security实现多种登录方式 1

已于 2023-05-06 16:50:45 修改
阅读量1.3k 收藏 6
点赞数
文章标签： servlet java spring
于 2023-03-22 09:50:32 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/eugene03/article/details/129703228
版权

Security 多种方式登录

1.Security 介绍

  1. 官网链接：https://docs.spring.io/spring-security/reference/5.7.6/servlet/architecture.html

2.Security 自定义拦截器实现多种登录方式

1. 账户密码登录

​ 1.自定义MyUsernamePasswordFilter

/**
 * 2023/2/26
 *
 * @author cyh
 * 10:30
 */
@Slf4j
public class MyUsernamePasswordFilter extends AbstractAuthenticationProcessingFilter {
    public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";
    public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";
    // 自定拦截路由
    private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER = new AntPathRequestMatcher("/user/login", "POST");
    private String usernameParameter = SPRING_SECURITY_FORM_USERNAME_KEY;
    private String passwordParameter = SPRING_SECURITY_FORM_PASSWORD_KEY;
    private boolean postOnly = true;
    private FormUser user;


    public MyUsernamePasswordFilter() {
        super(DEFAULT_ANT_PATH_REQUEST_MATCHER);
    }

    public MyUsernamePasswordFilter(AuthenticationManager authenticationManager) {
        super(DEFAULT_ANT_PATH_REQUEST_MATCHER, authenticationManager);
    }

    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        if (this.postOnly && !request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
        } else {
            log.info("url:" + request.getRequestURI());
            // 获取登录表单
            getUser(request);
            String username = obtainUsername();
            username = username != null ? username.trim() : "";
            String password = obtainPassword();
            password = password != null ? password : "";
            MyUsernamePasswordToken authRequest = MyUsernamePasswordToken.unauthenticated(username, password);
            this.setDetails(request, authRequest);
            this.setContinueChainBeforeSuccessfulAuthentication(false);
            return this.getAuthenticationManager().authenticate(authRequest);
        }
    }

    @Nullable
    protected String obtainPassword() {
        return user.getPassword();
    }

    @Nullable
    protected String obtainUsername() {
        return user.getUsername();
    }


    protected void setDetails(HttpServletRequest request, MyUsernamePasswordToken authRequest) {
        authRequest.setDetails(this.authenticationDetailsSource.buildDetails(request));
    }

    public void setUsernameParameter(String usernameParameter) {
        Assert.hasText(usernameParameter, "Username parameter must not be empty or null");
        this.usernameParameter = usernameParameter;
    }

    public void setPasswordParameter(String passwordParameter) {
        Assert.hasText(passwordParameter, "Password parameter must not be empty or null");
        this.passwordParameter = passwordParameter;
    }

    public void setPostOnly(boolean postOnly) {
        this.postOnly = postOnly;
    }

    public final String getUsernameParameter() {
        return this.usernameParameter;
    }

    public final String getPasswordParameter() {
        return this.passwordParameter;
    }

    /**
     * 获取登录用户信息
     *
     * @param request
     * @return
     */
    private void getUser(HttpServletRequest request) {
        ObjectMapper objectMapper = new ObjectMapper();
        objectMapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
        try {
            user = objectMapper.readValue(request.getInputStream(), FormUser.class);
            log.info("user:" + user.toString());
        } catch (Exception e) {
            throw new NullPointerException("获取不到登录信息");
        }
    }

}
  1. 自定义provider
@Slf4j
public class MyUsernamePasswordProvider implements AuthenticationProvider, InitializingBean, MessageSourceAware {


    private final MyUserDetailsService userDetailsService;
    private final PasswordEncoder passwordEncoder;
    private MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();

    public MyUsernamePasswordProvider(MyUserDetailsService userDetailsService, PasswordEncoder passwordEncoder) {
        this.userDetailsService = userDetailsService;
        this.passwordEncoder = passwordEncoder;
    }

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        try {
            MyUsernamePasswordToken tokenReq = (MyUsernamePasswordToken) authentication;
            String username = tokenReq.getPrincipal().toString();
            String password = tokenReq.getCredentials().toString();
            LoginUser loginUser = (LoginUser) userDetailsService.loadUserByUsername(username);
            if (!passwordEncoder.matches(password, loginUser.getPassword())) {
                throw new RuntimeException("账号或者密码错误");
            }
            // 将权限列表加入MyUsernamePasswordToken
            MyUsernamePasswordToken myUsernameAuthenticationToken = MyUsernamePasswordToken.authenticated(loginUser, null, null);
            myUsernameAuthenticationToken.setDetails(authentication.getDetails());
            return myUsernameAuthenticationToken;
        } catch (Exception e) {
            e.printStackTrace();
            throw new BadCredentialsException(e.getMessage());
        }
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return (MyUsernamePasswordToken.class.isAssignableFrom(authentication));
    }


