spring security 一个验证码登录例子

青旅半醒 2022-05-28 10:59 233阅读 0赞

看完shiro，在看spring security感觉快了很多，最开始看spring security的时候，非常晕，看完我觉得spring security做了太多事，以至于程序员都不知道，是怎么实现的，这样的

后果就是 当出现错误，或者需要修改的时候感觉无从下手。

个人理解，若有错误，请指正。

spring security跟shiro类似，都是使用过滤器来认证和授权，不同的是spring seciruty是实现了一个过滤器链，每个请求都要经过，我们可以使用自动配置，这样spring security自动帮我们配置了这一系列过滤器，也可以自定义过滤器放在它的过滤器链中。

验证码或密码登录，需要重新修改认证过滤器

**\[java\]**  [view plain][]  [copy][view plain]

1.  package com.test.hello.security;  
2.    
3.  import javax.servlet.http.HttpServletRequest;  
4.  import javax.servlet.http.HttpServletResponse;  
5.    
6.  import org.springframework.security.authentication.AbstractAuthenticationToken;  
7.  import org.springframework.security.authentication.AuthenticationServiceException;  
8.  import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;  
9.  import org.springframework.security.core.Authentication;  
10. import org.springframework.security.core.AuthenticationException;  
11. import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;  
12.   
13. public class KdUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter\{  
14.      private boolean postOnly = true;  
15.      public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException \{  
16.             if (this.postOnly && !request.getMethod().equals("POST")) \{  
17.                 throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());  
18.             \}  
19.   
20.             String username = obtainUsername(request);  
21.             String password = obtainPassword(request);  
22.             String type = request.getParameter("j\_type");  
23.   
24.             if (username == null) \{  
25.                 username = "";  
26.             \}  
27.   
28.             if (password == null) \{  
29.                 password = "";  
30.             \}  
31.               
32.             if (type == null) \{  
33.                 type = "1";  
34.             \}  
35.   
36.             username = username.trim();  
37.   
38.             Authentication authRequest;  
39.             if(type.equals("1"))\{  
40.                  authRequest = new UsernamePasswordAuthenticationToken(username, password);  
41.             \}else\{  
42.                  authRequest = new KdUsernamePasswordAuthenticationToken(username, password,type);  
43.             \}  
44.              
45.               
46.              
47.   
48.             // Allow subclasses to set the "details" property  
49.             setDetails(request, (AbstractAuthenticationToken)authRequest);  
50.   
51.             return this.getAuthenticationManager().authenticate(authRequest);  
52.         \}  
53.        
54.         /\*\* 
55.          \* Provided so that subclasses may configure what is put into the authentication request's details 
56.          \* property. 
57.          \* 
58.          \* @param request that an authentication request is being created for 
59.          \* @param authRequest the authentication request object that should have its details set 
60.          \*/  
61.         protected void setDetails(HttpServletRequest request, AbstractAuthenticationToken authRequest) \{  
62.             authRequest.setDetails(authenticationDetailsSource.buildDetails(request));  
63.         \}  
64.   
65.   
66.   
67. \}

