SpringSecurity之短信验证码

清疚 2023-06-29 07:30 22阅读 0赞

短信验证码流程大致与图形验证码一致，在图形验证码笔记中已经记录了短信验证码相关配置，此处不再记录。

## 验证码生成 ##

短信验证码生成接口已经完成，编写短信验证码发送接口SmsCodeSender：

/** * 发送短信验证码接口 * * @param type * 短信类别 * @param mobile * 手机号 * @param code * 验证码 */
    void send(String type, String mobile, String code);

实现类：

package com.cong.security.core.code.sms;
    
    import org.springframework.social.connect.UsersConnectionRepository;
    import lombok.extern.slf4j.Slf4j;
    
    /** * 此接口作用是防止用户未实现SmsCodeSender接口，如果用户自己实现SmsCodeSender接口则使用用户自己的处理方式，否则使用以下处理方式 * * @author single-聪 */
    @Slf4j
    public class SmsCodeSenderImpl implements SmsCodeSender { 
    
        @Override
        public void send(String type, String mobile, String code) { 
            // 调用三方发送短信验证码,实际开发中发送完成之后要存储
            log.info("向手机号[{}]发送[{}]类型短信验证码[{}]", mobile, type, code);
        }
    }

短信验证码发送接口CodeController：

// 短信验证码接口
    @Autowired
    private ValidateCodeGenerator smsCodeGenerator;
    // 发送短信接口
    @Autowired
    private SmsCodeSender smsCodeSender;
    
    /** * 用户短信发送接口 * * @param mobile * 手机号 * @param type * 类型 * @author single-聪 * @date 2019年10月16日 * @version 1.0.1 */
    @RequestMapping(value = "sms", method = RequestMethod.POST, consumes = "application/json;charset=UTF-8")
    public void sms(@RequestBody String c) { 
    	// 登录,绑定,密码重置等,使用当前接口
    	JSONObject strj = (JSONObject) JSONObject.parseObject(c);
    	String mobile = strj.getString("mobile");
    	String type = strj.getString("type");
    	ValidateCode smsCode = smsCodeGenerator.generate();
    	// 放到redis缓存中，设置过期时间(分类型存储)
    	smsCodeSender.send(type, mobile, smsCode.getCode());
    }

采用AJAX调用的方式，所以不编写HTML页面，直接使用POSTMAN模拟。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n_size_16_color_FFFFFF_t_70]  
后台日志：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n_size_16_color_FFFFFF_t_70 1]

## 验证码登录 ##

流程图  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n_size_16_color_FFFFFF_t_70 2]  
SmsAuthenticationToken.java：  
模仿UsernamePasswordAuthenticationToken编写

package com.cong.security.core.code.sms;
    
    import java.util.Collection;
    import org.springframework.security.authentication.AbstractAuthenticationToken;
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.SpringSecurityCoreVersion;
    
    /** * 封装短信登录信息，模仿UsernamePasswordAuthenticationToken写 * @author single-聪 */
    public class SmsCodeAuthenticationToken extends AbstractAuthenticationToken { 
    
    	
    	private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
    
    	/*认证信息 */
    	private final Object principal;
    
    	// 手机号
    	/** * This constructor can be safely used by any code that wishes to create a * <code>UsernamePasswordAuthenticationToken</code>, as the * {@link #isAuthenticated()} will return <code>false</code>. * */
    	public SmsCodeAuthenticationToken(String mobile) { 
    		super(null);
    		this.principal = mobile;
    		// 未登录存放手机号，登陆成功存放用户信息(此处为未登录)
    		setAuthenticated(false);
    	}
    
    	/** * This constructor should only be used by * <code>AuthenticationManager</code> or <code>AuthenticationProvider</code> * implementations that are satisfied with producing a trusted (i.e. * {@link #isAuthenticated()} = <code>true</code>) authentication token. * * @param principal * @param authorities */
    	public SmsCodeAuthenticationToken(Object principal, Collection<? extends GrantedAuthority> authorities) { 
    		super(authorities);
    		this.principal = principal;
    		// 登陆成功存放用户信息(此处为用户信息)
    		super.setAuthenticated(true); // must use super, as we override
    	}
    
    	public Object getPrincipal() { 
    		return this.principal;
    	}
    
    	public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException { 
    		if (isAuthenticated) { 
    			throw new IllegalArgumentException(
    					"Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
    		}
    		super.setAuthenticated(false);
    	}
    
