权限管理03-security登陆后鉴权

高秉文

已于 2022-02-11 16:59:54 修改

阅读量3.5k

点赞数 2

分类专栏：权限管理实战文章标签：安全 https 服务器

于 2022-02-11 08:58:08 首次发布

本文链接：https://blog.csdn.net/g759780748/article/details/122873069

版权

权限管理实战专栏收录该内容

4 篇文章 1 订阅

订阅专栏

1 大坑解决(security登录认证成功后，获取的用户一直是匿名用户)

【问题复现】

登陆成功后，调用其他接口，总是自动进入到我们的匿名用户未授权的过滤器，也就是前文写的这里

【问题分析】

security在UsernamePasswordAuthenticationFilter过滤器进行登录参数获取，但是之前还有一个过滤器SecurityContextPersistenceFilter，看下源码

源码中这个过滤器会清除掉

SecurityContextHolder中的Context，导致我们SecurityContextHolder.getContext().getAuthentication();肯定会出问题

【问题解决】

思路如下：

既然SecurityContextPersistenceFilter过滤器在UsernamePasswordAuthenticationFilter之前就把SecurityContextHolder中的Context清除了，那我们可以写一个过滤器，重新把SecurityContextHolder的context设置进去，并且此过滤器要放在UsernamePasswordAuthenticationFilter之后，那么就非常容易了

security中的过滤器一般都继承OncePerRequestFilter

package com.grm.security;

import com.alibaba.fastjson.JSON;
import com.grm.common.Result;
import com.grm.security.details.LoginUser;
import com.grm.util.JwtUtil;
import com.grm.util.RedisUtil;
import io.jsonwebtoken.Claims;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.ObjectUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * 解决天坑坑坑坑坑----------------
 * 登录成功，一直401，显示匿名用户鉴权失败，是因为SecurityContextHolder自己把Context清楚了，我们需要重新设置一下
 *
 * @author gaorimao
 * @date 2022/02/10
 */
@Slf4j
@Component
public class MyOncePerRequestFilter extends OncePerRequestFilter {
    @Autowired
    private JwtUtil jwtUtil;
    @Autowired
    private RedisUtil redisUtil;
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        if(!"/login".equals(request.getRequestURI())){
            log.info("[RequestURI] path = {}",request.getRequestURI());
            String token = request.getHeader("Authorization");
            if(ObjectUtils.isEmpty(token)){
                Result.renderJsonStr(response,Result.failed(500,"获取token失败！"));
            }
            Claims claims = jwtUtil.parseToken(token);
            String username = claims.getSubject();
            if(ObjectUtils.isEmpty(username)){
                Result.renderJsonStr(response,Result.failed(500,"token解析失败！"));
            }
            Object redisTokenObj = redisUtil.get("Authorization:"+username);
            if(redisTokenObj == null){
                Result.renderJsonStr(response,Result.failed(500,"token已过期！"));
            }
            Object loginUserObj = redisUtil.get("LoginUser:"+username);
            if(loginUserObj == null){
                Result.renderJsonStr(response,Result.failed(500,"获取当前登录用户失败！"));
            }
            LoginUser loginUser = (LoginUser)loginUserObj;
            log.info("[LoginUser] redis loginUser = {}", JSON.toJSONString(loginUser));

            /*
                重新设置SecurityContextHolder
             */
            UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(loginUser, loginUser.getPassword(), loginUser.getAuthorities());
            authenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
            SecurityContextHolder.getContext().setAuthentication(authenticationToken);
        }
        filterChain.doFilter(request, response);
    }
}

把这个过滤器配置在SecurityConfig中

@Autowired
private MyOncePerRequestFilter myOncePerRequestFilter;

// 重新设置SecurityContextHolder
http.addFilterBefore(myOncePerRequestFilter, UsernamePasswordAuthenticationFilter.class);