type为2时候，使用验证码登录，token- >provider ->

token

**\[java\]**  [view plain][]  [copy][view plain]

1.  package com.test.hello.security;  
2.    
3.  import java.util.Collection;  
4.    
5.  import org.springframework.security.authentication.AbstractAuthenticationToken;  
6.  import org.springframework.security.core.GrantedAuthority;  
7.    
8.  public class KdUsernamePasswordAuthenticationToken extends AbstractAuthenticationToken\{  
9.    
10.      //~ Instance fields ================================================================================================  
11.   
12.     /\*\* 
13.      \*  
14.      \*/  
15.     private static final long serialVersionUID = 1L;  
16.     private final Object principal;  
17.     private Object credentials;  
18.     private String type;  
19.   
20.     //~ Constructors ===================================================================================================  
21.   
22.     /\*\* 
23.      \* This constructor can be safely used by any code that wishes to create a 
24.      \* <code>UsernamePasswordAuthenticationToken</code>, as the \{@link 
25.      \* \#isAuthenticated()\} will return <code>false</code>. 
26.      \* 
27.      \*/  
28.     public KdUsernamePasswordAuthenticationToken(Object principal, Object credentials,String type) \{  
29.         super(null);  
30.         this.principal = principal;  
31.         this.credentials = credentials;  
32.         this.type = type;  
33.         setAuthenticated(false);  
34.     \}  
35.   
36.     /\*\* 
37.      \* This constructor should only be used by <code>AuthenticationManager</code> or <code>AuthenticationProvider</code> 
38.      \* implementations that are satisfied with producing a trusted (i.e. \{@link \#isAuthenticated()\} = <code>true</code>) 
39.      \* authentication token. 
40.      \* 
41.      \* @param principal 
42.      \* @param credentials 
43.      \* @param authorities 
44.      \*/  
45.     public KdUsernamePasswordAuthenticationToken(Object principal, Object credentials,String type, Collection<? extends GrantedAuthority> authorities) \{  
46.         super(authorities);  
47.         this.principal = principal;  
48.         this.credentials = credentials;  
49.         this.type = type;  
50.         super.setAuthenticated(true); // must use super, as we override  
51.     \}  
52.   
53.   
54.     //~ Methods ========================================================================================================  
55.   
56.     public Object getCredentials() \{  
57.         return this.credentials;  
58.     \}  
59.   
60.     public Object getPrincipal() \{  
61.         return this.principal;  
62.     \}  
63.   
64.     public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException \{  
65.         if (isAuthenticated) \{  
66.             throw new IllegalArgumentException(  
67.                 "Once created you cannot set this token to authenticated. Create a new instance using the constructor which takes a GrantedAuthority list will mark this as authenticated.");  
68.         \}  
69.   
70.         super.setAuthenticated(false);  
71.     \}  
72.   
73.     @Override  
74.     public void eraseCredentials() \{  
75.         super.eraseCredentials();  
76.         credentials = null;  
77.     \}  
78.   
79.     public String getType() \{  
80.         return type;  
81.     \}  
82.   
83.     public void setType(String type) \{  
84.         this.type = type;  
85.     \}  
86.   
87.       
88.       
89.   
90. \}

provider 重写了  密码校验方法，并且默认使用了KdJdbcDaoImpl去查询用户信息

KdAbstractUserDetailsAuthenticationProvider跟AbstractUserDetailsAuthenticationProvider一样仅仅改了authenticate方法里面的

Assert.isInstanceOf(KdUsernamePasswordAuthenticationToken.class,

**\[java\]**  [view plain][]  [copy][view plain]

1.  package com.test.hello.security;  
2.    
3.  import org.springframework.security.authentication.BadCredentialsException;  
4.  import org.springframework.security.authentication.InternalAuthenticationServiceException;  
5.  import org.springframework.security.core.AuthenticationException;  
6.  import org.springframework.security.core.userdetails.UserDetails;  
7.  import org.springframework.security.core.userdetails.UserDetailsService;  
8.  import org.springframework.security.core.userdetails.UsernameNotFoundException;  
9.    
10. public class KdDaoAuthenticationProvider extends KdAbstractUserDetailsAuthenticationProvider\{  
11.       
12.     private UserDetailsService userDetailsService = new KdJdbcDaoImpl();  
13.   
14.     public UserDetailsService getUserDetailsService() \{  
15.         return userDetailsService;  
16.     \}  
17.   
18.     public void setUserDetailsService(UserDetailsService userDetailsService) \{  
19.         this.userDetailsService = userDetailsService;  
20.     \}  
21.   
22.     @Override  
23.     public boolean supports(Class<?> authentication) \{  
24.         return (KdUsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication));  
25.     \}  
26.   
27.     @SuppressWarnings("deprecation")  
28.     @Override  
29.     protected void additionalAuthenticationChecks(UserDetails userDetails,  
30.             KdUsernamePasswordAuthenticationToken authentication)  
31.             throws AuthenticationException \{  
32.          if (authentication.getCredentials() == null) \{  
33.                 logger.debug("Authentication failed: no credentials provided");  
34.   
35.                 throw new BadCredentialsException(messages.getMessage(  
36.                         "AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"), userDetails);  
37.             \}  
38.   
39.             String presentedPassword = authentication.getCredentials().toString();  
40.   
41.             if (!userDetails.getPassword().equals(presentedPassword)) \{  
42.                 logger.debug("Authentication failed: password does not match stored value");  
43.   
44.                 throw new BadCredentialsException(messages.getMessage(  
45.                         "AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"), userDetails);  
46.             \}else\{  
47.                 KdJdbcDaoImpl.userpass.remove(userDetails.getUsername());  
48.             \}  
49.           
50.     \}  
51.       
52.       
53.   
54.       
55.   
56.     @Override  
57.     protected UserDetails retrieveUser(String username,  
58.             KdUsernamePasswordAuthenticationToken authentication)  
59.             throws AuthenticationException \{  
60.          UserDetails loadedUser;  
61.   
62.             try \{  
63.                 loadedUser = this.getUserDetailsService().loadUserByUsername(username);  
64.             \} catch (UsernameNotFoundException notFound) \{  
65.                 throw notFound;  
66.             \} catch (Exception repositoryProblem) \{  
67.                 throw new InternalAuthenticationServiceException(repositoryProblem.getMessage(), repositoryProblem);  
68.             \}  
69.   
70.             if (loadedUser == null) \{  
71.                 throw new InternalAuthenticationServiceException(  
72.                         "UserDetailsService returned null, which is an interface contract violation");  
73.             \}  
74.             return loadedUser;  
75.     \}  
76.       
77.       
78. \}