    @Override
    public void afterPropertiesSet() throws Exception {
        Assert.notNull(userDetailsService, "userDetailsService must not be null");
        Assert.notNull(userDetailsService, "userDetailsService must not be null");
    }

    @Override
    public void setMessageSource(MessageSource messageSource) {
        this.messages = new MessageSourceAccessor(messageSource);
    }

  1. 自定义Token

    public class MyUsernamePasswordToken extends AbstractAuthenticationToken {
    private static final long serialVersionUID = 570L;
    private final Object principal;
    private Object credentials;

    public MyUsernamePasswordToken(Object principal, Object credentials) {
        super((Collection) null);
        this.principal = principal;
        this.credentials = credentials;
        this.setAuthenticated(false);
    }

    public MyUsernamePasswordToken(Object principal, Object credentials, Collection<? extends GrantedAuthority> authorities) {
        super(authorities);
        this.principal = principal;
        this.credentials = credentials;
        super.setAuthenticated(true);
    }

    public static MyUsernamePasswordToken unauthenticated(Object principal, Object credentials) {
        return new MyUsernamePasswordToken(principal, credentials);
    }

    public static MyUsernamePasswordToken authenticated(Object principal, Object credentials, Collection<? extends GrantedAuthority> authorities) {
        return new MyUsernamePasswordToken(principal, credentials, authorities);
    }

    public Object getCredentials() {
        return this.credentials;
    }

    public Object getPrincipal() {
        return this.principal;
    }

    public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
        Assert.isTrue(!isAuthenticated, "Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
        super.setAuthenticated(false);
    }

    public void eraseCredentials() {
        super.eraseCredentials();
        this.credentials = null;
    }
}

  2. 自定义UserDetails

    @Data
@AllArgsConstructor
@NoArgsConstructor
public class LoginUser implements UserDetails, Serializable {
    private static final long serialVersionUID = -53711580203962796L;

    private User user;
    private List<Long> permissions;

    public LoginUser(User user, List<Long> permissions) {
        this.user = user;
        this.permissions = permissions;
    }

    private List<SimpleGrantedAuthority> authorities;

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        if (authorities != null) {
            return authorities;
        }
        if (CollUtil.isEmpty(permissions)) {
            return null;
        }
        authorities = permissions.stream().filter(x -> !ObjectUtil.isNull(x)).map(x -> x.toString())
                .map(SimpleGrantedAuthority::new)
                .collect(Collectors.toList());
        return authorities;
    }

    @Override
    public String getPassword() {
        return user.getPassword();
    }

    @Override
    public String getUsername() {
        return user.getUsername();
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }
}

  3. 自定义UserDetailsService

    @Slf4j
@Service
public class MyUserDetailsService implements UserDetailsService {


    @Autowired
    UserMapper userMapper;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        log.info("userDetails");
        LambdaQueryWrapper<User> wrapper = new LambdaQueryWrapper<>();
        wrapper.eq(User::getUsername, username);
        User user = userMapper.selectOne(wrapper);
        if (Objects.isNull(user)) {
            throw new UserNotFindException("找不到用户");
        }
        if (user.getStatus() == 1) {
            throw new UserNotFindException("账户已经被禁用");
        }
        return new LoginUser(user, null);
    }

}

​ 6.自定义成功行为

/**
 * 2023/2/26
 *
 * @author cyh
 * 15:04
 */
@Slf4j
@Component
public class MyUsernamePasswordSuccessHandler implements AuthenticationSuccessHandler {

    @Autowired
    RedisTemplate<String, String> redisTemplate;
    @Autowired
    UserRoleService userRoleService;
    @Autowired
    IUserService userService;

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authentication) throws IOException, ServletException {
        chain.doFilter(request, response);
    }

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        response.setCharacterEncoding("utf-8");
        response.setContentType("application/json;charset=utf-8");
        LoginUser loginUser = (LoginUser) authentication.getPrincipal();
        Long uid = loginUser.getUser().getId();

