springboot（十五）安全框架 Spring Security

拼搏现实的明天。 2023-03-02 05:22 59阅读 0赞

1.pom依赖

2.代码演示

--------------------

**[官方参考][Link 1]**

Spring Security是一个提供身份验证，授权和保护以防止常见攻击的框架。凭借对命令式和响应式应用程序的一流支持，它是用于保护基于Spring的应用程序的事实上的标准。

### 1.pom依赖 ###

<dependencies>
        
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
    </dependencies>

## ##

### 2.代码演示 ###

public class AuthUser implements UserDetails {
    
        @Getter
        @Setter
        private String userId;
        @Setter
        private String username;
        private Set<GrantedAuthority> authorities;
    
    
        @Override
        public Collection<? extends GrantedAuthority> getAuthorities() {
            return authorities;
        }
    
        public void setAuthorities(List<AuthorityBuilder> authorities) {
            this.authorities = authorities.stream()
                    .map(authorityBuilder -> new SimpleGrantedAuthority(authorityBuilder.getAuthority()))
                    .collect(Collectors.toSet());
        }
    
        public Set<GrantedAuthority> authoritiesLocal() {
            return authorities;
        }
    
        public void setAuthoritySet(Set<GrantedAuthority> authorities) {
            this.authorities = authorities;
        }
    
        @Override
        public String getUsername() {
            return username;
        }
    
        @Override
        public String getPassword() {
            return "";
        }
    
        @Override
        public boolean isAccountNonExpired() {
            return true;
        }
    
        @Override
        public boolean isAccountNonLocked() {
            return true;
        }
    
        @Override
        public boolean isCredentialsNonExpired() {
            return true;
        }
    
        @Override
        public boolean isEnabled() {
            return true;
        }
    
        @Data
        private static class AuthorityBuilder {
            private String authority;
        }
    }

@Data
    public class Token {
        private String userToken;
    }

public class TokenFilter extends AbstractPreAuthenticatedProcessingFilter {
        private static final String USER_TOKEN_HEADER_NAME = "USER-TOKEN";
        private static final String TOKEN_CREDENTIALS_VALUE = "N/A";
    
        public TokenFilter(AuthenticationManager authenticationManager) {
            setAuthenticationManager(authenticationManager);
        }
    
        @Override
        public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
                throws IOException, ServletException {
            String url = ((HttpServletRequest) request).getRequestURI();
            if (StringUtils.startsWithIgnoreCase(url, "/internal/api/")) {
                if (chain != null) {
                    chain.doFilter(request, response);
                }
                return;
            }
            super.doFilter(request, response, chain);
        }
    
        @Override
        protected Object getPreAuthenticatedPrincipal(HttpServletRequest request) {
            Token token = new Token();
            token.setUserToken(request.getHeader(USER_TOKEN_HEADER_NAME));
            return token;
        }
    
        @Override
        protected Object getPreAuthenticatedCredentials(HttpServletRequest request) {
            return TOKEN_CREDENTIALS_VALUE;
        }
    }

@EnableGlobalMethodSecurity(prePostEnabled = true)
    @EnableWebSecurity
    public class MySecurityConfig extends WebSecurityConfigurerAdapter {
        private AuthService authService;
    
        //授权
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.exceptionHandling().authenticationEntryPoint(getAuthenticationEntryPoint());
            http.authorizeRequests().anyRequest().permitAll();
            http.csrf().disable().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
            http.addFilterBefore(tokenFiler(), UsernamePasswordAuthenticationFilter.class);
        }
    
        //认证
        @Override
        protected void configure(AuthenticationManagerBuilder auth) {
            PreAuthenticatedAuthenticationProvider provider = new PreAuthenticatedAuthenticationProvider();
            provider.setPreAuthenticatedUserDetailsService(authService);
            auth.authenticationProvider(provider);
        }
    
        @Bean
        public AbstractPreAuthenticatedProcessingFilter tokenFiler() throws Exception {
            return new TokenFilter(authenticationManager());
        }
    
        @Bean
        public PasswordEncoder getPasswordEncoder() {
            return new BCryptPasswordEncoder();
        }
    
        @Bean
        public HttpStatusEntryPoint getAuthenticationEntryPoint() {//提示消息
            return new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED);
        }
    
        @Autowired
        public void setAuthService(AuthService authService) {
            this.authService = authService;
        }
    
    }

public interface AuthService extends AuthenticationUserDetailsService<PreAuthenticatedAuthenticationToken> {
    }

@Service
    public class AuthServiceImpl implements AuthService {
    
        @Autowired
        private AuthUserService authUserService;
    
        @Override
        public UserDetails loadUserDetails(PreAuthenticatedAuthenticationToken authenticationToken) throws UsernameNotFoundException {
            AuthUser authUser = new AuthUser();
            Object principal = authenticationToken.getPrincipal();
            if (!(principal instanceof Token)) {
                return authUser;
            }
            Token token = (Token) principal;
            return authUserService.getAuthUserByToken(token.getUserToken());
        }
    }

public interface AuthUserService {
    
        AuthUser getAuthUserByToken(String token);
    }

@Service
    public class AuthUserServiceImpl implements AuthUserService {
    
        @Override
        public AuthUser getAuthUserByToken(String token) {
            AuthUser authUser = new AuthUser();
            authUser.setUserId("111");
            authUser.setUsername("222");
            Set<GrantedAuthority> authorities = new HashSet<>();
            authorities.add(new SimpleGrantedAuthority("ROLE_AUTH"));
            authUser.setAuthoritySet(authorities);
            return authUser;
        }
    }

@RestController
    public class SecurityController {
    
    
        @GetMapping("/security")
        @PreAuthorize("hasRole('ROLE_AUTH')")
        public String security(@AuthenticationPrincipal AuthUser authUser,
                               @RequestHeader(value = "USER-TOKEN",required = false) String userToken) throws JsonProcessingException {
            System.out.println("TOKEN:" + userToken);
            ObjectMapper objectMapper = new ObjectMapper();
            System.out.println("authUser:" + objectMapper.writeValueAsString(authUser));
            return userToken;
        }
    
        @GetMapping("/message")
        @PreAuthorize("authenticated")
        public String getMessage() {
            Authentication authentication = SecurityContextHolder.getContext()
                    .getAuthentication();
            return "Hello " + authentication;
        }
    }

[Link 1]: https://docs.spring.io/spring-security/site/docs/5.3.3.BUILD-SNAPSHOT/reference/html5/#jc