    	@Override
    	public Object getCredentials() { 
    		return null;
    	}
    
    	@Override
    	public void eraseCredentials() { 
    		super.eraseCredentials();
    	}
    }

SmsCodeAuthenticationFilter：  
模仿UsernamePasswordAuthenticationToken编写

package com.cong.security.core.code.sms;
    
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    
    import org.springframework.security.authentication.AuthenticationServiceException;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
    import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
    import org.springframework.util.Assert;
    
    import lombok.extern.slf4j.Slf4j;
    
    /** * 封装短信登录信息，模仿UsernamePasswordAuthenticationToken写 * * @author single-聪 * */
    @Slf4j
    public class SmsCodeAuthenticationFilter extends AbstractAuthenticationProcessingFilter { 
    
    	// 手机号参数名称
    	public static final String SPRING_SECURITY_FORM_MOBILE_KEY = "mobile";
    
    	private String mobileParameter = SPRING_SECURITY_FORM_MOBILE_KEY;
    	// 只处理post请求
    	private boolean postOnly = true;
    
    	public SmsCodeAuthenticationFilter() { 
    		super(new AntPathRequestMatcher("/login/sms", "POST"));
    	}
    
    	public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
    			throws AuthenticationException { 
    		log.info("判断用户登录类型postOnly:[{}]....:[{}]", postOnly, request.getMethod());
    		if (postOnly && !request.getMethod().equals("POST")) { 
    			throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
    		}
    		String mobile = obtainMobile(request);
    		if (mobile == null) { 
    			mobile = "";
    		}
    		mobile = mobile.trim();
    		SmsCodeAuthenticationToken authRequest = new SmsCodeAuthenticationToken(mobile);
    		// Allow subclasses to set the "details" property
    		setDetails(request, authRequest);
    		return this.getAuthenticationManager().authenticate(authRequest);
    	}
    
    	/** * 获取手机号的方法 * * @param request * 请求 * @return 手机号 */
    	protected String obtainMobile(HttpServletRequest request) { 
    		return request.getParameter(mobileParameter);
    	}
    
    	/** * Provided so that subclasses may configure what is put into the * authentication request's details property. * * @param request * that an authentication request is being created for * @param authRequest * the authentication request object that should have its details * set */
    	protected void setDetails(HttpServletRequest request, SmsCodeAuthenticationToken authRequest) { 
    		authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
    	}
    
    	/** * Sets the parameter name which will be used to obtain the username from * the login request. * * @param mobileParameter * the parameter name. Defaults to "mobile". */
    	public void setUsernameParameter(String mobileParameter) { 
    		Assert.hasText(mobileParameter, "mobile parameter must not be empty or null");
    		this.mobileParameter = mobileParameter;
    	}
    
    	/** * Defines whether only HTTP POST requests will be allowed by this filter. * If set to true, and an authentication request is received which is not a * POST request, an exception will be raised immediately and authentication * will not be attempted. The <tt>unsuccessfulAuthentication()</tt> method * will be called as if handling a failed authentication. * <p> * Defaults to <tt>true</tt> but may be overridden by subclasses. */
    	public void setPostOnly(boolean postOnly) { 
    		this.postOnly = postOnly;
    	}
    
    	public final String getMobileParameter() { 
    		return mobileParameter;
    	}
    }

SmsCodeAuthenticationProvider：

package com.cong.security.core.code.sms;
    
    import org.springframework.security.authentication.AuthenticationProvider;
    import org.springframework.security.authentication.InternalAuthenticationServiceException;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import lombok.extern.slf4j.Slf4j;
    
    @Slf4j
    public class SmsCodeAuthenticationProvider implements AuthenticationProvider { 
    
    	private UserDetailsService userDetailsService;
    