        // 每次登录添加登录ip和时间
        //  获取权限列表并返回
        User user = loginUser.getUser();
        user.setLastLoginTime(LocalDateTime.now().toString());
        user.setLoginIp(ServletUtil.getClientIP(request));
        userService.updateById(user);
        String token = MyJwtUtil.getToken(uid, RequestKey.ADMIN_USER.getKey());
        redisTemplate.opsForValue().set(RequestKey.ADMIN_USER.getKey() + "login:" + uid, token, 60 * 60 * 72, TimeUnit.SECONDS);
        // TODO redis存放门店列表
        // TODO redis存放权限列表
        List<Long> permsByUserId = userRoleService.getPermsByUserId(uid);
        ResultAuthority resultAuthority = new ResultAuthority(token, permsByUserId);
        ResultData<ResultAuthority> ok = ResultData.success("ok", resultAuthority);
        response.getWriter().print(JSONUtil.parseObj(ok));
        log.info("登录成功：" + authentication.getPrincipal().toString());
    }
}

​ 7.自定义错误返回

@Slf4j
public class MyUsernamePasswordErrorHandler implements AuthenticationFailureHandler {
    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
        log.info(exception.getMessage());
        response.setCharacterEncoding("utf-8");
        response.setContentType("application/json;charset=utf-8");
        response.setStatus(200);
        ResultData<ResultAuthority> ok = ResultData.fail(500, exception.getMessage());
        response.getWriter().print(JSONUtil.parseObj(ok));
    }
}

3. 微信授权登录

  1. 微信登录拦截器

/**
 * 2023/3/6
 *
 * @author cyh
 * 9:29
 */
@Slf4j
public class WxLoginFilter extends AbstractAuthenticationProcessingFilter {

    private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER = new AntPathRequestMatcher("/wxlogin/userinfo", "GET");
    private boolean postOnly = true;

    public WxLoginFilter() {
        super(DEFAULT_ANT_PATH_REQUEST_MATCHER);
    }

    public WxLoginFilter(AuthenticationManager authenticationManager) {
        super(DEFAULT_ANT_PATH_REQUEST_MATCHER, authenticationManager);
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException {
        log.info("正在进行拦截");
        if (!request.getMethod().equals("GET")) {
            throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
        } else {
            // 从请求头里获取到code
            String code = obtainCode(request);
            code = code != null ? code.trim() : "";
            WxUserToken wxUserToken = WxUserToken.unauthenticated(code, null);
            this.setDetails(request, wxUserToken);
            return this.getAuthenticationManager().authenticate(wxUserToken);
        }
    }

    protected void setDetails(HttpServletRequest request, WxUserToken authRequest) {
        authRequest.setDetails(this.authenticationDetailsSource.buildDetails(request));
    }

    @Nullable
    protected String obtainCode(HttpServletRequest request) {
        return request.getParameter("code");
    }


    public void setPostOnly(boolean postOnly) {
        this.postOnly = postOnly;
    }
}

  1. 微信登录provider

    /**
 * 2023/3/6
 *
 * @author cyh
 * 9:35
 */
@Slf4j
public class WxLoginProvider implements AuthenticationProvider, InitializingBean, MessageSourceAware {

    private final WxLoginServiceImpl wxLoginService;
    private final WxLoginUtilService wxLoginUtilService;
    private MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();

    public WxLoginProvider(WxLoginServiceImpl userDetailsService, WxLoginUtilService wxLoginUtilService) {
        this.wxLoginService = userDetailsService;
        this.wxLoginUtilService = wxLoginUtilService;
    }

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        WxUserToken tokenReq = (WxUserToken) authentication;
        String code = (String) tokenReq.getPrincipal();
        WxUserToken wxUserToken = null;
        String openid = null;
        // 根据code拿到access_token和openid
        try {
            // 向微信获取
            WxOAuth2AccessToken accessToken = wxLoginUtilService.getAccessTokenAndOpenID(code);
            openid = wxLoginUtilService.getWxUserInfo(accessToken);
        } catch (WxErrorException e) {
            throw new RuntimeException(e);
        }
        // 从数据库里获取用户信息并设置认证通过
        WxLoginEntity wxLoginEntity = wxLoginService.loadUserByUsername(openid);
        log.info("userDetails:{}", wxLoginEntity.toString());
        wxUserToken = WxUserToken.authenticated(wxLoginEntity, null, null);
        wxUserToken.setDetails(authentication.getDetails());
        return wxUserToken;
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return (WxUserToken.class.isAssignableFrom(authentication));
    }

    @Override
    public void afterPropertiesSet() throws Exception {
        Assert.notNull(wxLoginService, "userDetailsService must not be null");
    }

    @Override
    public void setMessageSource(MessageSource messageSource) {
        this.messages = new MessageSourceAccessor(messageSource);
    }
}

