springboot在前后端分离项目中，集成springsecurity，集成jwt生成token，实现单点登录

分手后的思念是犯贱 2024-03-22 09:58 47阅读 0赞

## springSecurity集成springboot ##

> ***将springSecurity集成springboot,前后端分离的方式开发,使用token验证,实现单点登录***,***在权限控制方面,使用注解的方式进行控制***

#### 引入依赖: ####

<dependency>
                <groupId>io.jsonwebtoken</groupId>
                <artifactId>jjwt</artifactId>
                <version>0.9.1</version>
            </dependency>
    		<dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-data-redis</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-security</artifactId>
            </dependency>

#### 代码实现: ####

>  *  UserDetailsService接口重写登录逻辑
>  *  登录成功拦截器的重写
>  *  登录失败拦截器的重写
>  *  认证逻辑过滤器的重写
>  *  认证权限不足的拦截
>  *  未登录,进行访问权限的拦截
>  *  登出成功的拦截

##### java代码配置类: #####

@Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    public class SecurityConfig extends WebSecurityConfigurerAdapter {
        
    
        @Resource
        private UserDetailsService userDetailsService;
        @Resource
        private AuthenticationSuccessHandler authenticationSuccessHandler;
        @Resource
        private AuthenticationFailureHandler authenticationFailureHandler;
        @Resource
        private AuthenticationEntryPoint authenticationEntryPoint;
        @Resource
        private AccessDeniedHandler myAccessDeniedHandler;
    
        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        
            auth.userDetailsService(userDetailsService)
                    .passwordEncoder(new MD5Util());
        }
    
        @Override
        protected void configure(HttpSecurity http) throws Exception {
        
            http.formLogin()
                    .loginProcessingUrl("/login")
                    .successHandler(authenticationSuccessHandler)
                    .failureHandler(authenticationFailureHandler)
                    .usernameParameter("account")
            .and().csrf().disable();
    
            http.logout()
                    .logoutUrl("/logout")
                    .logoutSuccessHandler(new MyLogoutSuccessHandler());
    
            http.addFilter(new MyBasicAuthenticationFilter(authenticationManager()))
                    .httpBasic();
    
            http.exceptionHandling()
                    .authenticationEntryPoint(authenticationEntryPoint)
                    .accessDeniedHandler(myAccessDeniedHandler);
    
            // 管理员才可以查看swagger文档
    //        http.authorizeRequests()
    //                .antMatchers("/swagger-ui.html").hasAnyRole("ROLE_admin");
    //        http.authorizeRequests()
    //                .antMatchers("/user/register").permitAll()
    //                .anyRequest().authenticated(); // 所有请求都拦截,使用注解的方式权限控制时,不使用这个,
    
    
    
        }
    }

##### UserDetailsService接口重写登录逻辑: #####

// MyUserDetailsService implements UserDetailsService
    @Service
    public class MyUserDetailsServiceImpl implements MyUserDetailsService {
        
    
        @Resource
        private UserService userService;
    
        @Override
        public UserDetails loadUserByUsername(String account) throws UsernameNotFoundException {
        
            if (!StringUtils.hasText(account)){
        
                throw new RuntimeException("用户名不能为空!!!");
            }
            User user = (User) userService.getUserByName(account).getData();
            if (user == null){
        
                throw new RuntimeException("此账号还未注册");
            }
            List<GrantedAuthority> grantedAuthorityList =
                    AuthorityUtils.commaSeparatedStringToAuthorityList(user.getAdmin() == 0 ? "ROLE_admin" : "ROLE_normal");
            return new org.springframework.security.core.userdetails.User(user.getAccount(),user.getPassword(),grantedAuthorityList);
        }
    }

##### 登录成功拦截器的重写: #####

@Component
    @Slf4j
    public class MyAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
        
    
        @Resource
        private UserService userService;
    
        @Override
        public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        
            
            String account = String.valueOf(request.getParameter("account"));
            User user = (User) userService.findUserByAccount(account).getData();
    		// 得到权限
            String permissions = user.getAdmin() == 0 ? "ROLE_normal" : "ROLE_admin" ;
            String token = JwtUtil.createToken(user.getId(),user.getAccount(),permissions);
    		// token 发给前端
            response.setHeader("Authorization",token);
            response.setHeader("Access-Control-Expose-Headers", "Authorization");
            log.info("用户: [{}] 登录成功!!! , 权限为: [{}]",account , permissions);
            // SecurityContextHolder 赋值,用于授权
            SecurityContextHolder.getContext().setAuthentication(
                    new UsernamePasswordAuthenticationToken(user.getAccount(),token,
                            AuthorityUtils.commaSeparatedStringToAuthorityList(permissions))
            );
            ResponseUtil.out(response,Result.success(token));
        }
    }

