devbox
运维做开发
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

SpringBoot SpringSecurity JWT+Redis+RSA授权登录登出 验证码 前后端分离 分布式_spring-security-rsa

作者：运维做开发 | 2024-08-08 13:32:05

赞

踩

spring-security-rsa

目录

一、案例前的准备

1、RSA公钥私钥生成

2、JWT通过RSA算法签发

3、Redis的配置

4、FastJson配置

5、用户表与实体类

6、统一返回对象

7、常量类

8、图片验证码的使用

9、雪花算法生成唯一id

10、web渲染工具类

二、SpringSecurity的配置

1、SpringSecurity配置类

2、SpringSecurity异常处理器

三、JWT+SpringSecurity实现登录的主要步骤

1、登录图解

2、登录开始前首先创建UserDetails实体类的子类

3、创建UserDetailsService的实现类

4、登录的实现类与接口

5、认证过滤器

四、测试

1、登录测试

 2、资源访问测试

 3、退出登录

 五、案例源码链接

一、案例前的准备

1、RSA公钥私钥生成

第一步：生成密钥

通过keyTool（java提供的证书管理工具）生成
只要安装了JDK，就有这个工具。进入jdk的安装目录，就能使用该工具：

输入以下命令生成私钥：

  1. // 以下指令为一行，设置多行是方便阅读
  2. keytool -genkeypair 
  3. -alias 密钥别名 
  4. -keyalg 使用的算法 
  5. -keypass 密钥的访问密码 
  6. -keystore 生成的密钥库文件名，扩展名是jks
  7. -storepass 密钥库的访问密码，用来打开jks文件

此时私钥已生成：

 

第二步：生成公钥 

对于微服务来说，私钥放在认证服务上，其他服务只需要存公钥即可。因为其他服务只做校验，不加密JWT。私钥加密，公钥解密。

生成公钥输入以下命令：

keytool -list -rfc --keystore jks文件(包含扩展名.jks) | openssl x509 -inform pem -pubkey

复制文本，重命名文件

 

 公钥和私钥放到服务器上，私钥用于授权服务器授权token时加密，其他服务器仅需要通过公钥便可对加密内容进行解析了。

2、JWT通过RSA算法签发

这里需要添加依赖：

  1.         <dependency>
  2.             <groupId>io.jsonwebtoken</groupId>
  3.             <artifactId>jjwt</artifactId>
  4.             <version>0.9.1</version>
  5.         </dependency>
  6.         <dependency>
  7.             <groupId>org.springframework.security</groupId>
  8.             <artifactId>spring-security-rsa</artifactId>
  9.             <version>1.0.11.RELEASE</version>
  10.         </dependency>

 JWT工具类：

  1. package com.dragonwu.utils;
  2.  
  3. import com.dragonwu.model.OnlineUser;
  4. import io.jsonwebtoken.JwtBuilder;
  5. import io.jsonwebtoken.Jwts;
  6. import io.jsonwebtoken.SignatureAlgorithm;
  7. import org.springframework.core.io.ClassPathResource;
  8. import org.springframework.core.io.Resource;
  9. import org.springframework.security.core.context.SecurityContextHolder;
  10. import org.springframework.security.rsa.crypto.KeyStoreKeyFactory;
  11.  
  12. import java.io.BufferedReader;
  13. import java.io.InputStreamReader;
  14. import java.security.KeyFactory;
  15. import java.security.KeyPair;
  16. import java.security.PrivateKey;
  17. import java.security.PublicKey;
  18. import java.security.spec.X509EncodedKeySpec;
  19. import java.util.Base64;
  20. import java.util.Date;
  21. import java.util.Map;
  22. import java.util.Objects;
  23.  
  24. /**
  25.  * 通过RSA非对称加密的JWT工具类
  26.  *
  27.  * @author DragonWu
  28.  * @date 2022-10-06 17:51
  29.  **/
  30. public class JwtUtil {
  31.  
  32.     //默认60分钟
  33.     public static final Long DEFAULT_EXPIRE_MINUTES = 60L;
  34.  
  35.     //jwt的唯一标识，一般为username或userId
  36.     public static final String JWT_PRIMARY_KEY = "userId";
  37.  
  38.     //私钥路径
  39.     public static final String PRIVATE_KEY_PATH = "/keys/dragonwu.jks";
  40.     //公钥路径
  41.     public static final String PUBLIC_KEY_PATH = "/keys/public.key";
  42.  
  43.     //私钥
  44.     public static PrivateKey privateKey;
  45.     //公钥
  46.     public static PublicKey publicKey;
  47.  
  48.     /**
  49.      * 传入的数据不得含敏感信息，否则可能被盗用，私钥加密token
  50.      *
  51.      * @param claims  数据体
  52.      * @param minutes 过期时间，分
  53.      * @return String   JWT的token
  54.      */
  55.     public static String createJwt(Map<String, Object> claims, long minutes) {
  56.         //获取私钥
  57.         if (Objects.isNull(privateKey)) {
  58.             privateKey = getPrivateKey();
  59.         }
  60.  
  61.         //当前系统时间
  62.         long now = System.currentTimeMillis();
  63.         //过期时间
  64.         long exp = now + minutes * 60 * 1000;
  65.  
  66.         JwtBuilder jwtBuilder = Jwts.builder()
  67.                 //签发的算法
  68.                 .signWith(SignatureAlgorithm.RS256, privateKey)
  69.                 //设置令牌过期时间
  70.                 .setExpiration(new Date(exp))
  71.                 //设置签发时间
  72.                 .setIssuedAt(new Date())
  73.                 //设置body数据，自定义设置
  74.                 .setClaims(claims);
  75.         return jwtBuilder.compact();
  76.     }
  77.  
  78.     /**
  79.      * 公钥解析jwt
  80.      *
  81.      * @param jwt jwt字符串
  82.      * @return 返回null证明解析异常
  83.      */
  84.     public static Map<String, Object> parseJwt(String jwt) {
  85.         if (Objects.isNull(publicKey)) {
  86.             publicKey = getPublicKey();
  87.         }
  88.  
  89.         try {
  90.             return Jwts.parser().setSigningKey(publicKey).parseClaimsJws(jwt).getBody();
  91.         } catch (Exception ignored) {
  92.         }
  93.         return null;
  94.     }
  95.  
  96.     /**
  97.      * 获取私钥
  98.      *
  99.      * @return 当获取异常时返回null
  100.      */
  101.     private static PrivateKey getPrivateKey() {
  102.         try {
  103.             ClassPathResource keyFileResource = new ClassPathResource(PRIVATE_KEY_PATH);
  104.             //创建秘钥工厂，参数为：秘钥文件、秘钥库密码
  105.             //import org.springframework.security.rsa.crypto.KeyStoreKeyFactory;
  106.             //pom文件：
  107.             /*
  108.              公钥私钥生成 https://blog.csdn.net/qq_37470815/article/details/123027798
  109.              <dependency>
  110.              <groupId>org.springframework.security</groupId>
  111.              <artifactId>spring-security-rsa</artifactId>
  112.              <version>1.0.11.RELEASE</version>
  113.              </dependency>
  114.              KeyStoreKeyFactory keyStoreKeyFactory = new KeyStoreKeyFactory(keyFileResource, "密钥库密码password".toCharArray());
  115.              //获取秘钥，参数为：别名，秘钥密码
  116.              KeyPair keyContent = keyStoreKeyFactory.getKeyPair("alias别名", "秘钥的密码".toCharArray());
  117.              */
  118.             KeyStoreKeyFactory keyStoreKeyFactory = new KeyStoreKeyFactory(keyFileResource, "dragonwu".toCharArray());
  119.             KeyPair keyContent = keyStoreKeyFactory.getKeyPair("dragonwu", "dragonwu".toCharArray());
  120.             return keyContent.getPrivate();
  121.         } catch (Exception ignored) {
  122.         }
  123.         return null;
  124.     }
  125.  
  126.     /**
  127.      * 获取公钥
  128.      *
  129.      * @return 当获取异常时返回null
  130.      */
  131.     private static PublicKey getPublicKey() {
  132.         try {
  133.             Resource publicKey = new ClassPathResource(PUBLIC_KEY_PATH);
  134.             InputStreamReader publicKeyIs = new InputStreamReader(publicKey.getInputStream());
  135.             BufferedReader publicKeyBr = new BufferedReader(publicKeyIs);
  136.             StringBuilder publicKeySb = new StringBuilder();
  137.             String line;
  138.             //将文件中的多行变为一行
  139.             while ((line = publicKeyBr.readLine()) != null) {
  140.                 publicKeySb.append(line);
  141.             }
  142.  
  143.             //将String转换成java的PublicKey对象
  144.             byte[] byteKey = Base64.getDecoder().decode(publicKeySb.toString());
  145.             X509EncodedKeySpec x509EncodedKeySpec = new X509EncodedKeySpec(byteKey);
  146.             KeyFactory keyFactory = KeyFactory.getInstance("RSA");
  147.             return keyFactory.generatePublic(x509EncodedKeySpec);
  148.         } catch (Exception ignored) {
  149.         }
  150.         return null;
  151.     }
  152.  
  153.     /*
  154.     SpringSecurity登录后获取用户信息
  155.      */
  156.     public static OnlineUser getUser() {
  157.         return (OnlineUser) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
  158.     }
  159.  
  160. }

