关于使SpringSecurity登录参数使用requestBody后引发的一系列问题及解决

之前写了一篇SpringSecurity整合Redis实现单点登录及认证返回json数据，这个本来只是作为先来学习的总结笔记，但最近终于有用武之地了。
公司新项目成立，我临危受命负责web端项目的搭建和开发，安全框架选型正是SpringSecurity。但SpringSecurity登录操作默认的参数形式是url参数（就是http://xx.xx.xx:xx/login?username=xx&password=xx这样），我们需要将参数放到requestBody中，于是

@Override
	public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
			throws AuthenticationException {
		if (this.postOnly && !request.getMethod().equals("POST")) {
			throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
		}
		String username = obtainUsername(request);
		username = (username != null) ? username : "";
		username = username.trim();
		String password = obtainPassword(request);
		password = (password != null) ? password : "";
		UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
		// Allow subclasses to set the "details" property
		setDetails(request, authRequest);
		return this.getAuthenticationManager().authenticate(authRequest);
	}

	@Nullable
	protected String obtainPassword(HttpServletRequest request) {
		return request.getParameter(this.passwordParameter);
	}

	@Nullable
	protected String obtainUsername(HttpServletRequest request) {
		return request.getParameter(this.usernameParameter);
	}

我们可以看到，这个类获取参数的方式，就是getParameter，所以基本上我们只要重写obtainPassword和obtainUsername方法就能满足我们的需求了，如果还想丰富一下，那直接重写attemptAuthentication就好了，我选择的是后者，代码如下：

@Slf4j
public class CustomAuthenticationProcessingFilter extends UsernamePasswordAuthenticationFilter {
    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        try {
            String bodyString = getBodyString(request);
            if (!StringUtils.hasText(bodyString)) {
                throw new IllegalArgumentException("用户名或密码不能为空");
            }
            Map<String, Object> map = new JacksonJsonParser().parseMap(bodyString);

            if (!request.getMethod().equals("POST")) {
                throw new AuthenticationServiceException("不支持该方法: " + request.getMethod());
            }
            String username = obtainUsername(map);
            username = username.trim();
            if (!StringUtils.hasText(username)) {
                throw new UsernameNotFoundException("用户名为空");
            }
            String password = obtainPassword(map);
            if (!StringUtils.hasText(password)) {
                throw new UsernameNotFoundException("密码为空");
            }
            UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
            setDetails(request, authRequest);
            return this.getAuthenticationManager().authenticate(authRequest);
        } catch (IOException e) {
            log.error("解析登录参数时发生异常,{}", e.getMessage());
            e.printStackTrace();
            throw new RuntimeException(e.getMessage());
        }
    }

    private String obtainUsername(Map<String, Object> map){
        Object userName = map.get(UsernamePasswordAuthenticationFilter.SPRING_SECURITY_FORM_USERNAME_KEY);
        return userName == null ? "" : (String)userName;
    }

    private String obtainPassword(Map<String, Object> map){
        Object pwd = map.get(UsernamePasswordAuthenticationFilter.SPRING_SECURITY_FORM_PASSWORD_KEY);
        return pwd == null ? "" : (String)pwd;
    }

    /**
     * 接收传递的jsonBody类型的参数
     */
    private String getBodyString(HttpServletRequest request) throws IOException {
        StringBuilder sb = new StringBuilder();
        InputStream inputStream = null;
        BufferedReader reader = null;
        try {
            inputStream = request.getInputStream();
            reader = new BufferedReader(
                    new InputStreamReader(inputStream, StandardCharsets.UTF_8));

            char[] bodyCharBuffer = new char[1024];
            int len = 0;
            while ((len = reader.read(bodyCharBuffer)) != -1) {
                sb.append(new String(bodyCharBuffer, 0, len));
            }
        } catch (IOException e) {
            e.printStackTrace();
        } finally {
            if (inputStream != null) {
                try {
                    inputStream.close();
                } catch (IOException e) {
                    e.printStackTrace();
                }
            }
            if (reader != null) {
                try {
                    reader.close();
                } catch (IOException e) {
                    e.printStackTrace();
                }
            }
        }
        return sb.toString();
    }
}

这样我们就可以实现从requestBody中获取用户名密码的操作了。
类是写好了，那如何使其生效呢？
又一轮的面向百度，方法是用http.addFilterAt方法使其替代UsernamePasswordAuthenticationFilter，在SecurityConfigure类中的代码如下：

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
            .antMatchers("/").permitAll()
            .antMatchers("/swagger-ui.html").permitAll();
    http.logout().logoutUrl(apiPath + "/logout").logoutSuccessHandler(logoutSuccessHandler).deleteCookies("SESSION")
            .permitAll();

