基于SpringBoot2.7+SpringSecurity5.7的登录鉴权方案

本文链接：https://blog.csdn.net/loli_wolf/article/details/127698428

添加配置类SecurityConfig

SpringSecurity5.7+不需要继承WebSecurityConfigurerAdapter,而是注入一个过滤链的Bean,通过这个过滤链去处理用户登录的请求

@Bean
SecurityFilterChain filerChain(HttpSecurity http) throws Exception {
    return http.authorizeHttpRequests()
                .anyRequest().authenticated()
                .and().formLogin()
                .and().csrf().disable()
                .build();
}

自定义登录处理

登陆成功

自定义AuthenticationSuccessHandler接口的实现类

public class MyAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        Map<String, Object> result = new HashMap<String, Object>();
        result.put("msg", "登录成功");
        result.put("status", 200);
        response.setContentType("application/json;charset=UTF-8");
        String s = new ObjectMapper().writeValueAsString(result);
        response.getWriter().println(s);
    }
}

filterChain方法中替换

.and().formLogin().successHandler(new MyAuthenticationSucccessHandler())

登陆失败

自定义AuthenticationFailureHandler接口的实现类

public class MyAuthenticationFailureHandler implements AuthenticationFailureHandler {
    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
        Map<String, Object> result = new HashMap<String, Object>();
        result.put("msg", "登录失败: "+exception.getMessage());
        result.put("status", 500);
        response.setContentType("application/json;charset=UTF-8");
        String s = new ObjectMapper().writeValueAsString(result);
        response.getWriter().println(s);
    }
}

filterChain方法中替换

.failureHandler(new MyAuthenticationFailureHandler())

自定义登出处理

自定义LogoutSuccessHandler接口的实现类

public class MyLogoutSuccessHandler implements LogoutSuccessHandler {

    @Override
    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        Map<String, Object> result = new HashMap<String, Object>();
        result.put("msg", "注销成功");
        result.put("status", 200);
        response.setContentType("application/json;charset=UTF-8");
        String s = new ObjectMapper().writeValueAsString(result);
        response.getWriter().println(s);
    }
}

filterChain方法中替换
```
.and().logout().logoutSuccessHandler(new MyLogoutSuccessHandler())
```
- 通过 logout() 方法开启注销配置
- logoutUrl 指定退出登录请求地址，默认是 GET 请求，路径为 /logout
- invalidateHttpSession 退出时是否使 session 失效，默认值为 true
- clearAuthentication 退出时是否清除认证信息，默认值为 true
- 可以配置多个注销登录的请求，指定方法
```
.logoutRequestMatcher(new OrRequestMatcher(
                        new AntPathRequestMatcher("/logout1","GET"),
                        new AntPathRequestMatcher("/logout","GET")
                ))
```

自定义认证数据源

依赖

<dependency>
  <groupId>org.mybatis.spring.boot</groupId>
  <artifactId>mybatis-spring-boot-starter</artifactId>
  <version>2.2.2</version>
</dependency>
<dependency>
  <groupId>mysql</groupId>
  <artifactId>mysql-connector-java</artifactId>
  </dependency>
<dependency>
  <groupId>com.alibaba</groupId>
  <artifactId>druid</artifactId>
  <version>1.2.11</version>
</dependency>

设计表结构

-- 用户表
CREATE TABLE `user`
(
    `id`                    int(11) NOT NULL AUTO_INCREMENT,
    `username`              varchar(32)  DEFAULT NULL,
    `password`              varchar(255) DEFAULT NULL,
    `enabled`               tinyint(1) DEFAULT NULL,
    `accountNonExpired`     tinyint(1) DEFAULT NULL,
    `accountNonLocked`      tinyint(1) DEFAULT NULL,
    `credentialsNonExpired` tinyint(1) DEFAULT NULL,
    PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8;
-- 角色表
CREATE TABLE `role`
(
    `id`      int(11) NOT NULL AUTO_INCREMENT,
    `name`    varchar(32) DEFAULT NULL,
    `name_zh` varchar(32) DEFAULT NULL,
    PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8;
-- 用户角色关系表
CREATE TABLE `user_role`
(
    `id`  int(11) NOT NULL AUTO_INCREMENT,
    `uid` int(11) DEFAULT NULL,
    `rid` int(11) DEFAULT NULL,
    PRIMARY KEY (`id`),
    KEY   `uid` (`uid`),
    KEY   `rid` (`rid`)
) ENGINE=InnoDB AUTO_INCREMENT=5 DEFAULT CHARSET=utf8;