  2. 微信登录的Token

/**
 * 2023/3/6
 *
 * @author cyh
 * 9:33
 */
public class WxUserToken extends AbstractAuthenticationToken {

    private static final long serialVersionUID = 570L;
    private final Object principal;
    private Object credentials;

    public WxUserToken(Object principal, Object credentials) {
        super((Collection) null);
        this.principal = principal;
        this.credentials = credentials;
        this.setAuthenticated(false);
    }

    public WxUserToken(Object principal, Object credentials, Collection<? extends GrantedAuthority> authorities) {
        super(authorities);
        this.principal = principal;
        this.credentials = credentials;
        super.setAuthenticated(true);
    }

    public static WxUserToken unauthenticated(Object principal, Object credentials) {
        return new WxUserToken(principal, credentials);
    }

    public static WxUserToken authenticated(Object principal, Object credentials, Collection<? extends GrantedAuthority> authorities) {
        return new WxUserToken(principal, credentials, authorities);
    }

    public Object getCredentials() {
        return this.credentials;
    }

    public Object getPrincipal() {
        return this.principal;
    }

    public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
        Assert.isTrue(!isAuthenticated, "Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
        super.setAuthenticated(false);
    }

    public void eraseCredentials() {
        super.eraseCredentials();
        this.credentials = null;
    }

}
  1. 微信登录的UserDetails

/**
 * 2023/3/6
 *
 * @author cyh
 * 14:12
 */
@Data
@AllArgsConstructor
public class WxLoginEntity implements UserDetails {

    private OrderUser user;

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return null;
    }

    @Override
    public String getPassword() {
        return null;
    }

    @Override
    public String getUsername() {
        return user.getOpenid();
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }
}
  1. 微信登录的UserDetailsService
@Slf4j
@Service
public class WxLoginServiceImpl implements UserDetailsService {

    @Autowired
    WxLoginUtilService wxLoginUtilService;
    @Autowired
    IOrderUserService orderUserService;

    /**
     * 获取数据库用户信息
     *
     * @param username
     * @return
     * @throws UsernameNotFoundException
     */
    @Override
    public WxLoginEntity loadUserByUsername(String username) throws UsernameNotFoundException {
        OrderUser orderUser;
        orderUser = orderUserService.getOne(new LambdaQueryWrapper<OrderUser>().eq(OrderUser::getOpenid, username));
        if (ObjectUtil.isNull(orderUser)) {
            throw new UsernameNotFoundException("找不到用户");
        }
        return new WxLoginEntity(orderUser);
    }

}

  1. 成功返回

    @Slf4j
@Component
public class WxLoginSuccessHandler implements AuthenticationSuccessHandler {

    @Autowired
    RedisTemplate<String, String> redisTemplate;
    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

    @Override
    @IgnoreResponseAdvice
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException {
        // 获取当前认证的用户
        WxLoginEntity loginUser = (WxLoginEntity) authentication.getPrincipal();
        // 获取用户的id
        Long uid = loginUser.getUser().getId();
        // 获取token
        String token = MyJwtUtil.getToken(uid, RequestKey.WX_USER.getKey());
        redisTemplate.opsForValue().set(RequestKey.WX_USER.getKey() + "login:" + loginUser.getUser().getId(), token, 60 * 60 * 72, TimeUnit.SECONDS);
        // 设置返回的id和token
        response.setCharacterEncoding("utf-8");
        response.setContentType("application/json;charset=utf-8");
        Map<String, String> map = new HashMap<>();
        map.put("nickname", loginUser.getUser().getNickname());
        map.put("openid", loginUser.getUser().getOpenid());
        map.put("token", token);
        // 返回给前端
        ResultData<Map> ok = ResultData.success("ok", map);
        response.getWriter().print(JSONUtil.parseObj(ok));
    }
}

  2. 失败返回

    /**
 * 2023/3/6
 *
 * @author cyh
 * 9:35
 */
public class WxLoginErrorHandler implements AuthenticationFailureHandler {
    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
        throw new RuntimeException("授权登录验证失败");
    }
}

    自定义token拦截器

    /**
 * 2023/2/26
 *
 * @author cyh
 * 17:18
 */
@Slf4j
public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
    /**
     * 请求头token的key
     */
    private String tokenKey = RequestKey.TOKEN_KEY.getKey();

