Spring Security学习(二)

逃离我推掉我的手 2022-06-02 09:29 263阅读 0赞

> 以下配置基于表单登录配置

### 自定义配置登录页面 ###

@Override
    protected void configure(HttpSecurity http) throws Exception {
        http.formLogin()
                 // 自定义页面路径
                .loginPage("/api/login")
                .and()
                .authorizeRequests()
                // 允许/api/login的URL访问 否则浏览器页面将提示重定向次数过多进入死循环
                .antMatchers("/api/login").permitAll()
                .anyRequest()
                .authenticated();
    }

### 自定义登录路径 ###

@Override
    protected void configure(HttpSecurity http) throws Exception {
        http.formLogin()
                 .loginPage("/api/login")
                // 自定义登录路径
                .loginProcessingUrl("/api/formlogin") 
                .and()
                .authorizeRequests()
                .antMatchers("/api/login").permitAll()
                .anyRequest()
                .authenticated();
    }

Spring Security 默认表单登录

public UsernamePasswordAuthenticationFilter() {
        super(new AntPathRequestMatcher("/login", "POST"));
    }

可设置loginProcessingUrl属性来替换默认登录地址

### 登录成功处理 ###

当用户登录成功后需要保存用户登录数据，比如IP地址，登录时间等

// 注入SecurityLoginSuccessHandler
    @Autowired
    private SecurityLoginSuccessHandler securityLoginSuccessHandler; 
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.formLogin()
                .loginPage("/api/login")
                // 自定义登录成功处理
                .successHandler(securityLoginSuccessHandler)
                .loginProcessingUrl("/api/formlogin")
                .and()
                .authorizeRequests()
                .antMatchers("/api/login","/static/*").permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .csrf().disable();
    }

SecurityLoginSuccessHandler

@Component public class SecurityLoginSuccessHandler implements AuthenticationSuccessHandler { // 重定向跳转类 private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy(); // 缓存请求路径，可获取拦截前的请求路径 private RequestCache requestCache = new HttpSessionRequestCache(); @Override public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException { System.out.println("登录成功"); // 获取拦截前请求路径 并通过RedirectStrategy进行重定向跳转 SavedRequest savedRequest = requestCache.getRequest(request, response); String redirectUrl = savedRequest.getRedirectUrl(); // todo do something this.redirectStrategy.sendRedirect(request, response, redirectUrl); } }

### 登录失败处理 ###

跟登录成功处理一样 只是实现接口不同而已

@Autowired
    private SecurityLoginFailHandler securityLoginFailHandler;
        
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.formLogin()
                .loginPage("/api/login")
                .successHandler(securityLoginSuccessHandler)
                // 自定义登录失败处理
                .failureHandler(securityLoginFailHandler)
                .loginProcessingUrl("/api/formlogin")
                .and()
                .authorizeRequests()
                .antMatchers("/api/login", "/static/*").permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .csrf().disable();
    }

SecurityLoginFailHandler

@Component public class SecurityLoginFailHandler implements AuthenticationFailureHandler { @Override public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException { System.out.println("登录失败"); // todo do something response.setCharacterEncoding("UTF-8"); response.setContentType("text/json;charset=UTF-8"); response.getWriter().write(exception.getMessage()); } }

### 退出登录 ###

默认是访问URL`/logout`将注销登陆的用户

自定义配置

@Autowired
    private SecurityLoginoutHandler securityLoginoutHandler;
    @Autowired
    private SecurityLoginoutSuccessHandler securityLoginoutSuccessHandler;
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.formLogin()
                .loginPage("/api/login")
                .successHandler(securityLoginSuccessHandler)
                .failureHandler(securityLoginFailHandler)
                .loginProcessingUrl("/api/formlogin")
                .and()
                .authorizeRequests()
                .antMatchers("/api/login", "/static/*").permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .logout()
                // 退出登录地址
                .logoutUrl("/logout")
                // 退出跳转路径
                .logoutSuccessUrl("/api/login")
                // 默认session失效
                .invalidateHttpSession(true)
                // 退出登录处理
                .addLogoutHandler(securityLoginoutHandler)
                // 退出登录成功处理
                .logoutSuccessHandler(securityLoginoutSuccessHandler)
                // 指定退出登录后需要删除的cookie名称，多个cookie之间以逗号分隔。 
    // .deleteCookies(cookieNamesToClear)
                .and()
                .csrf().disable();
    }