加配置

# datasource
spring.datasource.type=com.alibaba.druid.pool.DruidDataSource
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
spring.datasource.url=jdbc:mysql://localhost:3306/demo4_springsecurity
spring.datasource.username=root
spring.datasource.password=123456

# mybatis
mybatis.mapper-locations=classpath:com/demo/mapper/*.xml
mybatis.type-aliases-package=com.demo.entity

# log
logging.level.com.demo=debug

做service,dao,mapper,entity

Role类

package com.demo.entity;

import lombok.AllArgsConstructor;
import lombok.Data;
import lombok.NoArgsConstructor;

@Data
@AllArgsConstructor
@NoArgsConstructor
public class Role {
    private Integer id;
    private String name;
    private String nameZh;
    //get set..
}

User类

package com.demo.entity;

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;

import java.util.ArrayList;
import java.util.Collection;
import java.util.List;

public class User  implements UserDetails {
    private Integer id;
    private String username;
    private String password;
    private Boolean enabled;
    private Boolean accountNonExpired;
    private Boolean accountNonLocked;
    private Boolean credentialsNonExpired;
    private List<Role> roles = new ArrayList<>();

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        List<GrantedAuthority> grantedAuthorities = new ArrayList<>();
        roles.forEach(role->grantedAuthorities.add(new SimpleGrantedAuthority(role.getName())));
        return grantedAuthorities;
    }

    @Override
    public String getPassword() {
        return password;
    }

    @Override
    public String getUsername() {
        return username;
    }

    @Override
    public boolean isAccountNonExpired() {
        return accountNonExpired;
    }

    @Override
    public boolean isAccountNonLocked() {
        return accountNonLocked;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return credentialsNonExpired;
    }

    public Integer getId() {
        return id;
    }

    public void setRoles(List<Role> roles) {
        this.roles = roles;
    }
    
    public List<Role> getRoles(){ return this.roles; }
    
    @Override
    public boolean isEnabled() {
        return enabled;
    }
    //get/set....
    public void setPassword(String password) {
        this.password = password;
    }
}

UserDao

package com.demo.dao;

import com.demo.entity.Role;
import com.demo.entity.User;
import org.apache.ibatis.annotations.Mapper;
import java.util.List;

@Mapper
public interface UserDao {
    //根据用户名查询用户
    User loadUserByUsername(@Param("username") String username);

    //根据用户id查询角色
    List<Role> getRolesByUid(@Param("uid") Integer uid);
}

UserMapper

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.demo.dao.UserDao">
    <!--查询单个-->
    <select id="loadUserByUsername" resultType="com.demo.entity.User">
        select id,
               username,
               password,
               enabled,
               accountNonExpired,
               accountNonLocked,
               credentialsNonExpired
        from user
        where username = #{username}
    </select>

    <!--查询指定行数据-->
    <select id="getRolesByUid" resultType="com.demo.entity.Role">
        select r.id,
               r.name,
               r.name_zh nameZh
        from role r,
             user_role ur
        where r.id = ur.rid
          and ur.uid = #{uid}
    </select>
</mapper>

UserDetailService

package com.demo.service;

import com.demo.dao.UserDao;
import com.demo.entity.User;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import org.springframework.util.ObjectUtils;

@Service
public class MyUserDetailServiceImpl implements UserDetailsService {

    private  final UserDao userDao;

    @Autowired
    public MyUserDetailServiceImpl(UserDao userDao) {
        this.userDao = userDao;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userDao.loadUserByUsername(username);
        if(ObjectUtils.isEmpty(user)) {
            throw new RuntimeException("用户不存在");
        }
        user.setRoles(userDao.getRolesByUid(user.getId()));
        return user;
    }
}

自定义LoginFilter继承UserNamePasswordFilter

package com.demo.filter;

import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.http.MediaType;
import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Map;

public class LoginFilter extends UsernamePasswordAuthenticationFilter {
    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        if (!request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
        }
        if (request.getContentType().equals(MediaType.APPLICATION_JSON_VALUE)) {
            try {
                Map<String, String> userinfo = new ObjectMapper().readValue(request.getInputStream(), Map.class);
                String username = userinfo.get(getUsernameParameter());
                String password = userinfo.get(getPasswordParameter());
                UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
                setDetails(request, authRequest);
                return this.getAuthenticationManager().authenticate(authRequest);
            } catch (IOException e) {
                e.printStackTrace();
            }
        }
        return super.attemptAuthentication(request,response);
    }
}

