Spring REST + Spring 安全示例

朴灿烈づ我的快乐病毒、 2023-09-28 23:01 4阅读 0赞

![fea0e7d02708a941ed1116d7acf08a53.png][]

扫码关注《Java学研大本营》，加入读者群，分享更多精彩

### 项目目录 ###

![5a8c1fefe41f5613fdfab6e507681041.png][]

### Maven ###

包括Spring Security 的 **spring-boot-starter-security**

<?xml version="1.0" encoding="UTF-8"?>
    <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
        <modelVersion>4.0.0</modelVersion>
        <parent>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-parent</artifactId>
            <version>2.7.1</version>
            <relativePath/> 
        </parent>
        <groupId>com.example</groupId>
        <artifactId>springrestsecurity</artifactId>
        <version>0.0.1-SNAPSHOT</version>
        <name>spring-rest-security</name>
        <description>Demo project for Spring Boot</description>
        <properties>
            <java.version>1.8</java.version>
        </properties>
        <dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-thymeleaf</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-web</artifactId>
            </dependency>
    
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-configuration-processor</artifactId>
                <optional>true</optional>
            </dependency>
            <dependency>
                <groupId>org.projectlombok</groupId>
                <artifactId>lombok</artifactId>
                <optional>true</optional>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-test</artifactId>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-security</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.security</groupId>
                <artifactId>spring-security-test</artifactId>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-data-jpa</artifactId>
            </dependency>
            <dependency>
                <groupId>com.h2database</groupId>
                <artifactId>h2</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-devtools</artifactId>
                <optional>true</optional>
            </dependency>
            <dependency>
                <groupId>javax.validation</groupId>
                <artifactId>validation-api</artifactId>
                <version>2.0.1.Final</version>
            </dependency>
        </dependencies>
    
        <build>
            <plugins>
                <plugin>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-maven-plugin</artifactId>
                    <configuration>
                        <excludes>
                            <exclude>
                                <groupId>org.projectlombok</groupId>
                                <artifactId>lombok</artifactId>
                            </exclude>
                        </excludes>
                    </configuration>
                </plugin>
            </plugins>
        </build>
    