SecurityLoginoutHandler

用来执行必要的清理,因而他们不应该抛出错误

@Component public class SecurityLoginoutHandler implements LogoutHandler { @Override public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) { System.out.println("退出登录"); } }

SecurityLoginoutSuccessHandler

被LogoutFilter在成功注销后调用，用来进行重定向或者转发相应的目的地。注意这个接口与LogoutHandler几乎一样，但是可以抛出异常。

@Component public class SecurityLoginoutSuccessHandler implements LogoutSuccessHandler { private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy(); @Override public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException { System.out.println("退出登录成功执行"); this.redirectStrategy.sendRedirect(request, response, "/"); } }

### 自定义用户登录账号密码 ###

WebSecurityConfig

SecurityUserDetailService

### 自定义用户登录账号密码（密码加密） ###

WebSecurityConfig

@Autowired
    private SecurityUserDetailService securityUserDetailService;
    
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        // 在内存中写死用户数据
        auth.inMemoryAuthentication().withUser("123456").password("123456").roles("USER");
        // 动态获取用户数据 使用Security加密
        auth.userDetailsService(securityUserDetailService).passwordEncoder(new BCryptPasswordEncoder());
         
        // 配置验证方式为加密验证 
        DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
        authenticationProvider.setUserDetailsService(securityUserDetailService);
        authenticationProvider.setPasswordEncoder(new BCryptPasswordEncoder());
        auth.authenticationProvider(authenticationProvider);
    }

SecurityUserDetailService

/** * 自定义UserDetailService * * @author Peng */
    @Component
    public class SecurityUserDetailService implements UserDetailsService {
        /** * String password; 密码 * String username; 账户名 * Set<GrantedAuthority> authorities; 角色名 * boolean accountNonExpired; 账户没有过期 * boolean accountNonLocked; 帐号没有被锁定 * boolean credentialsNonExpired; 密码没有过期 * boolean enabled; 是否可用 */
        @Override
        public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
            // 这里写死的密码 实际应用中应该从数据库中获取 
            BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
            // 数据库创建用户数据时密码应通过Security加密后保存
            String password = encoder.encode("123456");
            System.out.println(password);
            User user = new User(username, password, true,
                    true,
                    true,
                    true,
                    AuthorityUtils.commaSeparatedStringToAuthorityList("USER"));
            return user;
        }
    }

PasswordEncoder

// 密码加密
    String encode(CharSequence rawPassword);
    // 验证密码是否吻合
    boolean matches(CharSequence rawPassword, String encodedPassword);

### 获取登录用户信息 ###

/** * 获取登录用户数据 */
    @RequestMapping("/api/getme")
    @ResponseBody
    public Object getLoginUser(Authentication authentication) {
        Map<String, Object> json = new HashMap<>();
        // 两种方法
        json.put("data", SecurityContextHolder.getContext().getAuthentication());
        json.put("data1", authentication);
        return json;
    }

### 资源权限限制 ###

WebSecurityConfig

.antMatchers("/api/me").hasRole("ADMIN")
     