KdJdbcDaoImpl

**\[java\]**  [view plain][]  [copy][view plain]

1.  package com.test.hello.security;  
2.    
3.  import java.util.ArrayList;  
4.  import java.util.List;  
5.  import java.util.concurrent.ConcurrentHashMap;  
6.    
7.  import org.springframework.security.core.authority.AuthorityUtils;  
8.  import org.springframework.security.core.userdetails.User;  
9.  import org.springframework.security.core.userdetails.UserDetails;  
10. import org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl;  
11.   
12. public class KdJdbcDaoImpl extends JdbcDaoImpl\{  
13.       
14.     public static ConcurrentHashMap<String,String> userpass = new ConcurrentHashMap<String, String>();  
15.   
16.     @Override  
17.     protected List<UserDetails> loadUsersByUsername(String username) \{  
18.         List<UserDetails> list = new ArrayList<UserDetails>();  
19.          String password = userpass.get(username);  
20.          if(password != null)\{  
21.              list.add(new User(username, password, true, true, true, true, AuthorityUtils.NO\_AUTHORITIES));  
22.          \}  
23.           
24.          return list;  
25.     \}  
26.       
27.       
28.        
29.   
30.   
31. \}

最后的配置

**\[java\]**  [view plain][]  [copy][view plain]

1.  <security:http pattern="/resource/\*\*" security="none"></security:http>  
2.       <security:http pattern="/index.jsp" security="none"></security:http>  
3.        <security:http pattern="/" security="none"></security:http>  
4.         <security:http pattern="/checkcode" security="none"></security:http>  
5.       <security:http  entry-point-ref="loginUrlAuthenticationEntryPoint" >  
6.          <security:intercept-url pattern="/role/user\*\*" access="ROLE\_USER"/>  
7.          <security:intercept-url pattern="/role/admin\*\*" access="ROLE\_ADMIN"/>  
8.          <security:intercept-url pattern="/role/manager\*\*" access="ROLE\_MANAGER"/>  
9.          <security:custom-filter ref="kdUsernamePasswordAuthenticationFilter" position="FORM\_LOGIN\_FILTER"/>  
10.         <security:custom-filter ref="logoutFilter" position="LOGOUT\_FILTER"/>  
11.         <security:access-denied-handler ref="accessDeniedHandlerImpl"/>  
12.      </security:http>   
13.      
14.     
15.      <bean id="accessDeniedHandlerImpl" class="org.springframework.security.web.access.AccessDeniedHandlerImpl">  
16.       <property name="errorPage" value="/errorPage.jsp"></property>  
17.      </bean>  
18.      <bean id="loginUrlAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">  
19.      <property name="loginFormUrl" value="/index.jsp"></property>  
20.     </bean>  
21.       
22.     <bean id="kdUsernamePasswordAuthenticationFilter" class="com.test.hello.security.KdUsernamePasswordAuthenticationFilter">  
23.     <property name="authenticationManager" ref="org.springframework.security.authenticationManager"></property>  
24.     <property name="authenticationSuccessHandler" ref="savedRequestAwareAuthenticationSuccessHandler"></property>  
25.     <property name="authenticationFailureHandler" ref="simpleUrlAuthenticationFailureHandler"></property>  
26.     </bean>  
27.       
28.     <bean id="savedRequestAwareAuthenticationSuccessHandler" class="com.test.hello.security.KdSavedRequestAwareAuthenticationSuccessHandler">  
29.     <property name="defaultTargetUrl" value="/loginSuccess"></property>  
30.     </bean>  
31.     <bean id="simpleUrlAuthenticationFailureHandler" class="com.test.hello.security.KdSimpleUrlAuthenticationFailureHandler">  
32.     <property name="defaultFailureUrl" value="/index.jsp"></property>  
33.     </bean>  
34.       
35.     <bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">  
36.     <property name="filterProcessesUrl" value="/logout"></property>  
37.     <constructor-arg index="0" >  
38.      <bean class="org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler">  
39.       <property name="defaultTargetUrl" value="/index.jsp"></property>  
40.      </bean>  
41.     </constructor-arg>  
42.     <constructor-arg index="1">  
43.       <array>  
44.         <bean class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"></bean>  
45.       </array>  
46.     </constructor-arg>  
47.     </bean>  
48.        
49.        
50.       <bean id="org.springframework.security.authenticationManager" name="authenticationManager" class="org.springframework.security.authentication.ProviderManager" >    
51.             <property name="authenticationEventPublisher" ref="defaultAuthenticationEventPublisher"></property>    
52.             <property name="providers">    
53.                 <list>    
54.                     <ref bean="daoAuthenticationProvider"/>    
55.                     <ref bean="anonymousAuthenticationProvider"/>    
56.                     <ref bean="kdDaoAuthenticationProvider"/>  
57.                 </list>    
58.             </property>    
59.         </bean>    
60.             
61.         <bean id="defaultAuthenticationEventPublisher" class="org.springframework.security.authentication.DefaultAuthenticationEventPublisher"></bean>    
62.             
63.         <bean id="anonymousAuthenticationProvider" class="org.springframework.security.authentication.AnonymousAuthenticationProvider">    
64.             <property name="key" value="work"></property>    
65.         </bean>    
66.             
67.         <bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">    
68.             <property name="userDetailsService" ref="userService"></property>    
69.              
70.         </bean>    
71.         <bean id="userService" class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl">  
72.         <property name="dataSource" ref="dataSource"></property>  
73.         </bean>  
74.           
75.         <bean id="kdDaoAuthenticationProvider" class="com.test.hello.security.KdDaoAuthenticationProvider">  
76.         <property name="userDetailsService" ref="kdJdbcDaoImpl"></property>  
77.         </bean>  
78.           
79.         <bean id="kdJdbcDaoImpl" class="com.test.hello.security.KdJdbcDaoImpl">  
80.         <property name="dataSource" ref="dataSource"></property>  
81.         </bean>  
82.