    /**
     * 用户的value
     */
    private String wxUser = RequestKey.WX_USER.getKey();
    /**
     * 管理用户的value
     */
    private String adminUser = RequestKey.ADMIN_USER.getKey();
    /**
     * redis 工具
     */
    private RedisTemplate<String, String> redisTemplate;
    /**
     * 微信登录用户
     */
    private IOrderUserService orderUserService;
    /**
     * 管理用户
     */
    private IUserService userService;
    /**
     * jwt 工具
     */
    private MyJwtUtil myJwtUtil;
    /**
     * 用户权限
     */
    private UserRoleService userRoleService;


    public JwtAuthenticationTokenFilter(IOrderUserService orderUserService, IUserService userService, MyJwtUtil myJwtUtil, UserRoleService userRoleService, RedisTemplate<String, String> redisTemplate) {
        this.orderUserService = orderUserService;
        this.userService = userService;
        this.myJwtUtil = myJwtUtil;
        this.userRoleService = userRoleService;
        this.redisTemplate = redisTemplate;
    }


    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain chain) throws ServletException, IOException {
        String reqToken = request.getHeader(this.tokenKey);
        log.info("现在{}正在进行jwt认证:{}", request.getRequestURI(), reqToken);
        // 判断token和请求用户是否存在
        if (Strings.isBlank(reqToken)) {
            chain.doFilter(request, response);
            return;
        }
        // 判断token是否过期
        if (!myJwtUtil.verifyToken(reqToken)) {
            throw new TokenException("非法token, token已过期");
        }
        // 从token上获取uid
        Long uid = myJwtUtil.getUid(reqToken);
        String reqUser = myJwtUtil.getRoleUser(reqToken);
        if (ObjectUtil.isNull(uid) || ObjectUtil.isNull(reqUser)) {
            throw new TokenException("非法token");
        }
        if (StrUtil.equals(reqUser, wxUser)) {
            // 与redis中的用户token对比
            String redisToken = redisTemplate.opsForValue().get(wxUser + "login:" + uid);
            log.info("redisToken:{}", redisToken);
            if (StrUtil.isBlankIfStr(redisToken) || !StrUtil.equals(redisToken, reqToken)) {
                throw new TokenException("非法token");
            }
            // 判断获取的用户存不存在
            OrderUser user = orderUserService.getById(uid);
            if (ObjectUtil.isNull(user)) {
                throw new TokenException("非法token");
            }
            // 存在设置认证通过
            WxLoginEntity wxLoginEntity = new WxLoginEntity(user);
            WxUserToken wxUserToken = WxUserToken.authenticated(wxLoginEntity, null, null);
            SecurityContextHolder.getContext().setAuthentication(wxUserToken);
            chain.doFilter(request, response);
            return;
        }
        if (StrUtil.equals(reqUser, adminUser)) {
            // 与redis中的用户token对比
            String redisToken = redisTemplate.opsForValue().get(adminUser + "login:" + uid);
            log.info("redisToken:{}", redisToken);
            if (StrUtil.isBlankIfStr(redisToken) || !StrUtil.equals(redisToken, reqToken)) {
                throw new TokenException("非法token");
            }
            // TODO 从redis获取用户信息
            User byId = userService.getById(uid);
            // TODO 将用户信息放入MyUsernamePasswordToken
            List<Long> permsByUserId = userRoleService.getPermsByUserId(uid);
            LoginUser loginUser = new LoginUser(byId, permsByUserId);
            if (loginUser.getUser().getStatus() == 1) {
                redisTemplate.delete(adminUser + "login:" + uid);
                throw new TokenException("账户被禁用，请重新登录");
            }
            MyUsernamePasswordToken myUsernamePasswordToken = new MyUsernamePasswordToken(loginUser, null,
                    loginUser.getAuthorities());
            // TODO 将认证的信息放入 SecurityContextHolder.getContext()
            SecurityContextHolder.getContext().setAuthentication(myUsernamePasswordToken);
            chain.doFilter(request, response);
            return;
        }
        throw new TokenException("非法token");
    }

}

4. Security配置类

@Configuration
@EnableWebSecurity    // 添加 security 过滤器\
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig {

    /**
     * token认证器
     */
    @Autowired
    IOrderUserService orderUserService;
    @Autowired
    IUserService userService;
    @Autowired
    MyJwtUtil myJwtUtil;
    @Autowired
    UserRoleService userRoleService;
    @Autowired
    RedisTemplate<String, String> redisTemplate;

    JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter() {
        return new JwtAuthenticationTokenFilter(orderUserService, userService, myJwtUtil, userRoleService, redisTemplate);
    }

    /**
     * 放行路径配置类
     */
    @Autowired
    SecurityRelease securityRelease;

    /**
     * 放行路径
     */

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }


    /**
     * 获取AuthenticationManager（认证管理器），登录时认证使用
     *
     * @return
     * @throws Exception
     */
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
        AuthenticationManager authenticationManager = authenticationConfiguration.getAuthenticationManager();
        return authenticationManager;
    }

