInSession = (String)
  62.                 session.getAttribute("code");
  63.         // 请求验证码校验
  64.         if(!StringUtils.equals(codeInSession, codeInRequest)) {
  65.             HashMap<String, Object> map = new HashMap<>();
  66.             map.put("msg", "验证码不匹配");
  67.             map.put("status", 500);
  68.             response.setContentType("application/json;charset=UTF-8");
  69.             String s = new ObjectMapper().writeValueAsString(map);
  70.             response.getWriter().println(s);
  71.             return false;
  72.         }
  73.         return true;
  74.     }
  75. }

过滤器替换 前端代码对应的里面都有不用在添加了

9 配置类中验证码路径放行

.antMatchers("/login.html", "/fail.html", "/invalidSession.html","/kaptcha").permitAll()

也有这段代码

整合JTW

  • 引入依赖 不用管也有配置类里

  1. <dependency>
  2.     <groupId>io.jsonwebtoken</groupId>
  3.     <artifactId>jjwt</artifactId>
  4.     <version>0.9.0</version>
  5. </dependency>

 工具类

  1. package com.xinzhi.utils;
  2.  
  3. import io.jsonwebtoken.Claims;
  4. import io.jsonwebtoken.Jwts;
  5. import io.jsonwebtoken.SignatureAlgorithm;
  6. import lombok.Data;
  7. import org.springframework.security.core.userdetails.UserDetails;
  8. import org.springframework.stereotype.Component;
  9.  
  10. import java.util.Date;
  11. import java.util.HashMap;
  12. import java.util.Map;
  13.  
  14. @Data
  15. @Component
  16. public class JwtTokenUtil {
  17.     private String secret="xinzhi";
  18.     private Long expiration=3600000L;
  19.     private String header="JWTHeaderName";
  20.  
  21.  
  22.     /**
  23.      * 生成token令牌
  24.      *
  25.      * @param userDetails 用户
  26.      * @return 令token牌
  27.      */
  28.     public String generateToken(UserDetails userDetails) {
  29.         Map<String, Object> claims = new HashMap<>(2);
  30.         //获取用户名
  31.         claims.put("sub", userDetails.getUsername());
  32.         // 创建时间
  33.         claims.put("created", new Date());
  34.         return generateToken(claims);
  35.     }
  36.  
  37.     /**
  38.      * 从令牌中获取用户名
  39.      *
  40.      * @param token 令牌
  41.      * @return 用户名
  42.      */
  43.     public String getUsernameFromToken(String token) {
  44.         String username;
  45.         try {
  46.             Claims claims = getClaimsFromToken(token);
  47.             username = claims.getSubject();
  48.         } catch (Exception e) {
  49.             username = null;
  50.         }
  51.         return username;
  52.     }
  53.  
  54.     /**
  55.      * 判断令牌是否过期
  56.      *
  57.      * @param token 令牌
  58.      * @return 是否过期
  59.      */
  60.     public Boolean isTokenExpired(String token) {
  61.         try {
  62.             Claims claims = getClaimsFromToken(token);
  63.             Date expiration = claims.getExpiration();
  64.             return expiration.before(new Date());
  65.         } catch (Exception e) {
  66.             return false;
  67.         }
  68.     }
  69.  
  70.     /**
  71.      * 刷新令牌
  72.      *
  73.      * @param token 原令牌
  74.      * @return 新令牌
  75.      */
  76.     public String refreshToken(String token) {
  77.         String refreshedToken;
  78.         try {
  79.             Claims claims = getClaimsFromToken(token);
  80.             claims.put("created", new Date());
  81.             refreshedToken = generateToken(claims);
  82.         } catch (Exception e) {
  83.             refreshedToken = null;
  84.         }
  85.         return refreshedToken;
  86.     }
  87.  
  88.     /**
  89.      * 验证令牌
  90.      *
  91.      * @param token       令牌
  92.      * @param userDetails 用户
  93.      * @return 是否有效
  94.      */
  95.     public Boolean validateToken(String token, UserDetails userDetails) {
  96.         String username = getUsernameFromToken(token);
  97.         return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
  98.     }
  99.  
  100.  
  101.     /**
  102.      * 从claims生成令牌
  103.      *
  104.      * @param claims 数据声明
  105.      * @return 令牌
  106.      */
  107.     private String generateToken(Map<String, Object> claims) {
  108.         Date expirationDate = new Date(System.currentTimeMillis() + expiration);
  109.         return Jwts.builder().setClaims(claims)
  110.                 .setExpiration(expirationDate)
  111.                 .signWith(SignatureAlgorithm.HS512, secret)
  112.                 .compact();
  113.     }
  114.  
  115.     /**
  116.      * 从令牌中获取数据声明
  117.      *
  118.      * @param token 令牌
  119.      * @return 数据声明
  120.      */
  121.     private Claims getClaimsFromToken(String token) {
  122.         Claims claims;
  123.         try {
  124.             claims = Jwts.parser().setSigningKey(secret).parseClaimsJws(token).getBody();
  125.         } catch (Exception e) {
  126.             claims = null;
  127.         }
  128.         return claims;
  129.     }
  130.  
  131. }