    /*http.formLogin().loginProcessingUrl(apiPath + "/login")
            .successHandler(authenticationSuccessHandler)
            .failureHandler(authenticationFailureHandler)
            .and().authorizeRequests()
            .anyRequest().authenticated()
            .and().exceptionHandling().authenticationEntryPoint(authenticationEntryPoint)
            .and().csrf().disable(); // 关闭跨域防护*/ //初代登录配置
    // 配置登录认证filter
    http.addFilterBefore(getAuthenFilter(), UsernamePasswordAuthenticationFilter.class); //二代登录配置
    http.authorizeRequests()
        .anyRequest()
        .authenticated()
        .and().exceptionHandling().authenticationEntryPoint(authenticationEntryPoint);
    http.csrf().disable();
    http.exceptionHandling().accessDeniedHandler(accessDeniedHandler);
    // 同一个用户只能有一个session
    http.sessionManagement()
            .maximumSessions(1)
            .sessionRegistry(sessionRegistry())
            .expiredSessionStrategy(new CustomizeSessionInfoExpiredStrategy());
}


private UsernamePasswordAuthenticationFilter getAuthenFilter() throws Exception {
    CustomAuthenticationProcessingFilter filter = new CustomAuthenticationProcessingFilter();
    filter.setFilterProcessesUrl(apiPath + "/login");
    filter.setAuthenticationFailureHandler(authenticationFailureHandler);
    filter.setAuthenticationSuccessHandler(authenticationSuccessHandler);
    filter.setAuthenticationManager(super.authenticationManager());
    return filter;
}

关键的代码是这句http.addFilterBefore(getAuthenFilter(), UsernamePasswordAuthenticationFilter.class);
经过测试，好使了

我猜想，会不会是这个自定义的filter执行后没有再向后执行导致的呢？为了整明猜想继续调试程序进入自定义filter类的内部看看能发现点什么，于是程序执行到了AbstractAuthenticationProcessingFilter的doFilter方法中：

画红框的方法看着眼熟把，没错，那个就是自定义filter类中重写的方法，在执行完这个方法后，将判断是否继续执行filter链，而我们从图中可以明显的看到，这个条件是false的。啊…我的猜想被验证一半了，现在只要想办法把这个this.continueChainBeforeSuccessfulAuthentication值设置成true，就能看到我想的对不对了，于是我在SercurityConfigure类中的authenticationFilter()方法里，增加了authenProcessFilter.setContinueChainBeforeSuccessfulAuthentication(true);这样一行代码，整体如下：

private UsernamePasswordAuthenticationFilter authenticationFilter() throws Exception {
        CustomAuthenProcessFilter authenProcessFilter = new CustomAuthenProcessFilter();
        authenProcessFilter.setAuthenticationManager(super.authenticationManager());
        authenProcessFilter.setAuthenticationSuccessHandler(authenticationSuccessHandler);
        authenProcessFilter.setAuthenticationFailureHandler(authenticationFailureHandler);
        authenProcessFilter.setContinueChainBeforeSuccessfulAuthentication(true);
        return authenProcessFilter;
    }

重启，登录，好的，问题更严重了，登录直接报404了，我又调试了一边FilterChainProxy，发现这次filter是继续执行了，但是执行完最后一个filter后直接执行到DispatcherServlet中了，而控制器映射里没有登录地址的映射，所以报了404，这块就不贴代码了，有兴趣的可以自己尝试以下。
这可如何是好。

public class LoginConfigurer<H extends HttpSecurityBuilder<H>> extends
        AbstractAuthenticationFilterConfigurer<H, LoginConfigurer<H>, CustomAuthenProcessFilter> {
    public LoginConfigurer(){
        super(new CustomAuthenProcessFilter(), null);
    }
    @Override
    protected RequestMatcher createLoginProcessingUrlMatcher(String loginProcessingUrl) {
        return new AntPathRequestMatcher(loginProcessingUrl, "POST");
    }
}

然后再在配置代码中调用http.apply(new LoginConfigurer<>())，最终配置代码如下：

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
            .antMatchers("/").permitAll()
            .antMatchers("/swagger-ui.html").permitAll();
    http.logout().logoutUrl(apiPath + "/logout").logoutSuccessHandler(logoutSuccessHandler).deleteCookies("SESSION")
            .permitAll();

    /*http.formLogin().loginProcessingUrl(apiPath + "/login")
            .successHandler(authenticationSuccessHandler)
            .failureHandler(authenticationFailureHandler)
            .and().authorizeRequests()
            .anyRequest().authenticated()
            .and().exceptionHandling().authenticationEntryPoint(authenticationEntryPoint)
            .and().csrf().disable(); // 关闭跨域防护*/ //初代登录配置
    // 配置登录认证filter
    // http.addFilterBefore(getAuthenFilter(http), UsernamePasswordAuthenticationFilter.class); //二代登录配置
    http.apply(new LoginConfigurer<>()).loginProcessingUrl("/login") //三代登录配置
                .successHandler(authenticationSuccessHandler)
                .failureHandler(authenticationFailureHandler);
    http.authorizeRequests()
        .anyRequest()
        .authenticated()
        .and().exceptionHandling().authenticationEntryPoint(authenticationEntryPoint);
    http.csrf().disable();
    http.exceptionHandling().accessDeniedHandler(accessDeniedHandler);
    // 同一个用户只能有一个session
    http.sessionManagement()
            .maximumSessions(1)
            .sessionRegistry(sessionRegistry())
            .expiredSessionStrategy(new CustomizeSessionInfoExpiredStrategy());
}

重新启动，在不同地方使用同一账户登录，最终测试成功，单点登录功能恢复。
完结，撒花