配置SecurityConfig

    private final MyUserDetailServiceImpl myUserDetailService;

	//构造注入自定义UserDetailService
    @Autowired
    public SecurityConfig(MyUserDetailServiceImpl myUserDetailService) {
        this.myUserDetailService = myUserDetailService;
    }
	//注入AuthenticationManager
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception {
        return configuration.getAuthenticationManager();
    }
	//注入过滤器
    @Bean
    public LoginFilter loginFilter(AuthenticationManager authenticationManager){
        LoginFilter loginFilter = new LoginFilter();
        loginFilter.setPasswordParameter("password");
        loginFilter.setUsernameParameter("username");
        loginFilter.setFilterProcessesUrl("/login");
        loginFilter.setAuthenticationManager(authenticationManager);
        loginFilter.setAuthenticationSuccessHandler(new MyAuthenticationSucccessHandler());
        loginFilter.setAuthenticationFailureHandler(new MyAuthenticationFailureHandler());
        return loginFilter;
    }
	//配置添加自定义认证数据源，替换过滤器
    @Bean
    protected SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests()
                .anyRequest().authenticated()
                .and().formLogin()
                .and().logout().logoutSuccessHandler(new MyLogoutSuccessHandler())
                .and().userDetailsService(myUserDetailService)
                .csrf().disable();
        http.addFilterAt(loginFilter(http.getSharedObject(AuthenticationManager.class)), UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }

密码加密并支持旧密码自动升级

下次用户登录时密码自动升级为Bcrypt加密

自定义UserDetailService新增实现接口UserDetailsPasswordService

@Override
    public UserDetails updatePassword(UserDetails user, String newPassword) {
        Integer result = userDao.updatePassword(user.getUsername(), newPassword);
        if (result == 1) {
            ((User) user).setPassword(newPassword);
        }
        return user;
    }

userDao和userMapper新增对应实现

userDao

Integer updatePassword(@Param("username") String username,@Param("password") String password);

userMapper

<update id="updatePassword">
        update `user` set password=#{password}
        where username=#{username}
    </update>

基于JWT验证的登录

JWT工具类

public class JWTUtils {
    public static String TOKEN_HEADER = "token";

    //过期时间
    private static int EXPIRITION_DAY =7;

    private static String ROLE = "role";

    private static String SIGN = "#N!&SI#^";

    public static String createToken(String username, List<Role> roles){
        ArrayList<String> rolesList = new ArrayList<>();
        for(Role role:roles){
            rolesList.add(role.getName());
        }
        Calendar instance = Calendar.getInstance();
        //过期时间设为7天
        instance.add(Calendar.DATE,EXPIRITION_DAY);
        String token = JWT.create()
                .withArrayClaim("role",rolesList.toArray(new String[0]))
                .withClaim("username",username)
                .withExpiresAt(instance.getTime())
                .sign(Algorithm.HMAC256(SIGN));
        return token;
    }

    public static HashMap<String,Object> decode(String token){
        HashMap<String, Object> map = new HashMap<>();
        DecodedJWT verify;
        try{
            verify = JWT.require(Algorithm.HMAC256(SIGN)).build().verify(token);
        }catch (Exception e){
            e.printStackTrace();
            return map;
        }
        String username = verify.getClaim("username").asString();
        String[] roles = verify.getClaim("role").asArray(String.class);
        map.put("username",username);
        map.put("roles",roles);
        return map;
    }

    public static void setExpiritionDay(int expiritionDay) {
        EXPIRITION_DAY = expiritionDay;
    }

    public static void setRole(String role) {
        JWTUtils.ROLE = role;
    }

    public static void setSign(String sign) {
        JWTUtils.SIGN = sign;
    }
}

JWTAuthenticationFilter登录过滤器

基于之前实现的LoginFilter，在登陆成功处理中获取用户数据，返回Token

登陆成功处理Handler添加

User user = (User) authentication.getPrincipal();
String token = JWTUtils.createToken(user.getUsername(), user.getRoles());
result.put("token",token);