    	/** * 进行身份认证的逻辑 */
    	@Override
    	public Authentication authenticate(Authentication authentication) throws AuthenticationException { 
    		// 强转
    		SmsCodeAuthenticationToken authenticationToken = (SmsCodeAuthenticationToken) authentication;
    		// 根据手机号查询用户信息(用户名即手机号),这个接口逻辑实现可以自定义
    		UserDetails user = userDetailsService.loadUserByUsername((String) authenticationToken.getPrincipal());
    		if (user == null) { 
    			log.info("用户信息获取失败,直接返回");
    			throw new InternalAuthenticationServiceException("无法获取用户信息");
    		}
    		// 构造函数,用户信息+用户权限
    		SmsCodeAuthenticationToken authenticationResult = new SmsCodeAuthenticationToken(user, user.getAuthorities());
    		authenticationResult.setDetails(authenticationToken.getDetails());
    		return authenticationResult;
    	}
    
    	@Override
    	public boolean supports(Class<?> authentication) { 
    		// 判断传入类型是否为SmsCodeAuthenticationToken类型
    		return SmsCodeAuthenticationToken.class.isAssignableFrom(authentication);
    	}
    
    	public void setUserDetailsService(UserDetailsService userDetailsService) { 
    		this.userDetailsService = userDetailsService;
    	}
    }

短信验证码校验过滤器SmsCodeFilter：

package com.cong.security.core.code;
    
    import java.io.IOException;
    import java.util.HashSet;
    import java.util.Set;
    import javax.servlet.FilterChain;
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import com.cong.security.core.code.sms.SmsCodeSender;
    import com.cong.security.core.properties.SecurityProperties;
    import org.apache.commons.lang3.StringUtils;
    import org.springframework.beans.factory.InitializingBean;
    import org.springframework.security.web.authentication.AuthenticationFailureHandler;
    import org.springframework.social.connect.UsersConnectionRepository;
    import org.springframework.util.AntPathMatcher;
    import org.springframework.web.bind.ServletRequestBindingException;
    import org.springframework.web.bind.ServletRequestUtils;
    import org.springframework.web.context.request.ServletWebRequest;
    import org.springframework.web.filter.OncePerRequestFilter;
    import lombok.extern.slf4j.Slf4j;
    
    @Slf4j
    public class SmsCodeFilter extends OncePerRequestFilter implements InitializingBean { 
    
        /** * 失败处理器 */
        private AuthenticationFailureHandler myAuthenticationFailureHandler;
    
        private SmsCodeSender smsCodeSender;
    
        private UsersConnectionRepository usersConnectionRepository;
    
        public void setUsersConnectionRepository(UsersConnectionRepository usersConnectionRepository) { 
            this.usersConnectionRepository = usersConnectionRepository;
        }
    
        public void setSmsCodeSender(SmsCodeSender smsCodeSender) { 
            this.smsCodeSender = smsCodeSender;
        }
    
        /** * 存放需要拦截的Url */
        private Set<String> urls = new HashSet<>();
    
        private SecurityProperties securityProperties;
    
        public void setMyAuthenticationFailureHandler(AuthenticationFailureHandler myAuthenticationFailureHandler) { 
            this.myAuthenticationFailureHandler = myAuthenticationFailureHandler;
        }
    
        public void setSecurityProperties(SecurityProperties securityProperties) { 
            this.securityProperties = securityProperties;
        }
    
        private AntPathMatcher antPathMatcher = new AntPathMatcher();
    
        @Override
        public void afterPropertiesSet() throws ServletException { 
            super.afterPropertiesSet();
            String[] configUrls = StringUtils
                    .splitByWholeSeparatorPreserveAllTokens(securityProperties.getCode().getSms().getUrl(), ",");
            for (String string : configUrls) { 
                urls.add(string);
            }
        }
    