    @Bean
    SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.exceptionHandling().accessDeniedHandler(new AccessDeniedHandlerImpl());
        return
                http.authorizeRequests(authorize -> authorize
                                .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
                                // 请求放开
                                .antMatchers(securityRelease.getReleaseUrl()).permitAll()
                                // 其他地址的访问均需验证权限
                                .anyRequest().authenticated()
                        ) // 基于 token，不需要 csrf
                        .csrf().disable()
                        .formLogin().disable()
                        // 基于 token，不需要 session
                        .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
                        .addFilterAt(wxLoginFilter(), UsernamePasswordAuthenticationFilter.class)
                        .addFilterAt(usernamePasswordFilter(), UsernamePasswordAuthenticationFilter.class)
                        .addFilterBefore(jwtAuthenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class)
                        .build();


    }

    /**
     * 配置跨源访问(CORS)
     *
     * @return
     */
    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", new CorsConfiguration().applyPermitDefaultValues());
        return source;
    }


    @Autowired
    WxLoginServiceImpl wxLoginService;
    @Autowired
    WxLoginUtilService wxLoginUtilService;
    @Autowired
    WxLoginSuccessHandler wxLoginSuccessHandler;

    // 添加微信用户登录拦截器
    WxLoginFilter wxLoginFilter() throws Exception {
        WxLoginFilter myUsernameFilter = new WxLoginFilter();
        ProviderManager providerManager = new ProviderManager(Collections.singletonList(wxLoginProvider()));
        myUsernameFilter.setAuthenticationManager(providerManager);
        myUsernameFilter.setAuthenticationSuccessHandler(wxLoginSuccessHandler);
        myUsernameFilter.setAuthenticationFailureHandler(new WxLoginErrorHandler());
        myUsernameFilter.setContinueChainBeforeSuccessfulAuthentication(true);
        return myUsernameFilter;
    }

    WxLoginProvider wxLoginProvider() {
        WxLoginProvider provider = new WxLoginProvider(wxLoginService, wxLoginUtilService);
        return provider;
    }

    @Autowired
    MyUsernamePasswordSuccessHandler myUsernamePasswordSuccessHandler;
    @Autowired
    MyUserDetailsService userDetailsService;

    /**
     * 添加用户登录拦截器
     *
     * @return
     */
    MyUsernamePasswordFilter usernamePasswordFilter() {
        MyUsernamePasswordFilter filter = new MyUsernamePasswordFilter();
        ProviderManager manager = new ProviderManager(Collections.singletonList(usernamePasswordProvider()));
        filter.setAuthenticationManager(manager);
        filter.setAuthenticationFailureHandler(new MyUsernamePasswordErrorHandler());
        filter.setAuthenticationSuccessHandler(myUsernamePasswordSuccessHandler);
        return filter;
    }


    MyUsernamePasswordProvider usernamePasswordProvider() {
        return new MyUsernamePasswordProvider(userDetailsService, passwordEncoder());
    }
}

4.yml 文件配置放行路径

my-security:
  releaseUrl:
    - /wxlogin/**
    - /user/login
    - /user/logout
    - /doc.html
    - /webjars/**
    - /swagger-resources/**
    - /v2/**
    - /wx-pay/**
    - /**

5. 放行路径配置类

/**
 * 2023/3/13
 * security 放行路径配置类
 *
 * @author cyh
 * 14:27
 */
@Configuration
@Data
@ConfigurationProperties(prefix = "my-security")
public class SecurityRelease {
    private String[] releaseUrl;
}

3. 权限设置

  1. 数据库权限点保存

    ​ [外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-aWa6zeeH-1679449812207)(C:\Users\Administrator\AppData\Roaming\Typora\typora-user-images\image-20230322093826605.png)]

  2. 登录返回权限点

    [外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-Mb8MtsDm-1679449812208)(C:\Users\Administrator\AppData\Roaming\Typora\typora-user-images\image-20230322094029525.png)]

  3. 每次请求加载自定义Token并加载权限点

    [外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-QkccC3If-1679449812209)(C:\Users\Administrator\AppData\Roaming\Typora\typora-user-images\image-20230322094147211.png)]

  4. 在方法前权限点验证用户权限 — 配置类开启方法级别的权限认证

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-Hb9Wn6uw-1679449812209)(C:\Users\Administrator\AppData\Roaming\Typora\typora-user-images\image-20230322094236312.png)]

  1. 自定义权限点的转换

    [外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-IpMzvhOS-1679449812209)(C:\Users\Administrator\AppData\Roaming\Typora\typora-user-images\image-20230322094404170.png)]

