Spring Security

July 3, 2023

依赖：
https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-starter-security
https://mvnrepository.com/artifact/io.jsonwebtoken/jjwt-api

前置

使用 MybatisGenerator 生成 UserDao 类和对应 mapper 的 xml 文件
注意 UserDao 类需手动添加 @Repository 注解

编写 UserService 接口如下：

java

public interface UserService {
    List<User> selectAll();
    void add(User user);
    void update(User user);
    void delete(String userName);
    User selectByUserName(String userName);
}

编写 UserServiceImpl 类如下：

java

@Service
public class UserServiceImpl implements UserService {
    @Autowired
    private UserDao userDao;
    @Override
    public List<User> selectAll() {return userDao.selectAll();}
    @Override
    public void add(User user) {userDao.insert(user);}
    @Override
    public void update(User user) {userDao.updateByPrimaryKey(user);}
    @Override
    public void delete(String userName) {userDao.deleteByPrimaryKey(userName);}
    @Override
    public User selectByUserName(String userName) {return userDao.selectByPrimaryKey(userName);}
}

认证

https://springdoc.cn/spring-security/servlet/authentication/

Spring Security 提供下列方式实现登录认证。

登录页面设置方式
- 使用 Spring Security 默认的登录页面及表单项
- 自定义登录页面及表单项
用户名和密码设置方式
- 通过 application.properties 配置文件配置
- 通过 java 代码配置在内存中
- 通过 java 代码从数据库中加载

这里只讨论数据库认证方式，并使用 jwt 鉴权，io.jsonwebtoken 依赖的使用参见文档

下面我们创建一个 security 包，以下内容将置于该包内

创建 service/JwtUserDetailsServiceImpl（实现 spring security 的 UserDetailsService 接口）

务必注意下面是实现 spring security 的接口，而不是我们自己的

java

// org.springframework.security.core.userdetails.UserDetails
// org.springframework.security.core.userdetails.UserDetailsService
// org.springframework.security.core.userdetails.UsernameNotFoundException
@Service
public class JwtUserDetailsServiceImpl implements UserDetailsService {
    @Autowired
    private UserService userService;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userService.selectUserByUsername(username);
        if (user == null) throw new UsernameNotFoundException(String.format("用户 `%s` 不存在", username));
        return new JwtUser(user.getUserName(),
                           user.getNickName(),
                           user.getPassword(),
                           user.getAvatar(),
                           AuthorityUtils.commaSeparatedStringToAuthorityList(user.getRole()));
    }
}

创建 entity/JwtUser 类如下（实现 spring security 的 UserDetails 接口）

java

@Data
public class JwtUser implements UserDetails {
    private String username;
    private String nickname;
    private String password;
    private String avatar;
    private Collection<? extends GrantedAuthority> authorities;
    public JwtUser(String username, String nickname, String password, String avatar, Collection<? extends GrantedAuthority> authorities) {
        this.username = username;
        this.nickname = nickname;
        this.password = password;
        this.avatar = avatar;
        this.authorities = authorities;
    }
    public String getAvatar() {return avatar;}
    public String getNickname() {return nickname;}
    @Override
    public String getUsername() {return username;}
    @Override
    public boolean isAccountNonExpired() {return true;}
    @Override
    public boolean isAccountNonLocked() {return true;}
    @Override
    public boolean isCredentialsNonExpired() {return true;}
    @Override
    public boolean isEnabled() {return true;}
    public void setUsername(String username) {this.username = username;}
    @Override
    public String getPassword() {return password;}
    public void setPassword(String password) {this.password = password;}
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {return authorities;}
    public void setAuthorities(Collection<? extends GrantedAuthority> authorities) {this.authorities = authorities;}
}

创建 entity/AuthenticationBean 类如下

java

@Getter
@Setter
public class AuthenticationBean {
    private String username;
    private String password;
}

创建 filter/CustomAuthenticationFilter 对象，自定义认证流程

java

public class CustomAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        // 若请求头不是 json，不处理
        if (!(request.getContentType().equals(MediaType.APPLICATION_JSON_UTF8_VALUE)
                || request.getContentType().equals(MediaType.APPLICATION_JSON_VALUE)))
            return super.attemptAuthentication(request, response);

        // 尝试根据请求构造出 UsernamePasswordAuthenticationToken 对象
        UsernamePasswordAuthenticationToken authRequest = null;

        try (InputStream is = request.getInputStream()) {
            // 使用 jackson 解析 json，将请求的 json 读取为我们创建的 AuthenticationBean
            ObjectMapper mapper = new ObjectMapper();
            AuthenticationBean ab = mapper.readValue(is, AuthenticationBean.class);
            authRequest = new UsernamePasswordAuthenticationToken(ab.getUsername(), ab.getPassword());
        } catch (IOException e) {
            e.printStackTrace();
            authRequest = new UsernamePasswordAuthenticationToken("", "");
        } finally {
            this.setDetails(request, authRequest);
            return this.getAuthenticationManager().authenticate(authRequest);
        }
    }
}

创建 filter/JwtAuthenticationTokenFilter 对象，处理 Authorization 请求头

java

@Component
public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
    @Resource
    private UserDetailsService userDetailsService;

