spring security的ajax提交和json返回数据--兼容form表单提交

核心思想：就是重写从request中获取用户名，密码的方法
直接上代码。
参考资料：
http://docs.spring.io/spring-security/site/docs/4.0.3.RELEASE/reference/htmlsingle/#preface

直接上代码。

application-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:security="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.2.xsd
                    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.0.xsd">
    <!-- 不需要拦截 -->
    <security:http pattern="/login/**" security="none"></security:http>
    <security:http auto-config="false" use-expressions="true" entry-point-ref="http403EntryPoint">
        <security:csrf disabled="true" />
        <security:headers>
            <security:frame-options policy="SAMEORIGIN" />
            <security:cache-control disabled="true" />
            <security:content-type-options disabled="true" />
        </security:headers>
        <!-- 退出 -->
        <security:logout invalidate-session="true" logout-url="/login/logout.do" logout-success-url="/login/outSuccess.do"
            delete-cookies="true" />
        <!-- session超时 -->
        <security:session-management invalid-session-url="/login/timedout.do" session-fixation-protection="none"
            session-authentication-error-url="/login/timedout.do">
            <security:concurrency-control error-if-maximum-exceeded="false" expired-url="/login/timedout.do"
                max-sessions="1" />
        </security:session-management>
        <!-- filter_security_interceptor -->
        <security:custom-filter ref="mySecurityFilter" before="FILTER_SECURITY_INTERCEPTOR" />
        <!-- form_login_filter -->
        <security:custom-filter ref="CustomUsernamePasswordAuthenticationFilter" before="FORM_LOGIN_FILTER" />
    </security:http>

    <bean id="CustomUsernamePasswordAuthenticationFilter" class="u.frame.web.trade.security.MyUsernamePasswordAuthenticationFilter">
        <property name="authenticationManager" ref="authenticationManager" />
        <property name="authenticationSuccessHandler" ref="successHandler" />
        <property name="authenticationFailureHandler" ref="failureHandler" />
        <property name="filterProcessesUrl" value="/logincheck.do" />
    </bean>

    <!-- 自定义过滤器 -->
    <bean id="mySecurityFilter" class="u.frame.web.trade.security.MyFilterSecurityInterceptor" />

    <!-- 认证管理器 -->
    <bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager">
        <constructor-arg>
            <list>
                <ref bean="daoAuthenticationProvider" />
            </list>
        </constructor-arg>
    </bean>
    <!-- 认证提供类 -->
    <bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
        <property name="userDetailsService" ref="userServiceDetail" />
        <property name="passwordEncoder" ref="standardPasswordEncoder" />
        <property name="hideUserNotFoundExceptions" value="false" />
    </bean>

    <!-- 登录成功的处理 -->
    <bean id="successHandler" class="u.frame.web.trade.security.MySimpleUrlAuthenticationSuccessHandler">
        <property name="defaultTargetUrl" value="/login/success.do" />
    </bean>

    <!-- 登录失败的处理 -->
    <bean id="failureHandler" class="u.frame.web.trade.security.MySimpleUrlAuthenticationFailureHandler">
        <property name="defaultFailureUrl" value="/login/error.do" />
    </bean>

    <!-- 403的处理 -->
    <bean id="http403EntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint" />

    <!-- 获得用户信息 -->
    <bean id="userServiceDetail" class="u.frame.web.trade.security.MyUserDetailServiceImpl" />

    <!-- 密码加密工具 -->
    <bean id="standardPasswordEncoder" class="org.springframework.security.crypto.password.StandardPasswordEncoder">
        <constructor-arg value="q1w2e3r4t5y6u7i8o9p0" />
    </bean>
</beans>

MyUsernamePasswordAuthenticationFilter.java

package u.frame.web.trade.security;

import java.io.BufferedReader;
import java.io.IOException;

import javax.servlet.http.HttpServletRequest;

import org.apache.commons.lang3.StringUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import com.fasterxml.jackson.databind.ObjectMapper;

import u.frame.web.trade.model.Login;

public class MyUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
    static Log log = LogFactory.getLog(MyUsernamePasswordAuthenticationFilter.class);
    // 用户的登录信息
    private Login login;

    @Override
    protected String obtainPassword(HttpServletRequest request) {
        System.out.println("MyUsernamePasswordAuthenticationFilter-obtainPassword");
        if (checkJson(request)) {
            if (login != null) {
                return login.getPassWord();
            }
        }
        return super.obtainPassword(request);
    }