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-zIKK617J-1679449812210)(C:\Users\Administrator\AppData\Roaming\Typora\typora-user-images\image-20230322094420956.png)]
rdProvider usernamePasswordProvider() {
return new MyUsernamePasswordProvider(userDetailsService, passwordEncoder());
}
}


### **4.yml** 文件配置放行路径

```java
my-security:
  releaseUrl:
    - /wxlogin/**
    - /user/login
    - /user/logout
    - /doc.html
    - /webjars/**
    - /swagger-resources/**
    - /v2/**
    - /wx-pay/**
    - /**

5. 放行路径配置类

/**
 * 2023/3/13
 * security 放行路径配置类
 *
 * @author cyh
 * 14:27
 */
@Configuration
@Data
@ConfigurationProperties(prefix = "my-security")
public class SecurityRelease {
    private String[] releaseUrl;
}

3. 权限设置

  1. 数据库权限点保存

    ​ [外链图片转存中…(img-aWa6zeeH-1679449812207)]

  2. 登录返回权限点

    [外链图片转存中…(img-Mb8MtsDm-1679449812208)]

  3. 每次请求加载自定义Token并加载权限点

    [外链图片转存中…(img-QkccC3If-1679449812209)]

  4. 在方法前权限点验证用户权限 — 配置类开启方法级别的权限认证

[外链图片转存中…(img-Hb9Wn6uw-1679449812209)]

  1. 自定义权限点的转换

    [外链图片转存中…(img-IpMzvhOS-1679449812209)]

[外链图片转存中…(img-zIKK617J-1679449812210)]

Eugene03
关注
SpringBoot + SpringSecurity 短信验证码登录功能实现
08-27
SpringBoot + SpringSecurity 短信验证码登录功能实现 本文主要介绍了 SpringBoot + SpringSecurity 短信验证码登录功能实现的详细过程，该功能可以使用户通过手机短信验证码登录系统，而不是传统的用户名密码登录...
在 Spring Security 中定义多种登录方式，比如邮箱、手机验证码登录
xxxzzzqqq_的博客
03-21 3757
自定义认证方式总体来说还是很简单的；需要从头重写的也就三个类，然后就是将其配置到Spring Security 中。如果需要再自定义手机号验证码登录，按照上述流程再走一遍就行。其实也是 copy 一份，然后进行小幅度的修改即可。
security实现账密、手机号和微信三种方式登陆
qq_39164603的博客
09-16 5057
：security实现多种方式登陆 spring security 的核心功能主要包括 认证 授权 攻击防护 其核心就是一组过滤器链，项目启动后将会自动配置。最核心的就是 Basic Authentication Filter 用来认证用户的身份，一个在spring security中一种过滤器处理一种认证方式。 在说多种认证方式之前，咱们先简单过下单认证方式是如何配置的，也说下Spring Security的各个配置类的作用。 1、UsernamePasswordAuthenticationFilte
SpringSecurity配置多种登录方式
qq_53318060的博客
10-13 4167
SpringSecurity配置多种登陆方式
SpringBoot + Spring Security多种登录方式：账号+微信网页授权登录
Java知音
04-02 5453
一、概述实现账号用户名+微信网页授权登录集成在Spring Security的思路，最重要的一点是要实现微信登录通过Spring Security安全框架时，不需要验证账号、密码。二、准备工作要实现该功能，首先需要掌握Spring Security框架和微信扫码登录接口相关技术，如果对这两块还不太熟悉，可以参考：1、Springboot + Spring Security实现前后端分离登录认证及权...
SpringSecurity自定义多重登录方式
头发茂密的假程序猿
12-27 5755
前后分离项目，SpringSecurity自定义多重登录方式，通过自定义AuthenticationProvider实现，同时自定义过滤器进行登录验证
springSecurity登录的全过程
XuDream的博客
08-12 3282
整个流程就是：进入接口—>进行验证—>获取用户信息—>创建token—>存入redis—>返回/*** 自定义权限实现，ss取自SpringSecurity首字母*/*** 所有权限标识/*** 管理员角色权限标识/*** 验证用户是否具备某权限** @param permission 权限字符串* @return 用户是否具备某权限System . out . println("拥用这个权限才能通过" + permission);...
【Spring Security】入门——实现用户注册登录
热门推荐
淮南King的博客
07-21 1万+
一、项目框架1. 项目结构2. 选择安装依赖二、数据库三、代码实现1. 配置文件2. Spring Security 是一个功能强大且高度可自定义的身份验证和访问控制框架，它侧重于为 Java 应用程序提供身份验证和授权。 官网传送门：Spring Security官网 本篇文章目的在于快速使用Spring Boot与Spring Security搭建一个项目，实现简单的用户注册登录。 此项目所用知识点： Spring Boot Spring Security Mybatis 一、项目框架 1. 项目.