    </project>

项目依赖：

> mvn dependency:tree
    [INFO] Scanning for projects...
    [INFO] 
    [INFO] -------------------< com.example:springrestsecurity >-------------------
    [INFO] Building spring-rest-security 0.0.1-SNAPSHOT
    [INFO] --------------------------------[ jar ]---------------------------------
    [INFO] 
    [INFO] --- maven-dependency-plugin:3.3.0:tree (default-cli) @ springrestsecurity ---
    [INFO] com.example:springrestsecurity:jar:0.0.1-SNAPSHOT
    [INFO] +- org.springframework.boot:spring-boot-starter-thymeleaf:jar:2.7.1:compile
    [INFO] |  +- org.springframework.boot:spring-boot-starter:jar:2.7.1:compile
    [INFO] |  |  +- org.springframework.boot:spring-boot-starter-logging:jar:2.7.1:compile
    [INFO] |  |  |  +- ch.qos.logback:logback-classic:jar:1.2.11:compile
    [INFO] |  |  |  |  \- ch.qos.logback:logback-core:jar:1.2.11:compile
    [INFO] |  |  |  +- org.apache.logging.log4j:log4j-to-slf4j:jar:2.17.2:compile
    [INFO] |  |  |  |  \- org.apache.logging.log4j:log4j-api:jar:2.17.2:compile
    [INFO] |  |  |  \- org.slf4j:jul-to-slf4j:jar:1.7.36:compile
    [INFO] |  |  +- jakarta.annotation:jakarta.annotation-api:jar:1.3.5:compile
    [INFO] |  |  \- org.yaml:snakeyaml:jar:1.30:compile
    [INFO] |  +- org.thymeleaf:thymeleaf-spring5:jar:3.0.15.RELEASE:compile
    [INFO] |  |  +- org.thymeleaf:thymeleaf:jar:3.0.15.RELEASE:compile
    [INFO] |  |  |  +- org.attoparser:attoparser:jar:2.0.5.RELEASE:compile
    [INFO] |  |  |  \- org.unbescape:unbescape:jar:1.1.6.RELEASE:compile
    [INFO] |  |  \- org.slf4j:slf4j-api:jar:1.7.36:compile
    [INFO] |  \- org.thymeleaf.extras:thymeleaf-extras-java8time:jar:3.0.4.RELEASE:compile
    [INFO] +- org.springframework.boot:spring-boot-starter-web:jar:2.7.1:compile
    [INFO] |  +- org.springframework.boot:spring-boot-starter-json:jar:2.7.1:compile
    [INFO] |  |  +- com.fasterxml.jackson.core:jackson-databind:jar:2.13.3:compile
    [INFO] |  |  |  +- com.fasterxml.jackson.core:jackson-annotations:jar:2.13.3:compile
    [INFO] |  |  |  \- com.fasterxml.jackson.core:jackson-core:jar:2.13.3:compile
    [INFO] |  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:jar:2.13.3:compile
    [INFO] |  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.13.3:compile
    [INFO] |  |  \- com.fasterxml.jackson.module:jackson-module-parameter-names:jar:2.13.3:compile
    [INFO] |  +- org.springframework.boot:spring-boot-starter-tomcat:jar:2.7.1:compile
    [INFO] |  |  +- org.apache.tomcat.embed:tomcat-embed-core:jar:9.0.64:compile
    [INFO] |  |  +- org.apache.tomcat.embed:tomcat-embed-el:jar:9.0.64:compile
    [INFO] |  |  \- org.apache.tomcat.embed:tomcat-embed-websocket:jar:9.0.64:compile
    [INFO] |  +- org.springframework:spring-web:jar:5.3.21:compile
    [INFO] |  |  \- org.springframework:spring-beans:jar:5.3.21:compile
    [INFO] |  \- org.springframework:spring-webmvc:jar:5.3.21:compile
    [INFO] |     +- org.springframework:spring-context:jar:5.3.21:compile
    [INFO] |     \- org.springframework:spring-expression:jar:5.3.21:compile
    [INFO] +- org.springframework.boot:spring-boot-configuration-processor:jar:2.7.1:compile
    [INFO] +- org.projectlombok:lombok:jar:1.18.24:compile
    [INFO] +- org.springframework.boot:spring-boot-starter-test:jar:2.7.1:test
    [INFO] |  +- org.springframework.boot:spring-boot-test:jar:2.7.1:test
    [INFO] |  +- org.springframework.boot:spring-boot-test-autoconfigure:jar:2.7.1:test
    [INFO] |  +- com.jayway.jsonpath:json-path:jar:2.7.0:test
    [INFO] |  |  \- net.minidev:json-smart:jar:2.4.8:test
    [INFO] |  |     \- net.minidev:accessors-smart:jar:2.4.8:test
    [INFO] |  |        \- org.ow2.asm:asm:jar:9.1:test
    [INFO] |  +- jakarta.xml.bind:jakarta.xml.bind-api:jar:2.3.3:compile
    [INFO] |  |  \- jakarta.activation:jakarta.activation-api:jar:1.2.2:compile
    [INFO] |  +- org.assertj:assertj-core:jar:3.22.0:test
    [INFO] |  +- org.hamcrest:hamcrest:jar:2.2:test
    [INFO] |  +- org.junit.jupiter:junit-jupiter:jar:5.8.2:test
    [INFO] |  |  +- org.junit.jupiter:junit-jupiter-api:jar:5.8.2:test
