Spring Security 自定义登录成功和登录失败的处理

梦里梦外; 2022-05-20 07:19 164阅读 0赞

# 一、前言 #

spring security 默认情况下登录成功会跳转到引发登录的请求上去，但是有些登录并不是同步访问的，而是ajax异步请求来访问登录，那么前端希望拿到的是登录用户的用户信息。

# 二、自定义登录成功和登录失败的返回方式 #

**在`/src/main/resources`的resources目录新建index.html：**

<!DOCTYPE html>
    <html>
    <head>
    <meta charset="UTF-8">
    <title>Insert title here</title>
    </head>
    <body>
        index<br>
    </body>
    </html>

**新建登录成功跳转方式枚举:**

package com.xh.sercurity.properties;
    
    public enum LoginType {
    
        REDIRECT,// 跳转
        JSON// 返回json
    
    }

**新建处理自定义配置的类，并把LoginType加入进去：**

package com.xh.sercurity.properties;
    
    import org.springframework.boot.context.properties.ConfigurationProperties;
    
    @ConfigurationProperties(prefix = "xh.security")
    public class SecurityProperties { 
    
        private LoginType loginType = LoginType.JSON; // default json
    
        public LoginType getLoginType() {
            return loginType;
        }
    
        public void setLoginType(LoginType loginType) {
            this.loginType = loginType;
        }
    
    }

那么就可以在application.properties中定义不同类型的返回方式。

**使前面的configration配置类生效：**

package com.xh.sercurity.config;
    
    import org.springframework.boot.context.properties.EnableConfigurationProperties;
    import org.springframework.context.annotation.Configuration;
    
    import com.xh.sercurity.properties.SecurityProperties;
    
    @Configuration
    @EnableConfigurationProperties(SecurityProperties.class)// 使SecurityProperties生效
    public class SecurityPropertiesConfig {
    
    }

# 三、自定义登录成功的处理 #

package com.xh.sercurity.authentication;
    
    import java.io.IOException;
    
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
    import org.springframework.stereotype.Component;
    
    import com.fasterxml.jackson.databind.ObjectMapper;
    import com.xh.sercurity.properties.LoginType;
    import com.xh.sercurity.properties.SecurityProperties;
    
    /** * 登录成功的处理器 */
    @Component("myAuthenticationSuccessHandler")
    public class MyAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler { 
    
        private Logger logger = LoggerFactory.getLogger(getClass());
    
        @Autowired
        private ObjectMapper objectMapper;
    
        @Autowired
        private SecurityProperties myProperties;
    
        // Authentication 封装认证信息
        // 登录方式不同，Authentication不同
        @Override 
        public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
                Authentication authentication) throws ServletException, IOException {
            logger.info("MyAuthenticationSuccessHandler login success!");
            if (LoginType.JSON.equals(myProperties.getLoginType())) {
                response.setContentType("application/json;charset=UTF-8");
                // 把authentication对象转成 json 格式 字符串 通过 response 以application/json;charset=UTF-8 格式写到响应里面去
                response.getWriter().write(objectMapper.writeValueAsString(authentication));
            } else {
                // 父类的方法 就是 跳转
                super.onAuthenticationSuccess(request, response, authentication);
            }
    
        }
    
    }

# 四、自定义登录失败的处理 #

package com.xh.sercurity.authentication;
    
    import java.io.IOException;
    
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.http.HttpStatus;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
    import org.springframework.stereotype.Component;
    
    import com.fasterxml.jackson.databind.ObjectMapper;
    import com.xh.sercurity.properties.LoginType;
    import com.xh.sercurity.properties.SecurityProperties;
    import com.xh.sercurity.support.SimpleResponse;
    
    /** * 登录失败的处理器 */
    @Component("myAuthenctiationFailureHandler")
    public class MyAuthenctiationFailureHandler extends SimpleUrlAuthenticationFailureHandler {
    
        private Logger logger = LoggerFactory.getLogger(getClass());
    
        @Autowired
        private ObjectMapper objectMapper;
    
        @Autowired
        private SecurityProperties securityProperties;
    
        // AuthenticationException 认证过程中产生的异常
        @Override
        public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
                AuthenticationException exception) throws IOException, ServletException {
            logger.info("MyAuthenticationSuccessHandler login failure!");
            if (LoginType.JSON.equals(securityProperties.getLoginType())) {
                response.setStatus(HttpStatus.INTERNAL_SERVER_ERROR.value());
                response.setContentType("application/json;charset=UTF-8");
    //          response.getWriter().write(objectMapper.writeValueAsString(exception)); 
                response.getWriter().write(objectMapper.writeValueAsString(new SimpleResponse(exception.getMessage())));
            } else {
                super.onAuthenticationFailure(request, response, exception);
            }
        }
    
    }

# 五、把自定义处理器加入security认证中 #

package com.xh.sercurity.config;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.security.crypto.password.PasswordEncoder;
    import org.springframework.security.web.authentication.AuthenticationFailureHandler;
    import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
    
    @Configuration
    public class SecurityConfig extends WebSecurityConfigurerAdapter {
    
        @Bean
        public PasswordEncoder passwordEncoder () {
            return new BCryptPasswordEncoder();
        }
    
        @Autowired
        private AuthenticationSuccessHandler myAuthenticationSuccessHandler;
    
        @Autowired
        private AuthenticationFailureHandler myAuthenctiationFailureHandler;
    
        @Override
        protected void configure(HttpSecurity http) throws Exception {
    //      http.httpBasic()// httpBasic 登录
            http.formLogin()// 表单登录  来身份认证
                .loginPage("/authentication/require")// 自定义登录页面
                .loginProcessingUrl("/authentication/form")// 自定义登录路径
                .successHandler(myAuthenticationSuccessHandler)
                .failureHandler(myAuthenctiationFailureHandler)
                .and()
                .authorizeRequests()// 对请求授权
                // error  127.0.0.1  将您重定向的次数过多
                .antMatchers("/myLogin.html", "/authentication/require",
                        "/authentication/form").permitAll()// 这些页面不需要身份认证,其他请求需要认证
                .anyRequest() // 任何请求
                .authenticated()//; // 都需要身份认证
                .and()
                .csrf().disable();// 禁用跨站攻击
        }
    
    }