3、Redis的配置

引入依赖：

  1.         <dependency>
  2.             <groupId>org.springframework.boot</groupId>
  3.             <artifactId>spring-boot-starter-data-redis</artifactId>
  4.         </dependency>

redis配置类：

  1. @Configuration
  2. public class RedisConfig {
  3.     @Bean
  4.     public RedisTemplate<String, Object> redisTemplate(RedisConnectionFactory connectionFactory) {
  5.         // 创建 RedisTemplate 对象
  6.         RedisTemplate<String, Object> redisTemplate = new RedisTemplate<>();
  7.         // 设置连接工厂
  8.         redisTemplate.setConnectionFactory(connectionFactory);
  9.         // 设置 Key 的序列化 - String 序列化 RedisSerializer.string() => StringRedisSerializer.UTF_8
  10.         redisTemplate.setKeySerializer(RedisSerializer.string());
  11.         redisTemplate.setHashKeySerializer(RedisSerializer.string());
  12.         // 设置 Value 的序列化 - JSON 序列化 RedisSerializer.json() => GenericJackson2JsonRedisSerializer
  13.         redisTemplate.setValueSerializer(RedisSerializer.json());
  14.         redisTemplate.setHashValueSerializer(RedisSerializer.json());
  15.         // 返回
  16.         return redisTemplate;
  17.     }
  18. }

redis工具类：

  1. @Component
  2. public class RedisUtil {
  3.  
  4.     @Autowired
  5.     private RedisTemplate<String, Object> redisTemplate;
  6.  
  7.     /*
  8.     设置对象
  9.      */
  10.     public void setObject(String key, Object object, long time, TimeUnit timeUnit) {
  11.         try {
  12.             redisTemplate.opsForValue().set(key, object, time, timeUnit);
  13.         } catch (Exception e) {
  14.             e.printStackTrace();
  15.         }
  16.     }
  17.  
  18.     /*
  19.     获取对象
  20.      */
  21.     public Object getObject(String key) {
  22.         try {
  23.             return redisTemplate.opsForValue().get(key);
  24.         } catch (Exception e) {
  25.             e.printStackTrace();
  26.             return null;
  27.         }
  28.     }
  29.  
  30.     /*
  31.     删除对象
  32.      */
  33.     public void deleteObject(String key) {
  34.         try {
  35.             redisTemplate.delete(key);
  36.         } catch (Exception e) {
  37.             e.printStackTrace();
  38.         }
  39.     }
  40.  
  41. }

4、FastJson配置

引入依赖：

  1.         <dependency>
  2.             <groupId>com.alibaba</groupId>
  3.             <artifactId>fastjson</artifactId>
  4.             <version>2.0.9</version>
  5.         </dependency>

fastJson配置类：

  1. @Configuration
  2. public class MyFastJsonConfig {
  3.     @Bean
  4.     public HttpMessageConverters fastJsonHttpMessageConverters() {
  5.         FastJsonHttpMessageConverter fastConverter = new FastJsonHttpMessageConverter();
  6.         FastJsonConfig fastJsonConfig = new FastJsonConfig();
  7.         fastJsonConfig.setSerializerFeatures(SerializerFeature.PrettyFormat);
  8.         fastConverter.setFastJsonConfig(fastJsonConfig);
  9.         return new HttpMessageConverters((HttpMessageConverter<?>) fastConverter);
  10.     }
  11.  
  12. }

5、用户表与实体类

  1. CREATE TABLE `sys_user` (
  2.   `user_id` bigint(20) NOT NULL AUTO_INCREMENT COMMENT '用户ID',
  3.   `user_name` varchar(30) NOT NULL COMMENT '用户账号',
  4.   `password` varchar(100) DEFAULT '' COMMENT '密码'
  5.   PRIMARY KEY (`user_id`) USING BTREE
  6. ) ;

实体类:

  1. @Data
  2. @TableName("sys_user")
  3. public class SysUser implements Serializable {
  4.     @TableId(value = "user_id")
  5.     private Long userId;
  6.  
  7.     private String userName;
  8.  
  9.     //对该字段不进行序列化
  10.     @JSONField(serialize = false)
  11.     private String password;
  12. }