    [INFO] |  |  |  +- org.opentest4j:opentest4j:jar:1.2.0:test
    [INFO] |  |  |  +- org.junit.platform:junit-platform-commons:jar:1.8.2:test
    [INFO] |  |  |  \- org.apiguardian:apiguardian-api:jar:1.1.2:test
    [INFO] |  |  +- org.junit.jupiter:junit-jupiter-params:jar:5.8.2:test
    [INFO] |  |  \- org.junit.jupiter:junit-jupiter-engine:jar:5.8.2:test
    [INFO] |  |     \- org.junit.platform:junit-platform-engine:jar:1.8.2:test
    [INFO] |  +- org.mockito:mockito-core:jar:4.5.1:test
    [INFO] |  |  +- net.bytebuddy:byte-buddy:jar:1.12.11:compile
    [INFO] |  |  +- net.bytebuddy:byte-buddy-agent:jar:1.12.11:test
    [INFO] |  |  \- org.objenesis:objenesis:jar:3.2:test
    [INFO] |  +- org.mockito:mockito-junit-jupiter:jar:4.5.1:test
    [INFO] |  +- org.skyscreamer:jsonassert:jar:1.5.0:test
    [INFO] |  |  \- com.vaadin.external.google:android-json:jar:0.0.20131108.vaadin1:test
    [INFO] |  +- org.springframework:spring-core:jar:5.3.21:compile
    [INFO] |  |  \- org.springframework:spring-jcl:jar:5.3.21:compile
    [INFO] |  +- org.springframework:spring-test:jar:5.3.21:test
    [INFO] |  \- org.xmlunit:xmlunit-core:jar:2.9.0:test
    [INFO] +- org.springframework.boot:spring-boot-starter-security:jar:2.7.1:compile
    [INFO] |  +- org.springframework:spring-aop:jar:5.3.21:compile
    [INFO] |  +- org.springframework.security:spring-security-config:jar:5.7.2:compile
    [INFO] |  \- org.springframework.security:spring-security-web:jar:5.7.2:compile
    [INFO] +- org.springframework.security:spring-security-test:jar:5.7.2:test
    [INFO] |  \- org.springframework.security:spring-security-core:jar:5.7.2:compile
    [INFO] |     \- org.springframework.security:spring-security-crypto:jar:5.7.2:compile
    [INFO] +- org.springframework.boot:spring-boot-starter-data-jpa:jar:2.7.1:compile
    [INFO] |  +- org.springframework.boot:spring-boot-starter-aop:jar:2.7.1:compile
    [INFO] |  |  \- org.aspectj:aspectjweaver:jar:1.9.7:compile
    [INFO] |  +- org.springframework.boot:spring-boot-starter-jdbc:jar:2.7.1:compile
    [INFO] |  |  +- com.zaxxer:HikariCP:jar:4.0.3:compile
    [INFO] |  |  \- org.springframework:spring-jdbc:jar:5.3.21:compile
    [INFO] |  +- jakarta.transaction:jakarta.transaction-api:jar:1.3.3:compile
    [INFO] |  +- jakarta.persistence:jakarta.persistence-api:jar:2.2.3:compile
    [INFO] |  +- org.hibernate:hibernate-core:jar:5.6.9.Final:compile
    [INFO] |  |  +- org.jboss.logging:jboss-logging:jar:3.4.3.Final:compile
    [INFO] |  |  +- antlr:antlr:jar:2.7.7:compile
    [INFO] |  |  +- org.jboss:jandex:jar:2.4.2.Final:compile
    [INFO] |  |  +- com.fasterxml:classmate:jar:1.5.1:compile
    [INFO] |  |  +- org.hibernate.common:hibernate-commons-annotations:jar:5.1.2.Final:compile
    [INFO] |  |  \- org.glassfish.jaxb:jaxb-runtime:jar:2.3.6:compile
    [INFO] |  |     +- org.glassfish.jaxb:txw2:jar:2.3.6:compile
    [INFO] |  |     +- com.sun.istack:istack-commons-runtime:jar:3.0.12:compile
    [INFO] |  |     \- com.sun.activation:jakarta.activation:jar:1.2.2:runtime
    [INFO] |  +- org.springframework.data:spring-data-jpa:jar:2.7.1:compile
    [INFO] |  |  +- org.springframework.data:spring-data-commons:jar:2.7.1:compile
    [INFO] |  |  +- org.springframework:spring-orm:jar:5.3.21:compile
    [INFO] |  |  \- org.springframework:spring-tx:jar:5.3.21:compile
    [INFO] |  \- org.springframework:spring-aspects:jar:5.3.21:compile
    [INFO] +- com.h2database:h2:jar:2.1.214:compile
    [INFO] +- org.springframework.boot:spring-boot-devtools:jar:2.7.1:compile
    [INFO] |  +- org.springframework.boot:spring-boot:jar:2.7.1:compile
    [INFO] |  \- org.springframework.boot:spring-boot-autoconfigure:jar:2.7.1:compile
    [INFO] \- javax.validation:validation-api:jar:2.0.1.Final:compile
    [INFO] ------------------------------------------------------------------------
    [INFO] BUILD SUCCESS
    [INFO] ------------------------------------------------------------------------
    [INFO] Total time:  2.451 s
    [INFO] Finished at: 2022-07-18T10:22:10+07:00
    [INFO] ------------------------------------------------------------------------