Spring Security自定义登录原理及实现详解
09-07
在本文中，我们将深入探讨Spring Security的自定义登录原理和实现，这对于理解和构建安全的Web应用程序至关重要。Spring Security是一个强大的安全框架，提供了丰富的功能来保护我们的应用程序，包括用户认证、授权...
Spring Security通过AuthenticationManager的逻辑实现多种认证方式.docx
07-04
总的来说，`AbstractAuthenticationProcessingFilter`结合`AuthenticationManager`提供了一种灵活的机制，可以实现多种认证方式。开发者可以通过自定义`AuthenticationProvider`和`AuthenticationManager`的实现，...
Spring Security Oauth2.0 实现短信验证码登录示例
08-28
Spring Security Oauth2.0 实现短信验证码登录示例 本篇文章主要介绍了 Spring Security Oauth2.0 实现短信验证码登录示例，具有一定的参考价值。下面是该示例的详细知识点解释： 一、Spring Security Oauth2.0 ...
Spring Security基于JWT实现SSO单点登录详解
08-25
Spring Security 基于 JWT 实现 SSO 单点登录详解 基于 Spring Security 框架和 JWT（JSON Web Token）技术，可以实现 SSO（Single Sign-On）单点登录系统。SSO 是一种常见的身份验证机制，允许用户使用同一个...
Spring Security多种登录方式
dnf9906的博客
02-02 5142
目录不用过滤器（使用json传参方式登录）SecurityConfig配置账号密码手机号验证码使用使用过滤器实现（使用form表单传参方式登录） 不用过滤器（使用json传参方式登录） SecurityConfig配置 import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.http
学习：security登陆、认证、授权
Museum
07-31 1175
设置账号和密码 第一种方法：配置文件(不常用） application spring.security.user.name=admin spring.security.user.password=123 第二种方法：配置类 需要继承WebSecurityConfigurerAdapter @Configuration public class SecurityConfig extends WebSecurityConfigurerAdapter { @Override protected
security登录流程
weixin_48100716的博客
12-15 1166
用户发起登陆请求AdminController,然后调用我们自己的登录业务实现类AdminServiceImpl的登录方法去处理,调用security框架的核心接口方法authenticate开始认证,他会自动去调用我们实现security框架的UserDetailsService接口的登录认证方法,若是认证成功则向前端返回JWT数据,注:AuthenticationManager(接口是认证的核心接口),也是认证的出发点.我们通过security框架认证登录信息,若登陆成功,最终返回的是JWT数据。
SpringSecurity多端登录实现方案
一名蒟蒻的博客
01-12 9909
七、SpringSecurity多端登录实现方案 1、自定义AbstractAuthenticationProcessingFilter（仿UsernamePasswordAuthenticationFilter） public class MyAuthenticationFilter extends AbstractAuthenticationProcessingFilter { public static final String SPRING_SECURITY_FORM_USERNAME
Spring Security实现登录
不愧是暮言的博客
05-24 3715
Spring Security是Spring框架下的一个用于身份验证和授权的框架，它可以帮忙管理web应用中的用户认证、授权以及安全性问题。环境准备Spring Security核心概念实现基本登录功能添加Spring Security的数据库认证Spring Security是一个非常好用的身份认证和授权框架，可以有效保证应用的安全性。本文介绍了如何使用Spring Security实现基本的登录功能和数据库认证，希望这篇文章能够帮助到你。。
SpringSecurity登录流程
weixin_45802793的博客
09-27 4229
SpringSecurity登录流程 1.无处不在的Authentication 实现类中，我们最常用的是UsernamePasswordAuthenticationToken 2.登录流程 Spring Security中,认证和授权的校验都是在一系列过滤器链完成的，和认证相关的过滤器就是UsernamePasswordAuthenticationFilter public Authentication attemptAuthentication(HttpServletRequest reque
日常bug记录，easyexcel导入报错convert data ... to class java.math.BigDecimal error
最新发布
mm
11-11 205
排查发现实体类中有BigDecimal属性，然而数据中这个属性为null，进行转换时报错。在实体类上加上自定义转换器。解决方法：自定义转换器类。
springsecurity自定义多种登录方式
09-28
总的来说，实现多种登录方式的关键在于实现自定义的AuthenticationProvider和AuthenticationFilter，并在Spring Security的配置文件中进行配置。 ### 回答2： Spring Security 提供了多种自定义登录方式的选项。...
评论 3
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值