登录成功返回该前端的对象：

  1. @Data
  2. @NoArgsConstructor
  3. @AllArgsConstructor
  4. public class LoginVo implements Serializable {
  5.     //用户对象
  6.     private SysUser sysUser;
  7.  
  8.     //用户权限
  9.     private List<String> authorities;
  10.  
  11.     //JWT token
  12.     private String token;
  13. }

6、统一返回对象

  1. package com.dragonwu.model;
  2.  
  3. import com.dragonwu.constant.Constants;
  4.  
  5. import java.io.Serializable;
  6.  
  7. public class R<T> implements Serializable {
  8.  
  9.     private static final long serialVersionUID = 1L;
  10.  
  11.     /**
  12.      * 成功
  13.      */
  14.     public static final int SUCCESS = Constants.SUCCESS;
  15.  
  16.     /**
  17.      * 失败
  18.      */
  19.     public static final int FAIL = Constants.FAIL;
  20.  
  21.     private int code;//状体码
  22.  
  23.     private String msg;//信息
  24.  
  25.     private T data;//数据
  26.  
  27.     public static <T> R<T> ok() {
  28.         return restResult(null, SUCCESS, null);
  29.     }
  30.  
  31.     public static <T> R<T> ok(T data) {
  32.         return restResult(data, SUCCESS, null);
  33.     }
  34.  
  35.     public static <T> R<T> ok(T data, String msg) {
  36.         return restResult(data, SUCCESS, msg);
  37.     }
  38.  
  39.     public static <T> R<T> fail() {
  40.         return restResult(null, FAIL, null);
  41.     }
  42.  
  43.     public static <T> R<T> fail(String msg) {
  44.         return restResult(null, FAIL, msg);
  45.     }
  46.  
  47.     public static <T> R<T> fail(T data) {
  48.         return restResult(data, FAIL, null);
  49.     }
  50.  
  51.     public static <T> R<T> fail(T data, String msg) {
  52.         return restResult(data, FAIL, msg);
  53.     }
  54.  
  55.     public static <T> R<T> fail(int code, String msg) {
  56.         return restResult(null, code, msg);
  57.     }
  58.  
  59.     public static <T> R<T> restResult(T data, int code, String msg) {
  60.         R<T> apiResult = new R<>();
  61.         apiResult.setCode(code);
  62.         apiResult.setData(data);
  63.         apiResult.setMsg(msg);
  64.         return apiResult;
  65.     }
  66.  
  67.     public int getCode() {
  68.         return code;
  69.     }
  70.  
  71.     public void setCode(int code) {
  72.         this.code = code;
  73.     }
  74.  
  75.     public String getMsg() {
  76.         return msg;
  77.     }
  78.  
  79.     public void setMsg(String msg) {
  80.         this.msg = msg;
  81.     }
  82.  
  83.     public T getData() {
  84.         return data;
  85.     }
  86.  
  87.     public void setData(T data) {
  88.         this.data = data;
  89.     }
  90. }

7、常量类

  1. package com.dragonwu.constant;
  2.  
  3. /**
  4.  * @author DragonWu
  5.  * @since 2022-10-07 19:21
  6.  **/
  7. public interface Constants {
  8.     /*
  9.      成功
  10.      */
  11.     Integer SUCCESS = 200;
  12.  
  13.     /*
  14.      失败
  15.      */
  16.     Integer FAIL = 500;
  17.  
  18.     /*
  19.     redis的统一前缀
  20.      */
  21.     String REDIS_PRE = "DragonWu:";
  22.  
  23.     /*
  24.     redis的登录用户前缀
  25.      */
  26.     String ONLINE_PRE = REDIS_PRE + "online:";
  27.  
  28.     /*
  29.      登录
  30.      */
  31.     String LOGIN_OK = "登录成功";
  32.     String LOGIN_FAIL = "登录失败";
  33.     String LOGOUT_OK = "登出成功";
  34.     String LOGOUT_FAIL = "登出失败";
  35.     String LOGIN_ERROR = "用户名或密码错误";
  36.  
  37.     /*
  38.     获取资源
  39.      */
  40.     String GET_RESOURCE_OK = "获取成功";
  41.     String GET_RESOURCE_FAIL = "获取失败";
  42.  
  43.  
  44. }

8、图片验证码的使用

依赖引入:

  1.         <!--验证码-->
  2.         <dependency>
  3.             <groupId>com.github.whvcse</groupId>
  4.             <artifactId>easy-captcha</artifactId>
  5.             <version>1.6.2</version>
  6.         </dependency>

服务层接口：

  1. package com.dragonwu.service;
  2.  
  3. import com.dragonwu.constant.Constants;
  4.  
  5. import java.io.IOException;
  6. import java.util.Map;
  7.  
  8. /**
  9.  * 验证码类
  10.  * https://github.com/whvcse/EasyCaptcha
  11.  */
  12. public interface EasyCaptchaService {
  13.     /*
  14.      验证码宽度
  15.      */
  16.     Integer CAPTCHA_WIDTH = 130;
  17.  
  18.     /*
  19.     验证码高度
  20.      */
  21.     Integer CAPTCHA_HEIGHT = 48;
  22.     /*
  23.      验证码长度
  24.      */
  25.     Integer CAPTCHA_LENGTH = 4;
  26.  
  27.     /*
  28.      验证码类型: 默认图片
  29.      */
  30.     int CAPTCHA_TYPE_DEFAULT_PNG = 10;
  31.     /*
  32.      验证码类型: 动态GIF
  33.      */
  34.     final int CAPTCHA_TYPE_GIF = 20;
  35.     /*
  36.      验证码类型: 中文
  37.      */
  38.     final int CAPTCHA_TYPE_CHINESE = 30;
  39.     /*
  40.      验证码类型: 动态中文
  41.      */
  42.     final int CAPTCHA_TYPE_GIF_CHINESE = 40;
  43.     /*
  44.      验证码类型: 算术
  45.      */
  46.     final int CAPTCHA_TYPE_ARITHMETIC = 50;
  47.  
  48.     /*
  49.      验证码缓存key前缀
  50.      */
  51.     String CAPTCHA_KEY_PRE = Constants.REDIS_PRE + "captcha:";
  52.     /*
  53.      验证码图片键名
  54.      */
  55.     String IMAGE = "image";
  56.     /*
  57.      验证码UUID键名
  58.      */
  59.     String UUID = "uuid";
  60.     /*
  61.      验证码缓存时间,分
  62.      */
  63.     Integer CAPTCHA_CACHE_TIME = 3;
  64.  
  65.     /**
  66.      * 生成普通图片验证码
  67.      *
  68.      * @param type 验证码类型
  69.      * @return Map 验证码值，和base64转换的图片
  70.      */
  71.     Map<String, String> outputCaptchaImg(Integer type) throws IOException;
  72.  
  73.     /**
  74.      * 校验图片验证码
  75.      *
  76.      * @param uuid        存入redis的key
  77.      * @param captchaCode 验证码
  78.      * @throws RuntimeException 验证失败抛出错误
  79.      */
  80.     void verifyCaptchaCode(String uuid, String captchaCode) throws RuntimeException;
  81. }