 异常

创建一个exception包

  1. package com.xinzhi.exception;
  2.  
  3. /**
  4.  * jwt异常
  5.  */
  6.  
  7. public class CustomException extends RuntimeException {
  8.     //异常错误编码
  9.     private int code ;
  10.     //异常信息
  11.     private String message;
  12.  
  13.     private CustomException(){}
  14.  
  15.     public CustomException(int code, String message) {
  16.         this.code = code;
  17.         this.message = message;
  18.     }
  19.  
  20.     public int getCode() {
  21.         return code;
  22.     }
  23.  
  24.     @Override
  25.     public String getMessage() {
  26.         return message;
  27.     }
  28. }

service

JwtAuthService

  1. package com.xinzhi.service;
  2.  
  3. import com.xinzhi.exception.CustomException;
  4. import com.xinzhi.utils.JwtTokenUtil;
  5. import org.springframework.security.authentication.AuthenticationManager;
  6. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  7. import org.springframework.security.core.Authentication;
  8. import org.springframework.security.core.AuthenticationException;
  9. import org.springframework.security.core.context.SecurityContextHolder;
  10. import org.springframework.security.core.userdetails.UserDetails;
  11. import org.springframework.security.core.userdetails.UserDetailsService;
  12. import org.springframework.stereotype.Service;
  13.  
  14. import javax.annotation.Resource;
  15.  
  16. @Service
  17. public class JwtAuthService {
  18.  
  19.     @Resource
  20.     private AuthenticationManager authenticationManager;
  21.     @Resource
  22.     private UserDetailsService userDetailsService;
  23.     @Resource
  24.     private JwtTokenUtil jwtTokenUtil;
  25.  
  26.     public UserDetails login(String username, String password) throws CustomException {
  27.         try{
  28.  
  29.             // 通过手机号查到用户信息
  30.  
  31.             //使用用户名密码进行登录验证
  32.             UsernamePasswordAuthenticationToken upToken =
  33.                     new UsernamePasswordAuthenticationToken(username, password);
  34.             Authentication authentication = authenticationManager.authenticate(upToken);
  35.             SecurityContextHolder.getContext().setAuthentication(authentication);
  36.         }catch(AuthenticationException e){
  37.             throw new CustomException(500, "用户名或密码不正确");
  38.         }
  39.  
  40.         //返回了一个用户信息
  41.         UserDetails userDetails = userDetailsService.loadUserByUsername( username );
  42.         return userDetails;
  43.  
  44.     }
  45.  
  46.     public String refreshToken(String oldToken) {
  47.         if (!jwtTokenUtil.isTokenExpired(oldToken)) {
  48.             return jwtTokenUtil.refreshToken(oldToken);
  49.         }
  50.         return null;
  51.     }
  52. }

Controller

  1. package com.xinzhi.controller;
  2.  
  3. import com.google.code.kaptcha.impl.DefaultKaptcha;
  4. import com.xinzhi.model.vo.CaptchaImageVO;
  5. import org.springframework.web.bind.annotation.RequestMapping;
  6. import org.springframework.web.bind.annotation.RequestMethod;
  7. import org.springframework.web.bind.annotation.RestController;
  8.  
  9. import javax.annotation.Resource;
  10. import javax.imageio.ImageIO;
  11. import javax.servlet.ServletOutputStream;
  12. import javax.servlet.http.HttpServletResponse;
  13. import javax.servlet.http.HttpSession;
  14. import java.awt.image.BufferedImage;
  15.  
  16. /**
  17.  * 获取验证码
  18.  */
  19. @RestController
  20. public class CaptchaController extends Throwable {
  21.  
  22.     @Resource
  23.     DefaultKaptcha captchaProducer;
  24.     /**
  25.      * 获取验证码
  26.      */
  27.     @RequestMapping(value = "/kaptcha", method = RequestMethod.GET)
  28.     public void kaptcha(HttpSession session, HttpServletResponse response) throws Exception {
  29.  
  30.         response.setDateHeader("Expires", 0);
  31.         response.setHeader("Cache-Control", "no-store, no-cache, must-revalidate");
  32.         response.addHeader("Cache-Control", "post-check=0, pre-check=0");
  33.         response.setHeader("Pragma", "no-cache");
  34.         response.setContentType("image/jpeg");
  35.  
  36.         String capText = captchaProducer.createText();
  37.         System.out.println(capText);
  38.         CaptchaImageVO captchaImageVO = new CaptchaImageVO(capText,2 * 60);
  39.         //将验证码存到session
  40.         session.setAttribute("code", capText);
  41.         //将图片返回给前端
  42.         try(ServletOutputStream out = response.getOutputStream();) {
  43.             BufferedImage bi = captchaProducer.createImage(capText);
  44.             ImageIO.write(bi, "jpg", out);
  45.             out.flush();
  46.         }//使用try-with-resources不用手动关闭流
  47.     }
  48. }