    @SneakyThrows
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
        String token = request.getHeader("Authorization");
        if (!StringUtils.isEmpty(token)) {
            // 这里的 JwtUtils 需要自己实现，这里省略
            String username = JwtUtils.getUsername(token);
            if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
                // 强调：我们创建了 JwtUser 继承 spring security 的 UserDetails
                UserDetails userDetails = userDetailsService.loadUserByUsername(username);
                if (JwtUtils.validate(token, userDetails)) {
                    // 认证成功时，我们保存 UsernamePasswordAuthenticationToken 对象（当然也是 spring security 提供的）
                    UsernamePasswordAuthenticationToken authentication =
                        new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
                    authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                    SecurityContextHolder.getContext().setAuthentication(authentication);
                }
            }
        }
        chain.doFilter(request, response);
    }
}

创建 handler/MyAuthenticationSuccessHandler，处理认证成功

java

// org.springframework.security.core.userdetails.UserDetails
@Component
public class MyAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
    @Override
    public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {
        UserDetails userDetails = (UserDetails) authentication.getPrincipal();
        SecurityContextHolder.getContext().setAuthentication(authentication);

        Map<string, string> map = new HashMap<>();
        map.put("status", "ok");
        map.put("token" , generateToken(userDetails));

        httpServletResponse.setContentType("application/json;charset=UTF-8");
        ServletOutputStream out = httpServletResponse.getOutputStream();
        out.write(new ObjectMapper().writeValueAsBytes(map));
        out.flush();
        out.close();
    }

    // 使用 io.jsonwebtoken 依赖生成 jwt 字符串
    private String generateToken(UserDetails userDetails) {
        JwtUser jwtUser = (JwtUser) userDetails;
        Map<String, Object> claims = new HashMap<>();
        claims.put(Claims.SUBJECT  , userDetails.getUsername());
        claims.put(Claims.ISSUED_AT, new Date());
        claims.put("username"      , jwtUser.getUsername());
        claims.put("role"          , jwtUser.getAuthorities());
        return Jwts.builder()
                .setClaims(claims)
                .setExpiration(new Date(System.currentTimeMillis() + expiration))
                .signWith(SignatureAlgorithm.HS512, secret)
                .compact();
    }
}

创建 handler/MyAuthenticationFailureHandler，处理认证失败

java

@Component
public class MyAuthenticationFailureHandler implements AuthenticationFailureHandler {
    @Override
    public void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {
        Map<string, string> map = new HashMap<>();
        map.put("status", "error");
        map.put("reason", "auth fail");
        ServletOutputStream out = httpServletResponse.getOutputStream();
        out.write(new ObjectMapper().writeValueAsBytes(map));
        out.flush();
        out.close();
    }
}

创建 handler/EntryPointUnauthorizedHandler，处理未认证

java

@Component
public class EntryPointUnauthorizedHandler implements AuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
        Map<string, string> map = new HashMap<>();
        map.put("status", "error");
        map.put("reason", "unauthorized");
        ServletOutputStream out = httpServletResponse.getOutputStream();
        out.write(new ObjectMapper().writeValueAsBytes(map));
        out.flush();
        out.close();
    }
}

创建 handler/RestAccessDeniedHandler，处理无权限情况

java

@Component
public class RestAccessDeniedHandler implements AccessDeniedHandler {
    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
        Map<string, string> map = new HashMap<>();
        map.put("status", "error");
        map.put("reason", "access denied");
        ServletOutputStream out = httpServletResponse.getOutputStream();
        out.write(new ObjectMapper().writeValueAsBytes(map));
        out.flush();
        out.close();
    }
}

创建 config/WebSecurityConfig，对 spring security 进行配置

java

@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Resource
    private UserDetailsService userDetailsService;
    @Autowired
    private JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter;
    @Autowired
    private EntryPointUnauthorizedHandler entryPointUnauthorizedHandler;
    @Autowired
    private RestAccessDeniedHandler restAccessDeniedHandler;
    @Autowired
    private MyAuthenticationSuccessHandler myAuthenticationSuccessHandler;
    @Autowired
    private MyAuthenticationFailureHandler myAuthenticationFailureHandler;

    @Autowired
    public void configureAuthentication(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
        authenticationManagerBuilder.userDetailsService(userDetailsService)
                .passwordEncoder(new BCryptPasswordEncoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class)
                .addFilterBefore(new CorsFilter(), ChannelProcessingFilter.class);// 跨域 Filter，此处省略实现

        http.csrf().disable().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and().authorizeRequests()
                .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
                .antMatchers("/static/**").permitAll()
                .anyRequest().authenticated() // 任何请求，登录后可访问
                .and().addFilterAt(customAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)
                .formLogin().loginProcessingUrl("/user/login")
                .successHandler(myAuthenticationSuccessHandler)
                .failureHandler(myAuthenticationFailureHandler)
                .and().logout()
                .and().headers().cacheControl();

        http.exceptionHandling()
                .authenticationEntryPoint(entryPointUnauthorizedHandler)
                .accessDeniedHandler(restAccessDeniedHandler);
    }

    @Bean
    CustomAuthenticationFilter customAuthenticationFilter() throws Exception {
        CustomAuthenticationFilter filter = new CustomAuthenticationFilter();
        filter.setAuthenticationSuccessHandler(myAuthenticationSuccessHandler);
        filter.setAuthenticationFailureHandler(myAuthenticationFailureHandler);
        filter.setFilterProcessesUrl("/user/login");
        filter.setAuthenticationManager(authenticationManagerBean());
        return filter;
    }
}

授权

https://springdoc.cn/spring-security/servlet/authorization/

←Back to home