JWTAuthorizationFilter权限校验过滤器

public class JWTAuthorizationFilter extends BasicAuthenticationFilter {
    public JWTAuthorizationFilter(AuthenticationManager authenticationManager) {
        super(authenticationManager);
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
        //从请求头中获取token
        String token = request.getHeader(JWTUtils.TOKEN_HEADER);
        //没有直接跳过过滤器
        if(ObjectUtils.isEmpty(token)){
            chain.doFilter(request,response);
            return;
        }
        //将token中的用户名和权限用户组放入Authentication对象,在之后实现鉴权
        SecurityContextHolder.getContext().setAuthentication(getAuthentication(token));
        super.doFilterInternal(request, response, chain);
    }
    
    //解析token获取用户信息
    private UsernamePasswordAuthenticationToken getAuthentication(String token){
        HashMap<String, Object> tokenInfo = JWTUtils.decode(token);
        if(ObjectUtils.isEmpty(tokenInfo)){
            return null;
        }
        String username = (String) tokenInfo.get("username");
        String[] roles = (String[]) tokenInfo.get("roles");
        ArrayList<SimpleGrantedAuthority> authorities = new ArrayList<>();
        for(String role:roles){
            authorities.add(new SimpleGrantedAuthority(role));
        }
        return new UsernamePasswordAuthenticationToken(username,null,authorities);

    }
}

主类配置认证过滤器bean,添加过滤器

@Bean
    public JWTAuthorizationFilter jwtAuthorizationFilter(AuthenticationManager authenticationManager){
        JWTAuthorizationFilter filter = new JWTAuthorizationFilter(authenticationManager);
        return filter;
    }

http.addFilter(jwtAuthorizationFilter(http.getSharedObject(AuthenticationManager.class)));

设置不开启session

.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

添加验证码

基于Redis

新增字段uuid和kaptcha

验证码和Redis依赖包

<dependency>
  <groupId>com.github.penggle</groupId>
  <artifactId>kaptcha</artifactId>
  <version>2.3.2</version>
</dependency>

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>

<dependency>
    <groupId>org.apache.commons</groupId>
    <artifactId>commons-pool2</artifactId>
</dependency>

Redis配置

spring.redis.host=localhost
spring.redis.port=6379
spring.redis.lettuce.pool.max-active=8
spring.redis.lettuce.pool.max-idle=8
spring.redis.lettuce.pool.min-idle=0
spring.redis.lettuce.pool.max-wait=100

验证码配置类

@Configuration
public class KaptchaConfig {
    @Bean
    public Producer kaptcha() {
        Properties properties = new Properties();
        properties.setProperty("kaptcha.image.width", "150");
        properties.setProperty("kaptcha.image.height", "50");
        properties.setProperty("kaptcha.textproducer.char.string", "0123456789qazwsxedcrfvtgbyhnujmikolpQAZWSXEDCRFVTGBYHNUJMIKOLP");
        properties.setProperty("kaptcha.textproducer.char.length", "4");
        Config config = new Config(properties);
        DefaultKaptcha defaultKaptcha = new DefaultKaptcha();
        defaultKaptcha.setConfig(config);
        return defaultKaptcha;
    }
}

获取验证码控制器

@RestController
public class KaptchaController {

    private final String redisParam = "demo:verifyCode:uuid:";
    private final Producer producer;

    private final StringRedisTemplate stringRedisTemplate;

    @Autowired
    public KaptchaController(Producer producer,StringRedisTemplate stringRedisTemplate) {
        this.producer = producer;
        this.stringRedisTemplate=stringRedisTemplate;
    }

    @RequestMapping("/vc.png")
    public HashMap<String,String> getVerifyCode() throws IOException {
        //1.生成验证码和标识UUID
        String code = producer.createText();
        String uuid = UUID.randomUUID().toString();
        //redis存放验证码，UUID,过期时长五分钟
        stringRedisTemplate.opsForValue().set(redisParam+uuid,code,5L, TimeUnit.MINUTES);
        BufferedImage bi = producer.createImage(code);
        //2.写入内存
        FastByteArrayOutputStream fos = new FastByteArrayOutputStream();
        ImageIO.write(bi, "png", fos);
        System.out.println(code);
        //3.生成 base64,返回数据
        HashMap<String, String> ret = new HashMap<>();
        ret.put("uuid",uuid);
        ret.put("picture",Base64.encodeBase64String(fos.toByteArray()));
        return ret;
    }
}