服务实现类：

  1. package com.dragonwu.service.impl;
  2.  
  3. import com.baomidou.mybatisplus.core.toolkit.StringUtils;
  4. import com.dragonwu.service.EasyCaptchaService;
  5. import com.dragonwu.utils.RedisUtil;
  6. import com.dragonwu.utils.SnowflakeIdGen;
  7. import com.wf.captcha.ArithmeticCaptcha;
  8. import com.wf.captcha.ChineseCaptcha;
  9. import com.wf.captcha.ChineseGifCaptcha;
  10. import com.wf.captcha.GifCaptcha;
  11. import com.wf.captcha.SpecCaptcha;
  12. import org.springframework.beans.factory.annotation.Autowired;
  13. import org.springframework.stereotype.Service;
  14.  
  15. import java.io.IOException;
  16. import java.util.HashMap;
  17. import java.util.Map;
  18. import java.util.concurrent.TimeUnit;
  19.  
  20. @Service
  21. public class EasyCaptchaServiceImpl implements EasyCaptchaService {
  22.     /*
  23.     redis工具
  24.      */
  25.     @Autowired
  26.     private RedisUtil redisUtil;
  27.  
  28.     /*
  29.     雪花算法生成唯一key
  30.      */
  31.     @Autowired
  32.     private SnowflakeIdGen snowflakeIdGen;
  33.  
  34.     @Override
  35.     public Map<String, String> outputCaptchaImg(Integer type) throws IOException {
  36.         String codeValue = "";
  37.         Map<String, String> map = new HashMap<>();
  38.         switch (type) {
  39.             case CAPTCHA_TYPE_DEFAULT_PNG:
  40.                 SpecCaptcha specCaptcha = new SpecCaptcha(CAPTCHA_WIDTH, CAPTCHA_HEIGHT, CAPTCHA_LENGTH);
  41.                 codeValue = specCaptcha.text().toLowerCase();
  42.                 map.put(EasyCaptchaService.IMAGE, specCaptcha.toBase64());
  43.                 break;
  44.             case CAPTCHA_TYPE_GIF:
  45.                 GifCaptcha gifCaptcha = new GifCaptcha(CAPTCHA_WIDTH, CAPTCHA_HEIGHT, CAPTCHA_LENGTH);
  46.                 codeValue = gifCaptcha.text().toLowerCase();
  47.                 map.put(EasyCaptchaService.IMAGE, gifCaptcha.toBase64());
  48.                 break;
  49.             case CAPTCHA_TYPE_CHINESE:
  50.                 ChineseCaptcha chineseCaptcha = new ChineseCaptcha(CAPTCHA_WIDTH, CAPTCHA_HEIGHT, CAPTCHA_LENGTH);
  51.                 codeValue = chineseCaptcha.text();
  52.                 map.put(EasyCaptchaService.IMAGE, chineseCaptcha.toBase64());
  53.                 break;
  54.             case CAPTCHA_TYPE_GIF_CHINESE:
  55.                 ChineseGifCaptcha chineseGifCaptcha = new ChineseGifCaptcha(CAPTCHA_WIDTH, CAPTCHA_HEIGHT, CAPTCHA_LENGTH);
  56.                 codeValue = chineseGifCaptcha.text();
  57.                 map.put(EasyCaptchaService.IMAGE, chineseGifCaptcha.toBase64());
  58.                 break;
  59.             case CAPTCHA_TYPE_ARITHMETIC:
  60.                 ArithmeticCaptcha arithmeticCaptcha = new ArithmeticCaptcha(CAPTCHA_WIDTH, CAPTCHA_HEIGHT);
  61.                 codeValue = arithmeticCaptcha.text();
  62.                 map.put(EasyCaptchaService.IMAGE, arithmeticCaptcha.toBase64());
  63.                 break;
  64.             default:
  65.                 throw new IOException("类型不存在");
  66.         }
  67.         //生成redis键名
  68.         String uuid = String.valueOf(snowflakeIdGen.nextId());
  69.         //存入redis
  70.         redisUtil.setObject(EasyCaptchaService.CAPTCHA_KEY_PRE + uuid, codeValue, EasyCaptchaService.CAPTCHA_CACHE_TIME, TimeUnit.MINUTES);
  71.         map.put(EasyCaptchaService.UUID, uuid);
  72.         return map;
  73.     }
  74.  
  75.     @Override
  76.     public void verifyCaptchaCode(String uuid, String captchaCode) throws RuntimeException {
  77.         String cacheCaptchaCode = (String) redisUtil.getObject(EasyCaptchaService.CAPTCHA_KEY_PRE + uuid);
  78.         if (StringUtils.isBlank(cacheCaptchaCode)) {
  79.             throw new RuntimeException("验证码已过期，请重新获取");
  80.         }
  81.         if (!cacheCaptchaCode.equals(captchaCode.toLowerCase())) {
  82.             throw new RuntimeException("验证码错误");
  83.         }
  84.     }
  85. }