     这样只要是访问“api/me”的路径就会验证用户身份，用户身份必须是ADMIN才允许访问

<table style="margin:1.5em 0px; width:825px; color:rgb(51,51,51); font-size:14px"> 
 <thead> 
  <tr> 
   <th style="padding:5px 8px; text-align:left; border-color:rgb(230,230,230); word-break:normal; background:rgb(243,243,243)"> 表达</th> 
   <th style="padding:5px 8px; text-align:left; border-color:rgb(230,230,230); word-break:normal; background:rgb(243,243,243)"> 描述</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">hasRole([role])</td> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">如果当前主体具有指定的角色，则返回true.</td> 
  </tr> 
  <tr> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">hasAnyRole([role1,role2])</td> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">如果当前的主体有任何提供的角色（给定的作为一个逗号分隔的字符串列表）的话，返回true</td> 
  </tr> 
  <tr> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">hasAuthority([authority])</td> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">如果当前的主体具有指定的权限，则返回 true.</td> 
  </tr> 
  <tr> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">hasAnyAuthority([authority1,authority2])</td> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">如果当前的主体有任何提供的角色（给定的作为一个逗号分隔的字符串列表）的话，返回true.</td> 
  </tr> 
  <tr> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">principal</td> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">允许直接访问表示当前用户的主对象</td> 
  </tr> 
  <tr> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">permitAll</td> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">允许所有用户访问</td> 
  </tr> 
  <tr> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">denyAll</td> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">不允许用户访问</td> 
  </tr> 
  <tr> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">isAnonymous()</td> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">如果当前的主体是一个匿名用户，则返回true.</td> 
  </tr> 
  <tr> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">isRememberMe()</td> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">如果当前的主体是一个匿名用户，则返回true</td> 
  </tr> 
  <tr> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">isAuthenticated()</td> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">如果用户不是匿名的，则返回 true</td> 
  </tr> 
  <tr> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">isFullyAuthenticated()</td> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">如果用户不是一个匿名的或是一个记住我的用户返回true</td> 
  </tr> 
  <tr> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">hasPermission(Object target, Object permission)</td> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">如果用户已访问给定权限的提供的目标，则返回true，例如hasPermission(domainObject, 'read')</td> 
  </tr> 
  <tr> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">hasPermission(Object targetId, String targetType, Object permission)</td> 
   <td style="padding:5px 8px; border-color:rgb(230,230,230); word-break:normal">如果用户已访问给定权限的提供的目标，则返回true,例如hasPermission(1, 'com.example.domain.Message', 'read')</td> 
  </tr> 
 </tbody> 
</table>

### 登录验证码 ###

首先得写一个获取验证码方法，方法能够生成随机验证码并且把验证码存入session供验证的功能，这里就不写了

因为Spring Security未提供验证码的接口，所以需要我们自己写一个过滤器处理

VaildCodeFilter 验证码校验过滤器

/**
     * Security 登录验证码验证
     *
     * @author Peng
     */
    public class VaildCodeFilter extends OncePerRequestFilter {
        private SecurityLoginFailHandler securityLoginFailHandler;
    
        @Override
        protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
            // 登录路径必须为/api/formlogin才生效
            if ("/api/formlogin".equals(request.getRequestURI())) {
                HttpSession session = request.getSession();
                try {
                    String code = request.getParameter(页面验证码字段);
                    String sessionCode = (String) session.getAttribute(验证码sessionId);
                    if (code == null || sessionCode == null) {
                        throw new VaildCodeException("验证码不存在");
                    }
                    if (!sessionCode.equals(code)) {
                        throw new VaildCodeException("验证码不匹配");
                    }
                } catch (VaildCodeException e) {
                    securityLoginFailHandler.onAuthenticationFailure(request, response, e);
                    return;
                }
                session.removeAttribute(验证码sessionId);
            }
            filterChain.doFilter(request, response);
        }
    
        public void setSecurityLoginFailHandler(SecurityLoginFailHandler securityLoginFailHandler) {
            this.securityLoginFailHandler = securityLoginFailHandler;
        }
    }

最后在WebSecurityConfig configure中配置

@Override
        protected void configure(HttpSecurity http) throws Exception {
            // 在UsernamePasswordAuthenticationFilter过滤器前添加自定义验证码过滤器
            VaildCodeFilter vaildCodeFilter = new VaildCodeFilter();
            vaildCodeFilter.setSecurityLoginFailHandler(securityLoginFailHandler);
            http.addFilterBefore(vaildCodeFilter, UsernamePasswordAuthenticationFilter.class);
            
            http.formLogin().loginPage("/api/login")
                    .successHandler(securityLoginSuccessHandler)
                    .failureHandler(securityLoginFailHandler)
                    .loginProcessingUrl("/api/formlogin");
            http.authorizeRequests()
                    .antMatchers("/api/login", "/static/*", "/api/codeImg").permitAll()
                    .antMatchers("/api/me").hasRole("ADMIN")
                    .anyRequest()
                    .authenticated();
            http.logout()
                    .logoutUrl("/logout")
                    .logoutSuccessUrl("/api/login")
                    .invalidateHttpSession(true)
                    .addLogoutHandler(securityLoginoutHandler)
                    .logoutSuccessHandler(securityLoginoutSuccessHandler);
            // 指定退出登录后需要删除的cookie名称，多个cookie之间以逗号分隔。
    //                .deleteCookies(cookieNamesToClear)
            http.csrf().disable();
        }