验证码异常类

public class KaptchaNotMatchException extends AuthenticationException {

    public KaptchaNotMatchException(String msg) {
        super(msg);
    }

    public KaptchaNotMatchException(String msg, Throwable cause) {
        super(msg, cause);
    }
}

在登录验证过滤器实现校验验证码

以下为JWT登录校验的实现

public class JWTAuthenticationFilter extends UsernamePasswordAuthenticationFilter {

    @Autowired
    private StringRedisTemplate stringRedisTemplate;

    private static final String redisParam = "demo:verifyCode:uuid:";

    public static final String FORM_KAPTCHA_KEY = "kaptcha";

    public static final String FORM_UUID_KEY = "uuid";
    private String kaptcha=FORM_KAPTCHA_KEY;

    private String uuid = FORM_UUID_KEY;

    public String getuuidParamter() {
        return uuid;
    }

    public void setKaptchaParamter(String kaptcha) {
        this.kaptcha = kaptcha;
    }

    public void setuuidParamter(String uuid) {
        this.uuid = uuid;
    }

    public String getKaptchaParamter() {
        return kaptcha;
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        if (!"POST".equals(request.getMethod())) {
            throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
        }
        if (request.getContentType().equals(MediaType.APPLICATION_JSON_VALUE)) {
            try {
                Map<String, String> userinfo = new ObjectMapper().readValue(request.getInputStream(), Map.class);
                String username = userinfo.get(getUsernameParameter());
                String password = userinfo.get(getPasswordParameter());
                String kaptcha = userinfo.get(getKaptchaParamter());
                String uuid = userinfo.get(getuuidParamter());
                String kaptchaRedis = stringRedisTemplate.opsForValue().get(redisParam + uuid);
                if(!ObjectUtils.isEmpty(kaptchaRedis)&&!ObjectUtils.isEmpty(kaptcha)&&kaptchaRedis.equals(kaptcha)){
                    UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
                    setDetails(request, authRequest);
                    return this.getAuthenticationManager().authenticate(authRequest);
                }
            } catch (IOException e) {
                e.printStackTrace();
            }
        }
        throw new KaptchaNotMatchException("验证码错误或过期");
    }
}

实现Remember-me

LoginFilter新增rememberme字段

String rememberValue = userInfo.get(AbstractRememberMeServices.DEFAULT_PARAMETER);
                if (!ObjectUtils.isEmpty(rememberValue)) {
                    request.setAttribute(AbstractRememberMeServices.DEFAULT_PARAMETER, rememberValue);
                }

自定义RemembermeService实现类

public class PersistentTokenBasedRememberMeServicesImpl extends PersistentTokenBasedRememberMeServices {
    public PersistentTokenBasedRememberMeServicesImpl(String key, UserDetailsService userDetailsService, PersistentTokenRepository tokenRepository) {
        super(key, userDetailsService, tokenRepository);
    }
    @Override
    protected boolean rememberMeRequested(HttpServletRequest request, String parameter) {
        String paramValue = request.getAttribute(parameter).toString();
        if (paramValue != null) {
            if (paramValue.equalsIgnoreCase("true") || paramValue.equalsIgnoreCase("on")
                    || paramValue.equalsIgnoreCase("yes") || paramValue.equals("1")) {
                return true;
            }
        }
        return false;
    }
}

配置SecurityConfig

	//持久化到数据库	
	@Autowired
    private DataSource dataSource;
    @Bean
    public PersistentTokenRepository persistentTokenRepository(){
        JdbcTokenRepositoryImpl jdbcTokenRepository = new JdbcTokenRepositoryImpl();
        jdbcTokenRepository.setCreateTableOnStartup(false);
        //只需要没有表时设置为 true
        jdbcTokenRepository.setDataSource(dataSource);
        return jdbcTokenRepository;
    }
	//设置默认的remembermeService
	@Bean
    public RememberMeServices rememberMeServices() {
        return new PersistentTokenBasedRememberMeServicesImpl(UUID.randomUUID().toString(), myUserDetailService, persistentTokenRepository());
    }

http配置添加

.rememberMe().rememberMeServices(rememberMeServices())

LoginFilter配置添加

loginFilter.setRememberMeServices(rememberMeServices());

Remember-me数据库表也可以手动创建

create table persistent_logins (username varchar(64) not null, series varchar(64) primary key, token varchar(64) not null, last_used timestamp not null)