**\[java\]**  [view plain][]  [copy][view plain]

1.  <%@ page language="java" import="java.util.\*" pageEncoding="UTF-8"%>  
2.  <%  
3.  String path = request.getContextPath();  
4.  String basePath = request.getScheme()+"://"\+request.getServerName()+":"\+request.getServerPort()+path+"/";  
5.  %>  
6.    
7.  <%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>   
8.  <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">  
9.  <html>  
10.   <head>  
11.     <base href="<%=basePath%>">  
12.       
13.     <title>My JSP 'index.jsp' starting page</title>  
14.       
15.     <meta http-equiv="pragma" content="no-cache">  
16.     <meta http-equiv="cache-control" content="no-cache">  
17.     <meta http-equiv="expires" content="0">      
18.     <meta http-equiv="keywords" content="keyword1,keyword2,keyword3">  
19.     <meta http-equiv="description" content="This is my page">  
20.     <script type="text/javascript" src="resource/js/jquery.min.js"></script>  
21.     <script type="text/javascript">  
22.     $(function()\{  
23.         $("\#jtypese").change(function()\{  
24.              var v = $("\#jtypese").val();  
25.              if(v=='2')\{  
26.                  var uname = $("\#usernameinput").val();  
27.                  var url = "<%=basePath%>checkcode?username="\+uname;  
28.                  $.get(url,function(data,status)\{  
29.                         alert("验证码: " + data + "\\n发送状态: " + status);  
30.                       \});  
31.              \}  
32.         \});  
33.     \});  
34.     </script>  
35.   
36.   </head>  
37.     
38.   <body>  
39.     This is my login page. <br>  
40.     <form action="j\_spring\_security\_check" method="post">  
41.     <table>  
42.     <tr><td>用户名:</td><td><input name="j\_username" value="u1" id="usernameinput"></td></tr>  
43.     <tr><td>密码/验证码:</td><td><input name="j\_password" value="p1"></td></tr>  
44.     <tr><td>登录方式: </td><td><select name="j\_type" id="jtypese"><option value="1">密码</option><option value="2">验证码</option></select></td></tr>  
45.     <tr><td colspan="2"> <input type="submit" value="submit"></td></tr>  
46.     </table>  
47.     </form>  
48.       
49.    异常： $\{SPRING\_SECURITY\_LAST\_EXCEPTION \}<br>  
50.   失败次数：  $\{SPRING\_SESSION\_FAIL\_TIMES \}  
51.   </body>  
52. </html>

[view plain]: https://blog.csdn.net/u013038630/article/details/51881755#