9、雪花算法生成唯一id

  1. package com.dragonwu.utils;
  2.  
  3. import org.springframework.stereotype.Component;
  4.  
  5. /**
  6.  * 采用twitter的雪花算法，生成有一定顺序且不重复的id，结果类型为64位的long型
  7.  */
  8. @Component
  9. public class SnowflakeIdGen {
  10.     //集群id
  11.     private final long dataCenterId;
  12.     //机器id
  13.     private final long workerId;
  14.     //集群id的bit位数
  15.     private final long dataCenterIdBits = 5L;
  16.     //机器id的bit位数
  17.     private final long workerIdBits = 5L;
  18.     //序列号
  19.     private long sequenceId;
  20.     //上一次生成id使用的timestamp ，以毫秒为单位
  21.     private long lastTimestamp = 1L;
  22.  
  23.     /**
  24.      * 若没有指定集群id和机器id,则默认均为0
  25.      */
  26.     public SnowflakeIdGen() {
  27.         this(0, 0);
  28.     }
  29.  
  30.     /**
  31.      * 指定集群id和机器id
  32.      */
  33.     public SnowflakeIdGen(long dataCenterId, long workerId) {
  34.         //集群id的最大编号
  35.         long maxdataCenterId = ~(-1L << dataCenterIdBits);
  36.         if (dataCenterId < 0 || dataCenterId > maxdataCenterId) {
  37.             throw new RuntimeException(String.format("dataCenterId greater than %d or less than 0", maxdataCenterId));
  38.         }
  39.         //机器id的最大编号
  40.         long maxWorkerId = ~(-1L << workerIdBits);
  41.         if (workerId < 0 || workerId > maxWorkerId) {
  42.             throw new RuntimeException(String.format("workerId greater than %d or less than 0", maxWorkerId));
  43.         }
  44.         this.dataCenterId = dataCenterId;
  45.         this.workerId = workerId;
  46.     }
  47.  
  48.     /**
  49.      * 生成全局唯一的id
  50.      */
  51.     public synchronized long nextId() {
  52.         long timestamp = System.currentTimeMillis();
  53.         if (timestamp < lastTimestamp) {  //出现这种情况，通常是由于机器时间出问题了
  54.             throw new RuntimeException("machine time error");
  55.         }
  56.  
  57.         //同一时刻生成的id号
  58.         //序列号的bit位数
  59.         long sequenceIdBits = 12L;
  60.         if (timestamp == lastTimestamp) {
  61.             //序列号的掩码
  62.             long sequenceIdMask = ~(-1L << sequenceIdBits);
  63.             sequenceId = (sequenceId + 1) & sequenceIdMask;
  64.             if (sequenceId == 0) {  //说明当前毫秒的序列号用完了，需从下个毫秒数开始重新计数
  65.                 timestamp = nextTimestamp(lastTimestamp);
  66.             }
  67.         } else {
  68.             //否则序列号从0开始
  69.             sequenceId = 0L;
  70.         }
  71.  
  72.         lastTimestamp = timestamp;
  73.         //生成最终结果时，集群id需移动的bit位数
  74.         long timestampShiftBits = sequenceIdBits + workerIdBits + dataCenterIdBits;
  75.         //生成最终结果时，集群id需移动的bit位数
  76.         long dataCenterIdShiftBits = sequenceIdBits + workerIdBits;
  77.         //生成最终结果时，机器id需移动的bit位数
  78.         //去掉过去的时间，即从指定时间(本例以2017-10-12 00:00:00)开始算，
  79.         // 大约可用69.5年（41位的时间位，最大值换成毫秒，再换算成年，大约69.5年）
  80.         //1507737600000为从1970-01-01 00:00:00到2017-10-12 00:00:00经过的毫秒数
  81.         long pastMills = 1507737600000L;
  82.         return ((timestamp - pastMills) << timestampShiftBits)
  83.                 | (dataCenterId << dataCenterIdShiftBits)
  84.                 | (workerId << sequenceIdBits)
  85.                 | sequenceId;
  86.     }
  87.  
  88.     /**
  89.      * 获取上次取数毫秒的下一时刻
  90.      */
  91.     long nextTimestamp(long lastTimestamp) {
  92.         long timestamp = System.currentTimeMillis();
  93.         while (timestamp <= lastTimestamp) {
  94.             timestamp = System.currentTimeMillis();
  95.         }
  96.         return timestamp;
  97.     }
  98. }

10、web渲染工具类

  1. package com.dragonwu.utils;
  2.  
  3. import javax.servlet.http.HttpServletResponse;
  4. import java.io.IOException;
  5.  
  6. /**
  7.  * web渲染工具类
  8.  *
  9.  * @author DragonWu
  10.  * @since 2022-10-07 15:36
  11.  **/
  12. public class WebUtil {
  13.  
  14.     /**
  15.      * @param response   渲染对象
  16.      * @param jsonString 待渲染的字符串
  17.      */
  18.     public static void renderString(HttpServletResponse response, String jsonString) {
  19.         try {
  20.             response.setStatus(200);
  21.             response.setContentType("application/json");
  22.             response.setCharacterEncoding("utf-8");
  23.             response.getWriter().write(jsonString);
  24.         } catch (IOException e) {
  25.             e.printStackTrace();
  26.         }
  27.     }
  28. }

二、SpringSecurity的配置

依赖引入:

  1.         <dependency>
  2.             <groupId>org.springframework.boot</groupId>
  3.             <artifactId>spring-boot-starter-security</artifactId>
  4.         </dependency>

1、SpringSecurity配置类

  1. package com.dragonwu.config;
  2.  
  3. import com.dragonwu.filter.TokenAuthenticationFilter;
  4. import com.dragonwu.handler.AccessDeniedHandlerImpl;
  5. import com.dragonwu.handler.AuthenticationEntryPointImpl;
  6. import org.springframework.beans.factory.annotation.Autowired;
  7. import org.springframework.context.annotation.Bean;
  8. import org.springframework.context.annotation.Configuration;
  9. import org.springframework.security.authentication.AuthenticationManager;
  10. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  11. import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
  12. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  13. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  14. import org.springframework.security.config.http.SessionCreationPolicy;
  15. import org.springframework.security.core.userdetails.UserDetailsService;
  16. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  17. import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
  18. import org.springframework.web.cors.CorsConfiguration;
  19. import org.springframework.web.cors.CorsConfigurationSource;
  20. import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
  21.  
  22. import java.util.Arrays;
  23. import java.util.Collections;
  24.  
  25. /**
  26.  * @author DragonWu
  27.  * @since 2022-10-06 21:14
  28.  **/
  29. @Configuration
  30. @EnableGlobalMethodSecurity(prePostEnabled = true)  //开启权限访问注解
  31. public class SecurityConfig extends WebSecurityConfigurerAdapter {
  32.  
  33.     //允许匿名访问的
  34.     private static final String[] ALLOW_ASK = {
  35.             "/login",
  36.             "/captcha"
  37.     };
  38.     //总数允许访问的
  39.     private static final String[] ALWAYS_ALLOW_ASK = {
  40.             "/v2/api-docs",
  41.             "/swagger-resources/configuration/ui",//用来获取支持的动作
  42.             "/swagger-resources",//用来获取api-docs的URI
  43.             "/swagger-resources/configuration/security",//安全选项
  44.             "/webjars/**",
  45.             "/swagger-ui.html",//以上为api文档接口访问路径
  46.             "/static/**",//放行静态资源
  47.             "**/open" //开放访问的资源
  48.     };
  49.  
  50.     //自定义登录
  51.     @Autowired
  52.     private UserDetailsService userDetailsService;
  53.  
  54.     //token过滤器
  55.     @Autowired
  56.     private TokenAuthenticationFilter tokenAuthenticationFilter;
  57.  
  58.     //禁止访问异常处理器
  59.     @Autowired
  60.     private AccessDeniedHandlerImpl accessDeniedHandler;
  61.  
  62.     //认证异常处理器
  63.     @Autowired
  64.     private AuthenticationEntryPointImpl authenticationEntryPoint;
  65.  
  66.     /*
  67.     密码加密器
  68.      */
  69.     @Bean
  70.     public BCryptPasswordEncoder bCryptPasswordEncoder() {
  71.         return new BCryptPasswordEncoder();
  72.     }
  73.  
  74.     /*
  75.      设置自定义登录逻辑
  76.      */
  77.     @Override
  78.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  79.         auth.userDetailsService(userDetailsService);
  80.     }
  81.  
  82.     /*
  83.     自定义登录，用户认证
  84.      */
  85.     @Bean
  86.     @Override
  87.     protected AuthenticationManager authenticationManager() throws Exception {
  88.         return super.authenticationManager();
  89.     }
  90.  
  91.     /*
  92.     页面资源授权
  93.      */
  94.     @Override
  95.     protected void configure(HttpSecurity http) throws Exception {
  96.         http
  97.                 //关闭csrf
  98.                 .csrf().disable()
  99.                 //不通过Session获取SecurityContext
  100.                 .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
  101.                 .and()
  102.                 .authorizeRequests()
  103.                 //对应登录接口允许匿名访问
  104.                 .antMatchers(ALWAYS_ALLOW_ASK).permitAll()
  105.                 .antMatchers(ALLOW_ASK).anonymous()
  106.                 //除上面接口全都需要鉴权访问
  107.                 .anyRequest().authenticated();
  108.  
  109.         //添加过滤器
  110.         http.addFilterBefore(tokenAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
  111.  
  112.         //添加异常处理器
  113.         http.exceptionHandling()
  114.                 //认证失败的处理器
  115.                 .authenticationEntryPoint(authenticationEntryPoint)
  116.                 //授权失败处理器
  117.                 .accessDeniedHandler(accessDeniedHandler);
  118.  
  119.         //跨域配置
  120.         http.cors()
  121.                 .configurationSource(corsConfigurationSource());
  122.  
  123.     }
  124.  
  125.     /*
  126.      跨域配置对象
  127.      */
  128.     @Bean
  129.     public CorsConfigurationSource corsConfigurationSource() {
  130.         CorsConfiguration configuration = new CorsConfiguration();
  131.         //配置允许访问的服务器域名
  132.         configuration.setAllowedOrigins(Collections.singletonList("*"));
  133.         configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE"));
  134.         configuration.setAllowedHeaders(Collections.singletonList("*"));
  135.         configuration.setAllowCredentials(true);
  136.         UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
  137.         source.registerCorsConfiguration("/**", configuration);
  138.         return source;
  139.     }
  140. }