##### 登录失败拦截器的重写: #####

@Component
    @Slf4j
    public class MyAuthenticationFailureHandler implements AuthenticationFailureHandler {
        
    
        @Override
        public void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {
        
            log.warn("用户: [{}] 尝试登录,登录失败!!!",httpServletRequest.getParameter("account"),e);
            // 此为手动抛出异常
            if (e.getCause()!=null){
        
                ResponseUtil.out(httpServletResponse,Result.fail(555,e.getCause().getMessage()));
            }
            ResponseUtil.out(httpServletResponse, Result.fail(HttpCode.PASSWORD_ERROR));
        }
    }

##### 认证逻辑过滤器的重写: #####

/**
     * 重写授权的逻辑
     */
    @Slf4j
    public class MyBasicAuthenticationFilter extends BasicAuthenticationFilter {
        
    
    
        public MyBasicAuthenticationFilter(AuthenticationManager authenticationManager) {
        
            super(authenticationManager);
        }
    
        @Override
        protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
        
            String token = request.getHeader("Authorization");
            // 没有token,视为未登录
            if (!StringUtils.hasText(token)) {
        
                chain.doFilter(request,response);
                return;
            }
            Claims claims = JwtUtil.decryptToken(token);
            if (claims == null){
        
                ResponseUtil.out(response, Result.fail(HttpCode.TOKEN_ERROR));
                return;
            }
    
            Long id = Long.valueOf(claims.getId());
            String account = claims.getSubject();
            String permissions = (String) claims.get("permissions");
            log.info("正在授权中-----id为: [{}] , 账号为: [{}] , 具有的权限: {}" ,id,account,permissions);
    		// 认证成功,给SecurityContextHolder填充数据,用于验证授权
            SecurityContextHolder.getContext().setAuthentication(
                    new UsernamePasswordAuthenticationToken(account,token,
                            AuthorityUtils.commaSeparatedStringToAuthorityList(permissions))
            );
            chain.doFilter(request,response);
        }
    }

##### 认证权限不足的拦截: #####

/**
     * 登录的用户,权限不足的拦截
     */
    @Component
    public class MyAccessDeniedHandler implements AccessDeniedHandler {
        
    
        @Override
        public void handle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AccessDeniedException e) throws IOException, ServletException {
        
    
            ResponseUtil.out(httpServletResponse, Result.fail(HttpCode.NO_PERMISSIONS));
        }
    }

##### 未登录,进行访问权限的拦截: #####

/**
     * 未登录的用户,进行拦截
     */
    @Component
    public class MyAuthenticationEntryPoint implements AuthenticationEntryPoint {
        
    
        @Override
        public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {
        
            ResponseUtil.out(httpServletResponse, Result.fail(HttpCode.NO_LOGIN));
        }
    }

##### 登出成功的拦截: #####

@Slf4j
    public class MyLogoutSuccessHandler implements LogoutSuccessHandler {
        
    
        @Override
        public void onLogoutSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {
        
            if (authentication != null){
        
                new SecurityContextLogoutHandler().logout(httpServletRequest, httpServletResponse, authentication);
            }
            ResponseUtil.out(httpServletResponse, Result.success());
        }
    }

##### 工具类 #####

// SecurityContextHolder 类中存的是认证用户的信息
    public class SecurityContextUtil {
        
    
        /**
         * 通过SpringSecurity的上下文获取用户的token,得到id
         * @return
         */
        public static Long getCurrentUserId(){
        
            Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
            if (authentication == null) return null;
            String token = (String) authentication.getCredentials();
            if (!StringUtils.hasText(token)){
        
                return null;
            }
            Claims claims = JwtUtil.decryptToken(token);
            if (claims == null){
        
                return null;
            }
            return Long.valueOf(claims.getId());
        }
    }

/**
     * 自定义加密方式,盐值改变会导致一些用户无法登录
     */
    public class MD5Util implements PasswordEncoder {
        
        // 盐值
        private static String salt = PropertiesConfig.getSalt();
    
        /**
         * 加密
         * 加密两次,第二次加密放上盐值
         * @param charSequence 字符串
         * @return
         */
        @Override
        public String encode(CharSequence charSequence) {
        
            String data = DigestUtils.md5DigestAsHex(charSequence.toString().getBytes());
            return DigestUtils.md5DigestAsHex((data+salt).getBytes());
        }
    
        public static String encode(String charSequence){
        
            String data = DigestUtils.md5DigestAsHex(charSequence.toString().getBytes());
            return DigestUtils.md5DigestAsHex((data+salt).getBytes());
        }
        public static String encode(String charSequence,String salt){
        
            String data = DigestUtils.md5DigestAsHex(charSequence.toString().getBytes());
            return DigestUtils.md5DigestAsHex((data+salt).getBytes());
        }
    