### Spring Controller ###

再次查看 Book Controller，稍后我们将与 Spring Security 集成以保护 REST 端点。

package com.example.springrestsecurity;
    
    import com.example.springrestsecurity.error.BookNotFoundException;
    import com.example.springrestsecurity.error.BookUnSupportedFieldPatchException;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.http.HttpStatus;
    import org.springframework.util.StringUtils;
    import org.springframework.validation.annotation.Validated;
    import org.springframework.web.bind.annotation.*;
    
    import javax.validation.Valid;
    import javax.validation.constraints.Min;
    import java.util.List;
    import java.util.Map;
    
    @RestController
    @Validated
    public class BookController {
    
        @Autowired
        private BookRepository repository;
    
        @GetMapping("/books")
        List<Book> findAll() {
            return repository.findAll();
        }
    
        @PostMapping("/books")
        @ResponseStatus(HttpStatus.CREATED)
        Book newBook(@Valid @RequestBody Book newBook) {
            return repository.save(newBook);
        }
    
        @GetMapping("/books/{id}")
        Book findOne(@PathVariable @Min(1) Long id) {
            return repository.findById(id)
                    .orElseThrow(() -> new BookNotFoundException(id));
        }
    
        @PutMapping("/books/{id}")
        Book saveOrUpdate(@RequestBody Book newBook, @PathVariable Long id) {
    
            return repository.findById(id)
                    .map(x -> {
                        x.setName(newBook.getName());
                        x.setAuthor(newBook.getAuthor());
                        x.setPrice(newBook.getPrice());
                        return repository.save(x);
                    })
                    .orElseGet(() -> {
                        newBook.setId(id);
                        return repository.save(newBook);
                    });
        }
    
        @PatchMapping("/books/{id}")
        Book patch(@RequestBody Map<String, String> update, @PathVariable Long id) {
    
            return repository.findById(id)
                    .map(x -> {
    
                        String author = update.get("author");
                        if (!StringUtils.isEmpty(author)) {
                            x.setAuthor(author);
                            return repository.save(x);
                        } else {
                            throw new BookUnSupportedFieldPatchException(update.keySet());
                        }
    
                    })
                    .orElseGet(() -> {
                        throw new BookNotFoundException(id);
                    });
    
        }
    
        @DeleteMapping("/books/{id}")
        void deleteBook(@PathVariable Long id) {
            repository.deleteById(id);
        }
    }

### Bean 验证（休眠验证器） ###

1.  则将自动启用 bean 验证 JSR-303 实现（如 Hibernate Validator）在类路径上可用， 默认情况下，Spring Boot 会自动获取并下载 Hibernate Validator。
2.  下面的 POST 请求将被传递，我们需要对 book 对象进行 bean 验证，以确保 name、author 和 price 等字段不为空。

@PostMapping("/books")
        @ResponseStatus(HttpStatus.CREATED)
        Book newBook(@Valid @RequestBody Book newBook) {
            return repository.save(newBook);
        }

使用 **javax.validation.constraints.**\* 注释对 bean 进行注释。

*  Book.java

package com.example.springrestsecurity;
    
    import com.example.springrestsecurity.error.validator.Author;
    
    import javax.persistence.Entity;
    import javax.persistence.GeneratedValue;
    import javax.persistence.Id;
    import javax.validation.constraints.DecimalMin;
    import javax.validation.constraints.NotEmpty;
    import javax.validation.constraints.NotNull;
    import java.math.BigDecimal;
    
    @Entity
    public class Book {
    
        @Id
        @GeneratedValue
        private Long id;
    
        @NotEmpty(message = "Please provide a name")
        private String name;
    
        @Author
        @NotEmpty(message = "Please provide a author")
        private String author;
    
        @NotNull(message = "Please provide a price")
        @DecimalMin("1.00")
        private BigDecimal price;
    
        public Book() {
        }
    
        public Book(Long id, String name, String author, BigDecimal price) {
            this.id = id;
            this.name = name;
            this.author = author;
            this.price = price;
        }
    
        public Book(String name, String author, BigDecimal price) {
            this.name = name;
            this.author = author;
            this.price = price;
        }
    
        public Long getId() {
            return id;
        }
    
        public void setId(Long id) {
            this.id = id;
        }
    
        public String getName() {
            return name;
        }
    
        public void setName(String name) {
            this.name = name;
        }
    
        public String getAuthor() {
            return author;
        }
    
        public void setAuthor(String author) {
            this.author = author;
        }
    
        public BigDecimal getPrice() {
            return price;
        }
    
        public void setPrice(BigDecimal price) {
            this.price = price;
        }
    
        @Override
        public String toString() {
            return "Book{" +
                    "id=" + id +
                    ", name='" + name + '\'' +
                    ", author='" + author + '\'' +
                    ", price=" + price +
                    '}';
        }
    }