2、SpringSecurity异常处理器

认证异常处理器：

  1. @Component
  2. public class AuthenticationEntryPointImpl implements AuthenticationEntryPoint {
  3.  
  4.     @Override
  5.     public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {
  6.         R<String> result = R.restResult(null, HttpStatus.UNAUTHORIZED.value(), "认证失败");
  7.         String json = JSON.toJSONString(result);
  8.         //处理异常，返回结果
  9.         WebUtil.renderString(httpServletResponse, json);
  10.     }
  11. }

禁止访问异常处理器：

  1. @Component
  2. public class AccessDeniedHandlerImpl implements AccessDeniedHandler {
  3.     @Override
  4.     public void handle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AccessDeniedException e) throws IOException, ServletException {
  5.         R<String> result = R.restResult(null, HttpStatus.FORBIDDEN.value(), "禁止访问");
  6.         String json = JSON.toJSONString(result);
  7.         //处理异常，返回结果
  8.         WebUtil.renderString(httpServletResponse, json);
  9.     }
  10. }

异常处理器可以将异常自定义处理。

三、JWT+SpringSecurity实现登录的主要步骤

1、登录图解

2、登录开始前首先创建UserDetails实体类的子类

  1. package com.dragonwu.model;
  2.  
  3. import com.alibaba.fastjson.annotation.JSONField;
  4. import com.dragonwu.model.entity.SysUser;
  5. import lombok.Data;
  6. import lombok.NoArgsConstructor;
  7. import org.apache.tomcat.util.buf.StringUtils;
  8. import org.springframework.security.core.GrantedAuthority;
  9. import org.springframework.security.core.authority.SimpleGrantedAuthority;
  10. import org.springframework.security.core.userdetails.UserDetails;
  11.  
  12. import java.util.Collection;
  13. import java.util.List;
  14. import java.util.Objects;
  15. import java.util.stream.Collectors;
  16.  
  17. /**
  18.  * @author DragonWu
  19.  * @since 2022-10-06 20:29
  20.  **/
  21. @Data
  22. @NoArgsConstructor
  23. public class LoginUser implements UserDetails {
  24.  
  25.     private SysUser sysUser;
  26.  
  27.     //用户角色权限
  28.     private List<String> jurisdiction;
  29.  
  30.     //将不会被序列化到redis里
  31.     @JSONField(serialize = false)
  32.     private List<SimpleGrantedAuthority> authorities;
  33.  
  34.     public LoginUser(SysUser sysUser, List<String> jurisdiction) {
  35.         this.sysUser = sysUser;
  36.         this.jurisdiction = jurisdiction;
  37.     }
  38.  
  39.     public String getJurisdictionToString() {
  40.         return StringUtils.join(jurisdiction, ',');
  41.     }
  42.  
  43.     @Override
  44.     public Collection<? extends GrantedAuthority> getAuthorities() {
  45.         //把jurisdiction里的权限信息字符串封装成SimpleGrantedAuthority对象
  46.         if (!Objects.isNull(authorities)) {
  47.             return authorities;
  48.         }
  49.         authorities = jurisdiction.stream()
  50.                 .map(SimpleGrantedAuthority::new)
  51.                 .collect(Collectors.toList());
  52.         return authorities;
  53.     }
  54.  
  55.     @Override
  56.     public String getPassword() {
  57.         return sysUser.getPassword();
  58.     }
  59.  
  60.     @Override
  61.     public String getUsername() {
  62.         return sysUser.getUserName();
  63.     }
  64.  
  65.     @Override
  66.     public boolean isAccountNonExpired() {
  67.         return true;
  68.     }
  69.  
  70.     @Override
  71.     public boolean isAccountNonLocked() {
  72.         return true;
  73.     }
  74.  
  75.     @Override
  76.     public boolean isCredentialsNonExpired() {
  77.         return true;
  78.     }
  79.  
  80.     @Override
  81.     public boolean isEnabled() {
  82.         return true;
  83.     }
  84. }