        @Override
        protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
                throws ServletException, IOException { 
            // 登录请求才起作用且必须是post请求
            // 判断用户登录请求是否需要先进行验证码校验
            boolean match = false;
            for (String url : urls) { 
                if (antPathMatcher.match(url, request.getRequestURI())) { 
                    match = true;
                }
            }
            // 如果需要进行验证码校验
            if (match) { 
                try { 
                    validate(new ServletWebRequest(request));
                } catch (CodeException e) { 
                    myAuthenticationFailureHandler.onAuthenticationFailure(request, response, e);
                    return;
                }
            }
            filterChain.doFilter(request, response);
        }
    
        private void validate(ServletWebRequest request) throws ServletRequestBindingException { 
            // 手机号
            String mobile = ServletRequestUtils.getStringParameter(request.getRequest(), "mobile");
            // 验证码
            String code = ServletRequestUtils.getStringParameter(request.getRequest(), "code");
            // 类型(注册,修改密码,绑定),关键是绑定,绑定时需要知道用户当前设备号,原因是用户在使用三方登录的时候手机号未知
            String type = ServletRequestUtils.getStringParameter(request.getRequest(), "type");
            // 设备标识,用以鉴别用户
            String deviceId = ServletRequestUtils.getStringParameter(request.getRequest(), "deviceId");
            log.info("[{}]用户输入短信验证码值为[{}]...[{}]...[{}]", mobile, code, type, deviceId);
            if (mobile != null && code != null && type != null && deviceId != null) { 
            	// 短信验证码验证逻辑
                String test = smsCodeSender.test(usersConnectionRepository, type, mobile, code, deviceId);
                // 用户未输入值
                if (!test.equals("success")) { 
                    throw new CodeException("短信验证码不匹配");
                }
                // 验证成功，将验证码从session中移除
            } else { 
                throw new CodeException("SMS verification code failed to verify");
            }
        }
    }

配置使上述类生效并加入过滤器链：

package com.cong.security.core.code.sms;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.config.annotation.SecurityConfigurerAdapter;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.web.DefaultSecurityFilterChain;
    import org.springframework.security.web.authentication.AuthenticationFailureHandler;
    import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
    import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
    import org.springframework.stereotype.Component;
    
    @Component
    public class SmsCodeAuthenticationSecurityConfig
    		extends SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity> { 
    
    	@Autowired
    	private AuthenticationSuccessHandler myAuthenticationSuccessHandler;
    
    	@Autowired
    	private AuthenticationFailureHandler myAuthenticationFailureHandler;
    
    	@Autowired
    	private UserDetailsService userDetailsService;
    
    	@Override
    	public void configure(HttpSecurity http) throws Exception { 
    
    		SmsCodeAuthenticationFilter smsCodeAuthenticationFilter = new SmsCodeAuthenticationFilter();
    		smsCodeAuthenticationFilter.setAuthenticationManager(http.getSharedObject(AuthenticationManager.class));
    		// 成功失败处理器
    		smsCodeAuthenticationFilter.setAuthenticationSuccessHandler(myAuthenticationSuccessHandler);
    		smsCodeAuthenticationFilter.setAuthenticationFailureHandler(myAuthenticationFailureHandler);
    		SmsCodeAuthenticationProvider smsCodeAuthenticationProvider = new SmsCodeAuthenticationProvider();
    		smsCodeAuthenticationProvider.setUserDetailsService(userDetailsService);
    		// 加入过滤器链 
    		http.authenticationProvider(smsCodeAuthenticationProvider).addFilterAfter(smsCodeAuthenticationFilter,
    				UsernamePasswordAuthenticationFilter.class);
    	}
    }

配置短信验证码过滤器：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n_size_16_color_FFFFFF_t_70 3]  
此时启动项目模拟短信登录即可登陆成功：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n_size_16_color_FFFFFF_t_70 4]  
大致看一下短信发送及验证的接口逻辑：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n_size_16_color_FFFFFF_t_70 5]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200111152907252.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200111152956523.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200112171723772.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20200112220140985.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20200112220255119.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n_size_16_color_FFFFFF_t_70 5]: https://img-blog.csdnimg.cn/20200112220757914.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmdsZV9jb25n,size_16,color_FFFFFF,t_70