        /**
         * 匹配是否相等
         * @param charSequence 未加密的字符串
         * @param s 已加密的字符串
         * @return
         */
        @Override
        public boolean matches(CharSequence charSequence, String s) {
        
            if (!StringUtils.hasText(charSequence)) return false;
            String data = encode(charSequence);
            return data.equals(s);
        }
        public static boolean matches(String charSequence,String salt, String encrypt) {
        
            if (!StringUtils.hasText(charSequence)) return false;
            String data = DigestUtils.md5DigestAsHex(charSequence.getBytes());
            data = DigestUtils.md5DigestAsHex((data+salt).getBytes());
            return data.equals(encrypt);
        }
    
    }

// token工具
    @Slf4j
    public class JwtUtil {
        
    
        private static String key = PropertiesConfig.getKey();
        private static Integer time = PropertiesConfig.getTime();
    
        public static String createToken(Map<String, String> map) {
        
    
            Calendar calendar = Calendar.getInstance();
            calendar.add(Calendar.SECOND, time);
    
            JwtBuilder jwtBuilder = Jwts.builder()
                    .signWith(SignatureAlgorithm.HS256, key);
            map.forEach((key, value) -> {
        
                jwtBuilder.claim(key, value);
            });
            // 设置 签名时间, 过期时间
            String token = jwtBuilder.setIssuedAt(new Date())
                    .setExpiration(calendar.getTime()).compact();
    
            return token;
        }
    
        public static String createToken(Long id, String account, String permissions) {
        
    
            Calendar calendar = Calendar.getInstance();
            calendar.add(Calendar.SECOND, time);
            log.info("有效时间: {}",time);
            JwtBuilder jwtBuilder = Jwts.builder()
                    .signWith(SignatureAlgorithm.HS256, key);
            jwtBuilder.setId(String.valueOf(id));
            jwtBuilder.setSubject(account);
            jwtBuilder.claim("permissions",permissions);
            // 设置 签名时间, 过期时间
            String token = jwtBuilder.setIssuedAt(new Date())
                    .setExpiration(calendar.getTime()).compact();
    
            return token;
        }
    
        public static Claims decryptToken(String token) {
        
            try {
        
                Claims claims = Jwts.parser().setSigningKey(key).parseClaimsJws(token).getBody();
                return claims;
            } catch (Exception e) {
        
                log.info("解析token失败");
                return null; // 解密失败则返回null
            }
    
        }
    
    }

##### 使用: #####

@RestController
    @RequestMapping("/category")
    public class CategoryController {
        
        @Resource
        private CategoryService categoryService;
    
        @GetMapping("/all")
        @PreAuthorize("permitAll()")
        public Result all(){
        
            return categoryService.all();
        }
    
        @PostMapping("/add")
        @PreAuthorize("hasAnyRole('admin')")
        public Result add(@RequestBody @Validated CategoryAddParam categoryAddParam){
        
            return categoryService.add(categoryAddParam);
        }
    
        @PostMapping("/update")
        @PreAuthorize("hasAnyRole('admin')")
        public Result update(@RequestBody @Validated CategoryUpdateParam categoryUpdateParam){
        
            return categoryService.update(categoryUpdateParam);
        }
    
        @PostMapping("/delete")
        @PreAuthorize("hasAnyRole('admin')")
        public Result delete(@RequestBody Map<String,Long> map){
        
            Long id = map.get("id");
            if (id == null){
        
                return Result.fail(HttpCode.PARAM_ERROR);
            }
            return categoryService.delete(id);
        }
    
    
        /**
         * 根据名称查找类别
         */
        @PostMapping("/findCategoryByName")
        @PreAuthorize("permitAll()")
        public Result findCategoryByName(@RequestBody Map<String,String> map){
        
            String categoryName = map.get("categoryName");
            return categoryService.findCategoryByName(categoryName);
        }
    
        @PostMapping("fuzzy")
        @PreAuthorize("permitAll()")
        public Result fuzzy(@RequestBody CategoryFuzzyParam categoryFuzzyParam){
        
            return categoryService.fuzzy(categoryFuzzyParam);
        }
    
        @PostMapping("hot")
        @PreAuthorize("permitAll()")
        public Result hot(@RequestBody(required = false) Map<String,Integer> map){
        
            if (map == null) map = new HashMap<>();
            Integer limit = map.get("limit");
            return categoryService.hot(limit);
        }
    
        /**
         * 上传图片
         */
        @PostMapping("/uploadAvatar")
        @PreAuthorize("hasAnyRole('admin')")
        public Result uploadAvatar(@RequestParam("image")MultipartFile file) throws IOException {
        
            String url = FileUploadUtil.upload(PropertiesConfig.getUploadCategoryDir(), file, FileUploadUtil.IMAGE_ALLOWED_EXTENSION);
            return Result.success(FileUploadUtil.transformUrl(url));
        }
    
    
    }

> 致此集成springSecurity完毕，若我的代码有不足之处，还请大家斧正。