3、创建UserDetailsService的实现类

通过UserDetailsService的实现可对用户对象进行自定义返回

  1. package com.dragonwu.service.impl;
  2.  
  3. import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
  4. import com.dragonwu.model.entity.SysUser;
  5. import com.dragonwu.mapper.SysUserMapper;
  6. import com.dragonwu.model.LoginUser;
  7. import org.springframework.beans.factory.annotation.Autowired;
  8. import org.springframework.security.core.userdetails.UserDetails;
  9. import org.springframework.security.core.userdetails.UserDetailsService;
  10. import org.springframework.security.core.userdetails.UsernameNotFoundException;
  11. import org.springframework.stereotype.Service;
  12.  
  13. import java.util.ArrayList;
  14. import java.util.Arrays;
  15. import java.util.List;
  16. import java.util.Objects;
  17.  
  18. /**
  19.  * @author DragonWu
  20.  * @since 2022-10-06 20:47
  21.  **/
  22. @Service
  23. public class UserDetailsServiceImpl implements UserDetailsService {
  24.  
  25.     @Autowired
  26.     private SysUserMapper sysUserMapper;
  27.  
  28.     @Override
  29.     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
  30.         //查询用户信息
  31.         SysUser user = sysUserMapper.selectOne(new LambdaQueryWrapper<SysUser>().eq(SysUser::getUserName,username));
  32.         //如果没有查询到用户就抛出异常
  33.         if (Objects.isNull(user)) {
  34.             throw new UsernameNotFoundException("用户名不存在!");
  35.         }
  36.         //查询对应的权限信息和角色信息
  37.         // 这一般需要查询role表和jurisdiction表的权限,这里略过
  38.         List<String> jurisdiction=new ArrayList<>(Arrays.asList("admin","normal","ROLE_manager"));
  39.         //将数据封装到UserDetail返回
  40.         return new LoginUser(user, jurisdiction);
  41.     }
  42. }

4、登录的实现类与接口

接口：

  1. package com.dragonwu.controller;
  2.  
  3. import com.alibaba.fastjson.JSONObject;
  4. import com.dragonwu.constant.Constants;
  5. import com.dragonwu.model.R;
  6. import com.dragonwu.model.param.LoginParam;
  7. import com.dragonwu.model.vo.LoginVo;
  8. import com.dragonwu.service.LoginService;
  9. import lombok.extern.slf4j.Slf4j;
  10. import org.springframework.beans.factory.annotation.Autowired;
  11. import org.springframework.web.bind.annotation.GetMapping;
  12. import org.springframework.web.bind.annotation.PostMapping;
  13. import org.springframework.web.bind.annotation.RequestBody;
  14. import org.springframework.web.bind.annotation.RestController;
  15.  
  16. import java.util.Map;
  17.  
  18. @RestController
  19. @Slf4j
  20. public class LoginController {
  21.  
  22.     @Autowired
  23.     private LoginService loginService;
  24.  
  25.     @PostMapping("/login")
  26.     public R<LoginVo> login(@RequestBody LoginParam loginParam) {
  27.         try {
  28.             return R.ok(loginService.login(loginParam), Constants.LOGIN_OK);
  29.         } catch (RuntimeException msg) {
  30.             //返回失败结果
  31.             return R.fail(null, msg.getMessage());
  32.         } catch (Exception e) {
  33.             log.error("后台登录出现异常：" + JSONObject.toJSONString(loginParam), e);
  34.             return R.fail(null, Constants.LOGIN_FAIL);
  35.         }
  36.     }
  37.  
  38.     @GetMapping("/logout.do")
  39.     public R<String> logout() {
  40.         try {
  41.             loginService.logout();
  42.             return R.ok(null, Constants.LOGOUT_OK);
  43.         } catch (RuntimeException msg) {
  44.             return R.fail(null, msg.getMessage());
  45.         } catch (Exception e) {
  46.             log.error("退出登录出现异常：" + e);
  47.             return R.fail(null, Constants.LOGOUT_FAIL);
  48.         }
  49.     }
  50.  
  51.     @GetMapping("/captcha")
  52.     public R<Map<String, String>> captcha() {
  53.         try {
  54.             return R.ok(loginService.getCaptcha(), Constants.GET_RESOURCE_OK);
  55.         } catch (RuntimeException msg) {
  56.             return R.fail(null, msg.getMessage());
  57.         } catch (Exception e) {
  58.             log.error("获取验证码出现异常：", e);
  59.             return R.fail(null, Constants.GET_RESOURCE_FAIL);
  60.         }
  61.     }
  62. }

服务层接口：

  1. public interface LoginService {
  2.  
  3.     /**
  4.      * 用户登录
  5.      * @param loginParam 登录参数
  6.      * @return 登录返回对象
  7.      */
  8.     LoginVo login(LoginParam loginParam);
  9.  
  10.     /**
  11.      * 退出登录
  12.      */
  13.     void logout() throws RuntimeException;
  14.  
  15.     /**
  16.      * 获取验证码
  17.      * @return Map UUID验证码对应redis里的key,image的base64编码
  18.      */
  19.     Map<String,String> getCaptcha() throws IOException;
  20.  
  21. }

服务层实现类：

  1. package com.dragonwu.service.impl;
  2.  
  3. import com.dragonwu.constant.Constants;
  4. import com.dragonwu.model.LoginUser;
  5. import com.dragonwu.model.OnlineUser;
  6. import com.dragonwu.model.param.LoginParam;
  7. import com.dragonwu.model.vo.LoginVo;
  8. import com.dragonwu.service.EasyCaptchaService;
  9. import com.dragonwu.service.LoginService;
  10. import com.dragonwu.utils.JwtUtil;
  11. import com.dragonwu.utils.RedisUtil;
  12. import org.springframework.beans.factory.annotation.Autowired;
  13. import org.springframework.security.authentication.AuthenticationManager;
  14. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  15. import org.springframework.security.core.Authentication;
  16. import org.springframework.security.core.context.SecurityContextHolder;
  17. import org.springframework.stereotype.Service;
  18.  
  19. import java.io.IOException;
  20. import java.util.HashMap;
  21. import java.util.Map;
  22. import java.util.Objects;
  23. import java.util.concurrent.TimeUnit;
  24.  
  25. /**
  26.  * @author DragonWu
  27.  * @since 2022-10-07 19:02
  28.  **/
  29. @Service
  30. public class LoginServiceImpl implements LoginService {
  31.  
  32.     @Autowired
  33.     private AuthenticationManager authenticationManager;
  34.  
  35.     @Autowired
  36.     private RedisUtil redisUtil;
  37.  
  38.     @Autowired
  39.     private EasyCaptchaService easyCaptchaService;
  40.  
  41.  
  42.     @Override
  43.     public LoginVo login(LoginParam loginParam) throws RuntimeException {
  44.         //判断验证码是否正确
  45.         easyCaptchaService.verifyCaptchaCode(loginParam.getUuid(), loginParam.getCaptcha());
  46.  
  47.         //AuthenticationManager authenticate进行用户认证
  48.         UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(loginParam.getUsername(), loginParam.getPassword());
  49.         Authentication authenticate = authenticationManager.authenticate(authenticationToken);
  50.         //如果认证没通过给出相应的提示
  51.         if (Objects.isNull(authenticate)) {
  52.             throw new RuntimeException(Constants.LOGIN_ERROR);
  53.         }
  54.  
  55.         //如果认证通过了，获取UserDetailService返回过期的UserDetail对象
  56.         LoginUser loginUser = (LoginUser) authenticate.getPrincipal();
  57.         //使用primaryKey生成JWT
  58.         String primaryKey = loginUser.getSysUser().getUserId().toString();
  59.         Map<String, Object> claims = new HashMap<>();
  60.         claims.put(JwtUtil.JWT_PRIMARY_KEY, primaryKey);
  61.         String token = JwtUtil.createJwt(claims, JwtUtil.DEFAULT_EXPIRE_MINUTES);
  62.  
  63.         //把用户信息存入redis
  64.         OnlineUser onlineUser = new OnlineUser(loginUser.getSysUser(), loginUser.getJurisdictionToString());
  65.         redisUtil.setObject(Constants.ONLINE_PRE + primaryKey, onlineUser, JwtUtil.DEFAULT_EXPIRE_MINUTES, TimeUnit.MINUTES);
  66.  
  67.         //将返回结果封装达到返回对象
  68.         return new LoginVo(loginUser.getSysUser(), loginUser.getJurisdiction(), token);
  69.     }
  70.  
  71.     @Override
  72.     public void logout() throws RuntimeException {
  73.         try {
  74.             //获取SecurityContextHolder里的用户id
  75.             UsernamePasswordAuthenticationToken authentication =
  76.                     (UsernamePasswordAuthenticationToken) SecurityContextHolder.getContext().getAuthentication();
  77.             OnlineUser onlineUser = (OnlineUser) authentication.getPrincipal();
  78.             String primaryKey = String.valueOf(onlineUser.getSysUser().getUserId());
  79.             //删除redis中的值
  80.             redisUtil.deleteObject(Constants.ONLINE_PRE + primaryKey);
  81.         } catch (Exception e) {
  82.             throw new RuntimeException(Constants.LOGOUT_FAIL);
  83.         }
  84.     }
  85.  
  86.     @Override
  87.     public Map<String, String> getCaptcha() throws IOException {
  88.         return easyCaptchaService.outputCaptchaImg(EasyCaptchaService.CAPTCHA_TYPE_GIF);
  89.     }
  90. }