    @Override
    protected String obtainUsername(HttpServletRequest request) {
        System.out.println("MyUsernamePasswordAuthenticationFilter-obtainUsername");
        if (checkJson(request)) {
            if (login != null) {
                return login.getUserName();
            }
        }
        return super.obtainUsername(request);
    }

    public boolean checkJson(HttpServletRequest request) {
        try {
            if ("application/json".equals(request.getHeader("Content-Type"))) {
                StringBuffer sb = new StringBuffer();
                String line = null;
                BufferedReader reader;
                reader = request.getReader();
                while ((line = reader.readLine()) != null) {
                    sb.append(line);
                }
                if (StringUtils.isNotEmpty(sb.toString())) {
                    ObjectMapper mapper = new ObjectMapper();
                    login = mapper.readValue(sb.toString(), Login.class);
                }
                return true;
            }
        } catch (IOException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
        return false;

    }
}

MyFilterSecurityInterceptor.java

package u.frame.web.trade.security;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

import u.frame.util.ResponseJsonUtil;

/**
 */
public class MyFilterSecurityInterceptor implements Filter {
    static final Logger logger = LogManager.getLogger(MyFilterSecurityInterceptor.class.getName());

    @Override
    public void destroy() {
        // TODO Auto-generated method stub

    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        try {
            HttpServletRequest myrequest = (HttpServletRequest) request;
            if (myrequest.getSession().getAttribute("loginUser") == null) {
                ResponseJsonUtil.jsonResponse(response, "F0001");
            } else {
                chain.doFilter(request, response);
            }
        } catch (Exception e) {
            e.printStackTrace();
        } finally {
        }
    }
    @Override
    public void init(FilterConfig arg0) throws ServletException {

    }

}

MySimpleUrlAuthenticationSuccessHandler.java

package u.frame.web.trade.security;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;

import u.frame.common.Result;
import u.frame.util.ResponseJsonUtil;

public class MySimpleUrlAuthenticationSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {
    static Log log = LogFactory.getLog(MySimpleUrlAuthenticationSuccessHandler.class);
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication auth)
            throws IOException, ServletException {
        if ("application/json".equals(request.getHeader("Content-Type"))) {
            ResponseJsonUtil.jsonResponse(response, new Result<>());
        } else {
            super.onAuthenticationSuccess(request, response, auth);
        }
    }
}

MySimpleUrlAuthenticationFailureHandler.java

package u.frame.web.trade.security;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;

import u.frame.util.ResponseJsonUtil;

public class MySimpleUrlAuthenticationFailureHandler extends SimpleUrlAuthenticationFailureHandler {
    static Log log = LogFactory.getLog(MySimpleUrlAuthenticationFailureHandler.class);

    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception)
            throws IOException, ServletException {
        if ("application/json".equals(request.getHeader("Content-Type"))) {
            ResponseJsonUtil.jsonResponse(response, exception.getMessage());
        } else {
            // TODO Auto-generated method stub
            super.onAuthenticationFailure(request, response, exception);
        }

    }

}

MyUserDetailServiceImpl.java

package u.frame.web.trade.security;

import java.util.HashSet;
import java.util.List;
import java.util.Set;

import org.apache.commons.collections.CollectionUtils;
import org.apache.commons.lang3.StringUtils;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

import u.frame.web.trade.model.SysOperator;
import u.frame.web.trade.service.SysOperatorSer;

/**
 * @description 项目实现的用户查询服务,将用户信息查询出来(用于实现用户的认证)
 */
public class MyUserDetailServiceImpl implements UserDetailsService {
    static final Logger logger = LogManager.getLogger(MyUserDetailServiceImpl.class.getName());
    @Autowired
    private SysOperatorSer sysOperatorSer;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        System.out.println("MyUserDetailServiceImpl" + username);
        if (StringUtils.isEmpty(username)) {
            // 用户名为空
            throw new UsernameNotFoundException("F0005");
        }
        SysOperator sysOperator = obtainByUsername(username);
        if (sysOperator == null) {
            // 没有此用户
            throw new UsernameNotFoundException("F0003");
        }
        boolean enabled = true; // 可用性 :true:可用 false:不可用
        boolean accountNonExpired = true; // 过期性 :true:没过期 false:过期
        boolean credentialsNonExpired = true; // 有效性 :true:凭证有效 false:凭证无效
        boolean accountNonLocked = true; // 锁定性 :true:未锁定 false:已锁定

        Set<GrantedAuthority> authorities = new HashSet<GrantedAuthority>();
        return new org.springframework.security.core.userdetails.User(//
                sysOperator.getLoginCode(), //
                // user.getUserPassword()+"{"+user.getUserName()+"}",
                sysOperator.getLoginPwd(), //
                enabled, //
                accountNonExpired, //
                credentialsNonExpired, //
                accountNonLocked, //
                authorities//
        );
    }

    public SysOperator obtainByUsername(String username) {
        if (StringUtils.isEmpty(username)) {
            return null;
        }
        SysOperator sysOperator = new SysOperator();
        sysOperator.setLoginCode(username);
        List<SysOperator> list = sysOperatorSer.getList(sysOperator);
        if (CollectionUtils.isEmpty(list) || list.size() != 1) {
            // 没有此用户
            return null;
        }
        sysOperator = list.get(0);
        return sysOperator;
    }
}