将 **@Valid** 添加到 **@RequestBody** 。 完成，现在启用 bean 验证。

*  BookController.java

package com.example.springrestsecurity;
    
    import com.example.springrestsecurity.error.BookNotFoundException;
    import com.example.springrestsecurity.error.BookUnSupportedFieldPatchException;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.http.HttpStatus;
    import org.springframework.util.StringUtils;
    import org.springframework.validation.annotation.Validated;
    import org.springframework.web.bind.annotation.*;
    
    import javax.validation.Valid;
    import javax.validation.constraints.Min;
    import java.util.List;
    import java.util.Map;
    
    @RestController
    @Validated
    public class BookController {
    
        @Autowired
        private BookRepository repository;
    
        @GetMapping("/books")
        List<Book> findAll() {
            return repository.findAll();
        }
    
        @PostMapping("/books")
        @ResponseStatus(HttpStatus.CREATED)
        Book newBook(@Valid @RequestBody Book newBook) {
            return repository.save(newBook);
        }
    
        @GetMapping("/books/{id}")
        Book findOne(@PathVariable @Min(1) Long id) {
            return repository.findById(id)
                    .orElseThrow(() -> new BookNotFoundException(id));
        }
    
        @PutMapping("/books/{id}")
        Book saveOrUpdate(@RequestBody Book newBook, @PathVariable Long id) {
    
            return repository.findById(id)
                    .map(x -> {
                        x.setName(newBook.getName());
                        x.setAuthor(newBook.getAuthor());
                        x.setPrice(newBook.getPrice());
                        return repository.save(x);
                    })
                    .orElseGet(() -> {
                        newBook.setId(id);
                        return repository.save(newBook);
                    });
        }
    
        @PatchMapping("/books/{id}")
        Book patch(@RequestBody Map<String, String> update, @PathVariable Long id) {
    
            return repository.findById(id)
                    .map(x -> {
    
                        String author = update.get("author");
                        if (!StringUtils.isEmpty(author)) {
                            x.setAuthor(author);
    
                            // better create a custom method to update a value = :newValue where id = :id
                            return repository.save(x);
                        } else {
                            throw new BookUnSupportedFieldPatchException(update.keySet());
                        }
    
                    })
                    .orElseGet(() -> {
                        throw new BookNotFoundException(id);
                    });
    
        }
    
        @DeleteMapping("/books/{id}")
        void deleteBook(@PathVariable Long id) {
            repository.deleteById(id);
        }
    }

尝试再次向 REST 端点发送 POST 请求。 如果 bean 验证由于缺少数据字段而失败，它将触发 **MethodArgumentNotValidException** 。 默认情况下，Spring 将返回一个 HTTP 状态 **400 Bad Request** ，但没有错误详细信息。

![64c5ba59c9eaf28c32fd770b8e3aa852.png][]

上面的错误响应是不友好的，我们可以像这样捕获 **MethodArgumentNotValidException** 并覆盖响应：

*  CustomGlobalExceptionHandler.java

package com.example.springrestsecurity.error;
    
    import org.hibernate.exception.ConstraintViolationException;
    import org.springframework.http.HttpHeaders;
    import org.springframework.http.HttpStatus;
    import org.springframework.http.ResponseEntity;
    import org.springframework.web.bind.MethodArgumentNotValidException;
    import org.springframework.web.bind.annotation.ControllerAdvice;
    import org.springframework.web.bind.annotation.ExceptionHandler;
    import org.springframework.web.context.request.WebRequest;
    import org.springframework.web.servlet.mvc.method.annotation.ResponseEntityExceptionHandler;
    
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    import java.util.Date;
    import java.util.LinkedHashMap;
    import java.util.List;
    import java.util.Map;
    import java.util.stream.Collectors;
    
    @ControllerAdvice
    public class CustomGlobalExceptionHandler extends ResponseEntityExceptionHandler {
    
        // Let Spring BasicErrorController handle the exception, we just override the status code
        @ExceptionHandler(BookNotFoundException.class)
        public void springHandleNotFound(HttpServletResponse response) throws IOException {
            response.sendError(HttpStatus.NOT_FOUND.value());
        }
    
        @ExceptionHandler(BookUnSupportedFieldPatchException.class)
        public void springUnSupportedFieldPatch(HttpServletResponse response) throws IOException {
            response.sendError(HttpStatus.METHOD_NOT_ALLOWED.value());
        }
    