Filter

  1. package com.xinzhi.filter;
  2.  
  3.  
  4. import com.xinzhi.service.SpringUserDetailsService;
  5. import com.xinzhi.utils.JwtTokenUtil;
  6. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  7. import org.springframework.security.core.Authentication;
  8. import org.springframework.security.core.context.SecurityContextHolder;
  9. import org.springframework.security.core.userdetails.UserDetails;
  10. import org.springframework.stereotype.Component;
  11. import org.springframework.util.StringUtils;
  12. import org.springframework.web.filter.OncePerRequestFilter;
  13.  
  14. import javax.annotation.Resource;
  15. import javax.servlet.FilterChain;
  16. import javax.servlet.ServletException;
  17. import javax.servlet.http.HttpServletRequest;
  18. import javax.servlet.http.HttpServletResponse;
  19. import java.io.IOException;
  20.  
  21. /**
  22.  * jwt
  23.  */
  24. @Component
  25. public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
  26.  
  27.     @Resource
  28.     private SpringUserDetailsService myUserDetailsService;
  29.  
  30.     @Resource
  31.     private JwtTokenUtil jwtTokenUtil;
  32.  
  33.     @Override
  34.     protected void doFilterInternal(HttpServletRequest request,
  35.                                     HttpServletResponse response,
  36.                                     FilterChain filterChain)
  37.             throws ServletException, IOException {
  38.         String jwtToken = request.getHeader(jwtTokenUtil.getHeader());
  39.         if(!StringUtils.isEmpty(jwtToken)){
  40.             String username = jwtTokenUtil.getUsernameFromToken(jwtToken);
  41.             Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
  42.             //如果可以正确的从JWT中提取用户信息，并且该用户未被授权
  43.             if(username != null){
  44.                 UserDetails userDetails = myUserDetailsService.loadUserByUsername(username);
  45.                 if(jwtTokenUtil.validateToken(jwtToken,userDetails)){
  46.                     //给使用该JWT令牌的用户进行授权
  47.                     UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(userDetails,null, userDetails.getAuthorities());
  48.                     SecurityContextHolder.getContext().setAuthentication(authenticationToken);
  49.                 }
  50.             }
  51.         }
  52.         filterChain.doFilter(request,response);
  53.  
  54.     }
  55. }

后台日志记录

依赖 已经有了

  1. <dependency>
  2.             <groupId>org.aspectj</groupId>
  3.             <artifactId>aspectjweaver</artifactId>
  4.             <version>1.8.13</version>
  5.         </dependency>

 代码

  1. package com.xinzhi.aspest;
  2.  
  3. import com.xinzhi.model.User;
  4. import lombok.Data;
  5. import org.aspectj.lang.JoinPoint;
  6. import org.aspectj.lang.annotation.*;
  7. import org.slf4j.Logger;
  8. import org.slf4j.LoggerFactory;
  9. import org.springframework.security.core.context.SecurityContextHolder;
  10. import org.springframework.stereotype.Component;
  11. import org.springframework.web.context.request.RequestContextHolder;
  12. import org.springframework.web.context.request.ServletRequestAttributes;
  13.  
  14. import javax.servlet.http.HttpServletRequest;
  15. import java.util.Arrays;
  16.  
  17. @Component("myAspect")
  18. @Aspect
  19. @Data
  20. public class MyAspect {
  21. //    打印日志
  22.  
  23.     private final static Logger logger= LoggerFactory.getLogger(MyAspect.class);
  24.  
  25.     //@Before指在切点方法之前执行,也就是在Controller层方法执行之前执行,这里可以通过JoinPoint获取一些有关方法的信息,在这里也可以修改参数的值
  26.  
  27.     //@Before()括号里设置的是切点方法的名称
  28.     @Before("execution(public * com.xinzhi.controller..*.*(..))")
  29.     public void doBefore(JoinPoint joinPoint) throws Throwable {
  30.         // 接收到请求，记录请求内容
  31.         ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
  32.         HttpServletRequest request = attributes.getRequest();
  33.         Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
  34.         if(principal.equals("anonymousUser")){
  35.             logger.info("匿名用户");
  36.             return;
  37.         }
  38.         User user =(User)(principal);
  39.         // 记录下请求内容
  40.         logger.info("URL : " + request.getRequestURI().toString());
  41.         logger.info("HTTP_METHOD : " + request.getMethod());
  42.         logger.info("IP : " + request.getRemoteAddr());
  43.         logger.info("CLASS_METHOD : " + joinPoint.getSignature().getDeclaringTypeName() + "." + joinPoint.getSignature().getName());
  44.         logger.info("ARGS : " + Arrays.toString(joinPoint.getArgs()));
  45.         logger.info("用户 : " + user.getUsername());
  46.     }
  47.  
  48. }

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/笔触狂放9/article/detail/885755
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号