开启会话管理

基于JWT进行登录鉴权不需要

会话过期处理

public class MyInvalidSessionStrategy implements InvalidSessionStrategy {
    @Override
    public void onInvalidSessionDetected(HttpServletRequest request, HttpServletResponse response) throws IOException {
        response.setContentType("application/json;charset=UTF-8");
        Map<String, Object> result = new HashMap<>();
        result.put("status", HttpStatus.UNAUTHORIZED.value());
        result.put("msg", "当前会话已经过期,请重新登录");
        String s = new ObjectMapper().writeValueAsString(result);
        response.getWriter().println(s);
    }
}

http配置添加

.and().sessionManagement().invalidSessionStrategy(new MyInvalidSessionStrategy())

配置类注入

@Bean
    public HttpSessionEventPublisher httpSessionEventPublisher() {
        return new HttpSessionEventPublisher();
    }

会话并发管理由于自定义过滤器和session不一致问题暂无解决

跨域配置

配置类配置跨域

CorsConfigurationSource configurationSource() {
        CorsConfiguration corsConfiguration = new CorsConfiguration();
        corsConfiguration.setAllowedHeaders(Arrays.asList("*"));
        corsConfiguration.setAllowedMethods(Arrays.asList("*"));
        corsConfiguration.setAllowedOrigins(Arrays.asList("*"));
        corsConfiguration.setMaxAge(3600L);
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", corsConfiguration);
        return source;
    }

http开启跨域

.cors().configurationSource(configurationSource());

自定义异常处理

http配置添加**.exceptionHandling()**,在之后进行配置

未登录处理

配置**.authenticationEntryPoint()**

实现类:

public class MyAuthenticationEntryPoint implements AuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
        response.setStatus(HttpStatus.UNAUTHORIZED.value());
        response.setContentType("application/json;charset=UTF-8");
        Map<String, Object> result = new HashMap<>();
        result.put("msg", "未登录");
        result.put("status", 401);
        String s = new ObjectMapper().writeValueAsString(result);
        response.getWriter().println(s);
    }
}

权限异常处理

配置**.accessDeniedHandler()**

实现类:

public class MyAccessDeniedHandler implements AccessDeniedHandler {
    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException{
        response.setStatus(HttpStatus.FORBIDDEN.value());
        response.setContentType("application/json;charset=UTF-8");
        Map<String, Object> result = new HashMap<>();
        result.put("msg", "权限不足 ");
        result.put("status", 403);
        String s = new ObjectMapper().writeValueAsString(result);
        response.getWriter().println(s);
    }
}

授权

基于URL

在http配置中的**authorizeHttpRequests()**后配置

.antMatchers("/*").hasRole("ADMIN")

权限表达式

方法	说明
hasAuthority(String authority)	当前用户是否具备指定权限
hasAnyAuthority(String… authorities)	当前用户是否具备指定权限中任意一个
hasRole(String role)	当前用户是否具备指定角色
hasAnyRole(String… roles);	当前用户是否具备指定角色中任意一个
permitAll();	放行所有请求/调用
denyAll();	拒绝所有请求/调用
isAnonymous();	当前用户是否是一个匿名用户
isAuthenticated();	当前用户是否已经认证成功
isRememberMe();	当前用户是否通过 Remember-Me 自动登录
isFullyAuthenticated();	当前用户是否既不是匿名用户又不是通过 Remember-Me 自动登录的
hasPermission(Object targetId, Object permission);	当前用户是否具备指定目标的指定权限信息
hasPermission(Object targetId, String targetType, Object permission);	当前用户是否具备指定目标的指定权限信息

基于方法

配置类注解**@EnableGlobalMethodSecurity(prePostEnabled=true,securedEnabled=true, jsr250Enabled=true)**

perPostEnabled: 开启 Spring Security 提供的四个权限注解，@PostAuthorize、@PostFilter、@PreAuthorize 以及@PreFilter。
securedEnabled: 开启 Spring Security 提供的 @Secured 注解支持，该注解不支持权限表达式
jsr250Enabled: 开启 JSR-250 提供的注解，主要是@DenyAll、@PermitAll、@RolesAll 同样这些注解也不支持权限表达式