        // @Validate For Validating Path Variables and Request Parameters
        @ExceptionHandler(ConstraintViolationException.class)
        public void constraintViolationException(HttpServletResponse response) throws IOException {
            response.sendError(HttpStatus.BAD_REQUEST.value());
        }
    
        // error handle for @Valid
        @Override
        protected ResponseEntity<Object> handleMethodArgumentNotValid(MethodArgumentNotValidException ex,
                                                                      HttpHeaders headers,
                                                                      HttpStatus status, WebRequest request) {
    
            Map<String, Object> body = new LinkedHashMap<>();
            body.put("timestamp", new Date());
            body.put("status", status.value());
    
            //Get all errors
            List<String> errors = ex.getBindingResult()
                    .getFieldErrors()
                    .stream()
                    .map(x -> x.getDefaultMessage())
                    .collect(Collectors.toList());
    
            body.put("errors", errors);
    
            return new ResponseEntity<>(body, headers, status);
    
        }
    
    }

![481fc84ee8280b14dc963126d38f2490.png][]

### 路径变量验证 ###

*  我们也可以应用 **javax.validation.constraints.** \* 直接在路径变量甚至请求参数上进行注释。 应用 **@Validated** ，并添加 **javax.validation.constraints.** \* 像这样的路径变量注释：
 *  BookController.java

默认错误信息是好的，只是错误代码500不合适。

![256e2b9f0c04233431f8a9bf4a732133.png][]

如果 **@Validated** 失败，它会触发 **ConstraintViolationException** ，我们可以像这样覆盖错误代码：

*  CustomGlobalExceptionHandler.java

import org.springframework.http.HttpStatus;
    import org.springframework.web.bind.annotation.ControllerAdvice;
    import org.springframework.web.bind.annotation.ExceptionHandler;
    import org.springframework.web.servlet.mvc.method.annotation.ResponseEntityExceptionHandler;
    
    import javax.servlet.http.HttpServletResponse;
    import javax.validation.ConstraintViolationException;
    import java.io.IOException;
    
    @ControllerAdvice
    public class CustomGlobalExceptionHandler extends ResponseEntityExceptionHandler {
    
        @ExceptionHandler(ConstraintViolationException.class)
        public void constraintViolationException(HttpServletResponse response) throws IOException {
            response.sendError(HttpStatus.BAD_REQUEST.value());
        }
    
        //..
    }

![1f034d1b5d9eedd4eae8ade5668682c2.png][]

### 自定义验证器 ###

我们将为 **author** 字段创建一个自定义验证器，只允许 4 个作者保存到数据库中。

*  Author.java

package com.example.springrestsecurity.error.validator;
    
    import javax.validation.Constraint;
    import javax.validation.Payload;
    import java.lang.annotation.Documented;
    import java.lang.annotation.Retention;
    import java.lang.annotation.Target;
    
    import static java.lang.annotation.ElementType.FIELD;
    import static java.lang.annotation.RetentionPolicy.RUNTIME;
    
    @Target({FIELD})
    @Retention(RUNTIME)
    @Constraint(validatedBy = AuthorValidator.class)
    @Documented
    public @interface Author {
    
        String message() default "Author is not allowed.";
    
        Class<?>[] groups() default {};
    
        Class<? extends Payload>[] payload() default {};
    
    }

*  AuthorValidator.java

package com.example.springrestsecurity.error.validator;
    
    import javax.validation.ConstraintValidator;
    import javax.validation.ConstraintValidatorContext;
    import java.util.Arrays;
    import java.util.List;
    
    public class AuthorValidator implements ConstraintValidator<Author, String> {
        List<String> authors = Arrays.asList("Santideva", "Marie Kondo", "Martin Fowler", "toptech");
        @Override
        public boolean isValid(String value, ConstraintValidatorContext context) {
            return authors.contains(value);
        }
    }

*  Book.java

测试一下。 如果自定义验证器失败，则会触发 \*\*MethodArgumentNotValidException \*\*

curl -v -X POST localhost:8080/books 
        -H "Content-type:application/json" 
        -d "{\"name\":\"Spring REST tutorials\", \"author\":\"abc\",\"price\":\"9.99\"}"
    
    {
        "timestamp":"2019-02-20T13:49:59.971+0000",
        "status":400,
        "errors":["Author is not allowed."]
    }

