SpringBoot Security认证 Redis缓存用户信息【SpringBoot系列10】

在用户的 login 接口中 Spring Security 认证通过后，获取到用户的详情，然后保存到 Redis 中，其中 token 为 Redis 缓存 用户的key .

@Slf4j
@RestController
@RequestMapping("/api/auth")
public class AuthController {

    @Autowired
    private AuthenticationManager authenticationManager;
    @Autowired
    private JWTGenerator jwtGenerator;

    @Autowired
    private RedisTemplate redisTemplate;

    @PostMapping("login")
    public R login(@RequestBody LoginRequest loginDto){
        log.info("登录认证开始 {}",loginDto.toString());
        Authentication authentication = authenticationManager.authenticate(
                new UsernamePasswordAuthenticationToken(
                        loginDto.getUserName(),
                        loginDto.getPassword()));
        // 认证成功存储认证信息到上下文
        SecurityContextHolder.getContext().setAuthentication(authentication);

        log.info("登录认证完成 {}",loginDto.toString());
        String token = jwtGenerator.generateToken(authentication);
        log.info("登录认证生成 token {}",token);

        String name = authentication.getName();
        //查询用户的详情
        UserInfo userInfo = userService.getByUsername(name);
        //保存用户信息到 redis 中
        ValueOperations<String, UserInfo> operations = redisTemplate.opsForValue();
        //保存用户信息到 redis 中
        operations.set(token, userInfo,7*24*3600, TimeUnit.SECONDS);

        return R.okData(token);
    }
 }
复制代码

然后咱们在 Spring Security 配置的拦截器中，token 校验通过后，从 Redis 中查询缓存的用户信息，将用户信息的 UserId 配置到请求头中

import com.alibaba.fastjson.JSONObject;
import com.biglead.demo.pojo.UserInfo;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.data.redis.core.ValueOperations;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.util.StringUtils;
import org.springframework.web.filter.OncePerRequestFilter;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;

public class JWTAuthenticationFilter extends OncePerRequestFilter {

    @Autowired
    private JWTGenerator tokenGenerator;
    @Autowired
    private CustomUserDetailsService customUserDetailsService;
    @Autowired
    private RedisTemplate redisTemplate;

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain) throws ServletException, IOException {
        //获取请求头中的 token 信息
        String token = getJWTFromRequest(request);
        //校验token
        if(StringUtils.hasText(token) && tokenGenerator.validateToken(token)) {
            //解析 token 中的用户信息 （用户的唯一标识 ）
            String username = tokenGenerator.getUsernameFromJWT(token);

            UserDetails userDetails = customUserDetailsService.loadUserByUsername(username);
            UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(userDetails, null,
                    userDetails.getAuthorities());
            authenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
            SecurityContextHolder.getContext().setAuthentication(authenticationToken);

            //获取用户信息
            ValueOperations<String, UserInfo> operations = redisTemplate.opsForValue();
            UserInfo userInfo = operations.get(token);
            if(userInfo==null){
                Map<String,Object> map = new HashMap<>();
                map.put("code",403);
                map.put("message","登录过期，重新登录");
                response.getWriter().print(JSONObject.toJSONString(map));
                return;
            }
            
            //自定义Request 
            HttpServletRequest req = (HttpServletRequest) request;

            XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(req);
            //添加自定义头
            xssRequest.putHeader("userId", userInfo.getUserId().toString());
            xssRequest.putHeader("userName", userInfo.getUserName().toString());

            filterChain.doFilter(xssRequest, response);
            return;
        }
        filterChain.doFilter(request, response);
    }

    /**
     * 就是校验请求头的一种格式 可以随便定义
     * 只要可以解析 就可以
     * @param request
     * @return
     */
    private String getJWTFromRequest(HttpServletRequest request) {
        String bearerToken = request.getHeader("Authorization");
        if(StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")) {
            return bearerToken.substring(7, bearerToken.length());
        }
        return null;
    }
}
复制代码

这里的核心实现 就是 XssHttpServletRequestWrapper

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
  
    private final Map<String, String> customHeaders;

    public XssHttpServletRequestWrapper(HttpServletRequest request) {
        super(request);
        this.customHeaders = new HashMap<String, String>();
    }

    public void putHeader(String name, String value) {
        this.customHeaders.put(name, value);
    }

    public String getHeader(String name) {
        // check the custom headers first
        String headerValue = customHeaders.get(name);

        if (headerValue != null) {
            return headerValue;
        }
        // else return from into the original wrapped object
        return ((HttpServletRequest) getRequest()).getHeader(name);
    }

    public Enumeration<String> getHeaderNames() {
        // create a set of the custom header names
        Set<String> set = new HashSet<String>(customHeaders.keySet());

        // now add the headers from the wrapped request object
        @SuppressWarnings("unchecked")
        Enumeration<String> e = ((HttpServletRequest) getRequest()).getHeaderNames();
        while (e.hasMoreElements()) {
            // add the names of the request headers into the list
            String n = e.nextElement();
            set.add(n);
        }

        // create an enumeration from the set and return
        return Collections.enumeration(set);
    }

    @Override
    public Enumeration<String> getHeaders(String name) {
        String values = getHeader(name);
        Set<String> set = Arrays.asList(values.split(",")).stream().collect(Collectors.toSet());
        if (customHeaders.containsKey(name)) {
            return Collections.enumeration(set);
        }
        return super.getHeaders(name);
    }
}
复制代码

这里是自定义的 HttpServletRequestWrapper ，本小节是对 请求Request 中的请求头的操作，后续咱们还会在这里 获取请求体中的参数

然后咱们在请求其他接口的时候 ，就可以通过 @RequestHeader 注解来获取对应的信息，如这里获取 设置的用户信息

@Api(tags="用户分类模块")
@RestController()
@RequestMapping("/auto/userCategory")
@Slf4j
public class UserCategoryController {

    @Resource
    IUserCategoryService userCategoryService;
    @GetMapping(value="/findPage")
    @ApiOperation(value = "分页查询")
    public Object findPage(
            @RequestHeader String userId,
            @RequestHeader String userName,
            @RequestParam(required = false,defaultValue = "1") Integer index,
                           @RequestParam(required = false,defaultValue = "10") Integer pageSize) {
        log.info("请求头 userId {} userName {}",userId,userName);
        Object page = userCategoryService.findPage(index, pageSize);
        return page;
    }
}
复制代码

本文章是系列文章 ，每节文章都有对应的代码，每节的源码都是在上一节的基础上配置而来，对应的视频讲解课程正在火速录制中。 项目源码在这里 ：gitee.com/android.lon… 有兴趣可以关注一下公众号：biglead

作者：早起的年轻人
链接：https://juejin.cn/post/7215895579464974392