这里我们便实现了登录逻辑。

5、认证过滤器

判断用户是否已登录

  1. package com.dragonwu.filter;
  2.  
  3. import com.alibaba.fastjson.JSON;
  4. import com.dragonwu.constant.Constants;
  5. import com.dragonwu.model.OnlineUser;
  6. import com.dragonwu.model.R;
  7. import com.dragonwu.utils.JwtUtil;
  8. import com.dragonwu.utils.RedisUtil;
  9. import com.dragonwu.utils.WebUtil;
  10. import org.junit.platform.commons.util.StringUtils;
  11. import org.springframework.beans.factory.annotation.Autowired;
  12. import org.springframework.http.HttpStatus;
  13. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  14. import org.springframework.security.core.authority.AuthorityUtils;
  15. import org.springframework.security.core.context.SecurityContextHolder;
  16. import org.springframework.stereotype.Component;
  17. import org.springframework.web.filter.OncePerRequestFilter;
  18.  
  19. import javax.servlet.FilterChain;
  20. import javax.servlet.ServletException;
  21. import javax.servlet.http.HttpServletRequest;
  22. import javax.servlet.http.HttpServletResponse;
  23. import java.io.IOException;
  24. import java.util.Map;
  25. import java.util.Objects;
  26.  
  27. /**
  28.  * token验证过滤器
  29.  *
  30.  * @author DragonWu
  31.  * @since 2022-10-07 19:02
  32.  **/
  33. @Component
  34. public class TokenAuthenticationFilter extends OncePerRequestFilter {
  35.  
  36.     public static final String HEADER = "Authorization";
  37.     public static final String PARAM = "token";
  38.  
  39.     @Autowired
  40.     private RedisUtil redisUtil;
  41.  
  42.     @Override
  43.     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
  44.         //获得前端请求中的token
  45.         String token = request.getHeader(HEADER);
  46.         if (StringUtils.isBlank(token)) {
  47.             token = request.getParameter(PARAM);
  48.         }
  49.         //如果token为空，放行，验证失败
  50.         if (StringUtils.isBlank(token)) {
  51.             chain.doFilter(request, response);
  52.             return;
  53.         }
  54.  
  55.         //解析token
  56.         Map<String, Object> claims = JwtUtil.parseJwt(token);
  57.         if (Objects.isNull(claims)) {//解析异常
  58.             R<String> result = R.restResult(null, HttpStatus.FORBIDDEN.value(), "token非法");
  59.             String json = JSON.toJSONString(result);
  60.             //返回解析错误的json数据
  61.             WebUtil.renderString(response, json);
  62.             return;
  63.         }
  64.  
  65.         //获取用户主键，以便到redis中查询
  66.         String primaryKey = (String) claims.get(JwtUtil.JWT_PRIMARY_KEY);
  67.         //从redis中获取token对应的数据
  68.         String redisKey = Constants.ONLINE_PRE + primaryKey;
  69.         //获取用户信息
  70.         OnlineUser onlineUser = (OnlineUser) redisUtil.getObject(redisKey);
  71.         if (Objects.isNull(onlineUser)) {
  72.             R<String> result = R.restResult(null, HttpStatus.UNAUTHORIZED.value(), "认证失败");
  73.             String json = JSON.toJSONString(result);
  74.             //返回请求失败的json数据
  75.             WebUtil.renderString(response, json);
  76.             return;
  77.         }
  78.  
  79.         //存入SecurityContextHolder中
  80.         UsernamePasswordAuthenticationToken authenticationToken =
  81.                 new UsernamePasswordAuthenticationToken(onlineUser, null,
  82.                         AuthorityUtils.commaSeparatedStringToAuthorityList(onlineUser.getAuthorities()));
  83.         //获取权限信息封装到authenticationToken里
  84.         SecurityContextHolder.getContext().setAuthentication(authenticationToken);
  85.  
  86.         //放行
  87.         chain.doFilter(request, response);
  88.  
  89.     }
  90. }

四、测试

1、登录测试

首先访问验证码接口获取验证码的图片和uuid:

 

 服务器通过用户输入的验证码结果和redis中的缓存进行比较得出是否验证码正确。

访问登录接口：

 登录成功：

 2、资源访问测试

未携带JWT：

 携带token就是登录的状态：

携带错误的token测试：可以看到错误的token会被服务器警告。

 

 3、退出登录

退出登录后，redis中缓存的用户信息将被删除。

 五、案例源码链接

SpringCloudAlibaba各技术栈实现的案例代码集 我的笔记: SpringCloudAlibaba各技术栈实现的案例代码集 我的笔记 - Gitee.com

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/运维做开发/article/detail/948512
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号