### Spring Security ###

创建一个新的 **@Configuration** 类并扩展 **WebSecurityConfigurerAdapter** 。 在下面的示例中，我们将使用 HTTP Basic 身份验证来保护 REST 端点。

*  SpringSecurityConfig.java

package com.example.springrestsecurity.config;
    
    import org.springframework.context.annotation.Configuration;
    import org.springframework.http.HttpMethod;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    
    @Configuration
    public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
    
        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    
            auth.inMemoryAuthentication()
                    .withUser("user").password("{noop}password").roles("USER")
                    .and()
                    .withUser("admin").password("{noop}password").roles("USER", "ADMIN");
    
        }
    
        // Secure the endpoins with HTTP Basic authentication
        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http.httpBasic()
                    .and()
                    .authorizeRequests()
                    .antMatchers(HttpMethod.GET, "/books/**").hasRole("USER")
                    .antMatchers(HttpMethod.POST, "/books").hasRole("ADMIN")
                    .antMatchers(HttpMethod.PUT, "/books/**").hasRole("ADMIN")
                    .antMatchers(HttpMethod.PATCH, "/books/**").hasRole("ADMIN")
                    .antMatchers(HttpMethod.DELETE, "/books/**").hasRole("ADMIN")
                    .and()
                    .csrf().disable()
                    .formLogin().disable();
        }
    }

### Spring Boot ###

普通 Spring Boot 应用程序启动 REST 端点并将 3 本书插入 H2 数据库进行演示。

package com.example.springrestsecurity;
    
    import org.springframework.boot.CommandLineRunner;
    import org.springframework.boot.SpringApplication;
    import org.springframework.boot.autoconfigure.SpringBootApplication;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Profile;
    
    import java.math.BigDecimal;
    
    @SpringBootApplication
    public class SpringRestSecurityApplication {
    
        public static void main(String[] args) {
            SpringApplication.run(SpringRestSecurityApplication.class, args);
        }
        @Profile("demo")
        @Bean
        CommandLineRunner initDatabase(BookRepository repository) {
            return args -> {
                repository.save(new Book("A Guide to the Bodhisattva Way of Life", "Santideva", new BigDecimal("15.41")));
                repository.save(new Book("The Life-Changing Magic of Tidying Up", "Marie Kondo", new BigDecimal("9.69")));
                repository.save(new Book("Refactoring: Improving the Design of Existing Code", "Martin Fowler", new BigDecimal("47.99")));
            };
        }
    }

### 演示 ###

![8eecf3f642818776ca3fa56b5d5ae7f4.png][]

*  普通 GET 和 POST 会返回 401，所有端点都受到保护，需要身份验证。

![fc6a996c3f8f7c7339801fd1159421c2.png][]

*  发送 GET 请求以及 `user`登录

![ad3d49687018522bd765a123ee3efdde.png][]

*  尝试使用“user”登录发送 POST 请求，它将返回 403，禁止错误。 这是因为用户无权发送 POST 请求。

![f3eccf28345cc77ff494c5253dbac4dc.png][]

再次查看 Spring Security 配置。 要发送 **POST、PUT、PATCH** 或 **DELETE** 请求，我们需要 **admin**

*  SpringSecurityConfig.java

@Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                    .httpBasic()
                    .and()
                    .authorizeRequests()
                    .antMatchers(HttpMethod.GET, "/books/**").hasRole("USER")
                    .antMatchers(HttpMethod.POST, "/books").hasRole("ADMIN")
                    .antMatchers(HttpMethod.PUT, "/books/**").hasRole("ADMIN")
                    .antMatchers(HttpMethod.PATCH, "/books/**").hasRole("ADMIN")
                    .antMatchers(HttpMethod.DELETE, "/books/**").hasRole("ADMIN")
                    .and()
                    .csrf().disable()
                    .formLogin().disable();
        }
    
    }

*  尝试使用管理员登录发送 POST 请求

![f8db679a0b8de217577bed0b5c9fac34.png][]

### 源代码 ###

https://github.com/java-cake/spring-boot/tree/main/springrestsecurity

![6d739f1a5f0d2bb3ebacb457d7be9f8b.png][]

### 推荐书单 ###

#### 《Java编程讲义》 ####

购买链接：https://item.jd.com/13495830.html

《Java编程讲义》根据目前Java开发领域的实际需求，从初学者角度出发，详细讲解了Java技术的基础知识。

全书共15章，包括Java开发入门，Java语言基础，Java控制结构，数组，面向对象编程，继承和多态，抽象类、接口和内部类，异常处理，Java常用类库，集合与泛型，Lambda表达式，输入-输出流，多线程，JDBC数据库技术，网络编程等内容。内容全面覆盖．1ava开发必备的基础知识点，结合生活化案例展开讲解，程序代码给出了详细的注释，能够使初学者轻松领会Java技术精髓，快速掌握Java开发技能。

《Java编程讲义》适合作为高等院校相关专业的教材及教学参考书，也适合作为Java开发入门者的自学用书，还可供开发人员查阅、参考。

![e19731a916a76663c4add4772828132f.jpeg][]

> > > > ### 精彩回顾 ###
> > 
> > [想要代码干净又整洁？这里有十大原则][Link 1]
> > 
> > [通过自学成为开发者的 9 种方法][9]
> > 
> > [怎么做一个有产品意识的软件工程师？][Link 2]

> > 扫码关注《Java学研大本营》，加入读者群，分享更多精彩

[fea0e7d02708a941ed1116d7acf08a53.png]: https://img-blog.csdnimg.cn/img_convert/fea0e7d02708a941ed1116d7acf08a53.png
[5a8c1fefe41f5613fdfab6e507681041.png]: https://img-blog.csdnimg.cn/img_convert/5a8c1fefe41f5613fdfab6e507681041.png
[64c5ba59c9eaf28c32fd770b8e3aa852.png]: https://img-blog.csdnimg.cn/img_convert/64c5ba59c9eaf28c32fd770b8e3aa852.png
[481fc84ee8280b14dc963126d38f2490.png]: https://img-blog.csdnimg.cn/img_convert/481fc84ee8280b14dc963126d38f2490.png
[256e2b9f0c04233431f8a9bf4a732133.png]: https://img-blog.csdnimg.cn/img_convert/256e2b9f0c04233431f8a9bf4a732133.png
[1f034d1b5d9eedd4eae8ade5668682c2.png]: https://img-blog.csdnimg.cn/img_convert/1f034d1b5d9eedd4eae8ade5668682c2.png
[8eecf3f642818776ca3fa56b5d5ae7f4.png]: https://img-blog.csdnimg.cn/img_convert/8eecf3f642818776ca3fa56b5d5ae7f4.png
[fc6a996c3f8f7c7339801fd1159421c2.png]: https://img-blog.csdnimg.cn/img_convert/fc6a996c3f8f7c7339801fd1159421c2.png
[ad3d49687018522bd765a123ee3efdde.png]: https://img-blog.csdnimg.cn/img_convert/ad3d49687018522bd765a123ee3efdde.png
[f3eccf28345cc77ff494c5253dbac4dc.png]: https://img-blog.csdnimg.cn/img_convert/f3eccf28345cc77ff494c5253dbac4dc.png
[f8db679a0b8de217577bed0b5c9fac34.png]: https://img-blog.csdnimg.cn/img_convert/f8db679a0b8de217577bed0b5c9fac34.png
[6d739f1a5f0d2bb3ebacb457d7be9f8b.png]: https://img-blog.csdnimg.cn/img_convert/6d739f1a5f0d2bb3ebacb457d7be9f8b.png
[e19731a916a76663c4add4772828132f.jpeg]: https://img-blog.csdnimg.cn/img_convert/e19731a916a76663c4add4772828132f.jpeg
[Link 1]: https://mp.weixin.qq.com/s?__biz=MzkzMDM3MjI3Nw==&mid=2247484467&idx=1&sn=a03c98cecf89bf808a36ea3a342c411a&chksm=c27a0be9f50d82ff7c33fc58d06ba1c3c40e4002f3ad2536cc6d23b0754cef741c0740ed1e5f#rd
[9]: https://mp.weixin.qq.com/s?__biz=MzkzMDM3MjI3Nw==&mid=2247484737&idx=1&sn=65ecbefa3f5bc306763142d86b0caae1&chksm=c27a0a9bf50d838dbdc37210590e27edd029d9f563c377829367fa5bcd1374c44ed01196d339#rd
[Link 2]: https://mp.weixin.qq.com/s?__biz=MzkzMDM3MjI3Nw==&mid=2247484703&idx=1&sn=b13abaffc02ff89c2c914ca3d1c289d6&chksm=c27a0ac5f50d83d368f7a7015b51c7eb4e463e8551c6c1dc7e4f0982cfb25f2407c9af8f6017#rd