以上注解含义如下

@PostAuthorize：在目前标方法执行之后进行权限校验。
@PostFiter：在目标方法执行之后对方法的返回结果进行过滤。
@PreAuthorize：在目标方法执行之前进行权限校验。
@PreFiter：在目前标方法执行之前对方法参数进行过滤。
@Secured：访问目标方法必须具各相应的角色。
@DenyAll：拒绝所有访问。
@PermitAll：允许所有访问。
@RolesAllowed：访问目标方法必须具备相应的角色。

在对应Controller方法或类上添加注解,如果数据库里存的权限是ROLE_admin，则基于url只需要admin，基于方法需要写全ROLE_admin

	@Secured("ROLE_admin")
    @RequestMapping("/t")
    public String t(HttpServletRequest request){
        return "111";
    }

其他用法

@PreAuthorize("hasRole('ADMIN') and authentication.name=='root'")
@PreAuthorize("authentication.name==#name")
@PreFilter(value = "filterObject.id%2!=0",filterTarget = "users")
@PostAuthorize("returnObject.id==1")
@PostFilter("filterObject.id%2==0")
@Secured({"ROLE_ADMIN","ROLE_USER"}) //具有其中一个即可
@RolesAllowed({"ROLE_ADMIN","ROLE_USER"}) //具有其中一个角色即可

OAuth2第三方登录

在对应开发者平台申请appid，appsecret

SpringSecurity通过OAuth2AuthorizationRequestRedirectFilter做第三方认证重定向，数据用Session保存，之后在OAuth2LoginAuthenticationFilter拦截用户同意登录后回调的地址，获取用户信息。

由于token验证是无状态式的，关闭了session，所以需要对oauth2登录完以后再生成我们的token用以鉴定是否登录，此处重写登录成功Handler

前端请求/oauth2/authorization/gitee，后端自动为用户重定向到gitee认证，用户认证后重定向请求后端/login/oauth2/code/gitee，获取code，后端再去第三方授权服务器拿token，再用token去拿info

从gitee获取的用户信息样例

{gists_url=https://gitee.com/api/v5/users/Loli_Wolf/gists{/gist_id}, repos_url=https://gitee.com/api/v5/users/Loli_Wolf/repos, following_url=https://gitee.com/api/v5/users/Loli_Wolf/following_url{/other_user}, bio=null, created_at=2022-11-13T12:41:11+08:00, remark=, login=Loli_Wolf, type=User, blog=https://github.com/LoliWolf, subscriptions_url=https://gitee.com/api/v5/users/Loli_Wolf/subscriptions, weibo=null, updated_at=2022-12-06T20:00:45+08:00, id=11995789, public_repos=0, email=null, organizations_url=https://gitee.com/api/v5/users/Loli_Wolf/orgs, starred_url=https://gitee.com/api/v5/users/Loli_Wolf/starred{/owner}{/repo}, followers_url=https://gitee.com/api/v5/users/Loli_Wolf/followers, public_gists=0, url=https://gitee.com/api/v5/users/Loli_Wolf, received_events_url=https://gitee.com/api/v5/users/Loli_Wolf/received_events, watched=0, followers=0, avatar_url=https://gitee.com/assets/no_portrait.png, events_url=https://gitee.com/api/v5/users/Loli_Wolf/events{/privacy}, html_url=https://gitee.com/Loli_Wolf, following=0, name=Loli_Wolf, stared=1}

oauth2配置样例

spring.security.oauth2.client.registration.gitee.client-id=
spring.security.oauth2.client.registration.gitee.client-secret= 
spring.security.oauth2.client.registration.gitee.redirect-uri=http://localhost:8080/login/oauth2/code/gitee
spring.security.oauth2.client.registration.gitee.authorization-grant-type=authorization_code
spring.security.oauth2.client.registration.gitee.client-authentication-method=POST
spring.security.oauth2.client.registration.gitee.client-name=gitee
spring.security.oauth2.client.registration.gitee.provider=gitee

spring.security.oauth2.client.provider.gitee.authorization-uri=https://gitee.com/oauth/authorize
spring.security.oauth2.client.provider.gitee.user-info-authentication-method=GET
spring.security.oauth2.client.provider.gitee.token-uri=https://gitee.com/oauth/token
spring.security.oauth2.client.provider.gitee.user-info-uri=https://gitee.com/api/v5/user
spring.security.oauth2.client.provider.gitee.user-name-attribute=name

HttpSecurity配置里开启oauth2

.and().oauth2Login().successHandler(new OAuth2AuthenticationSuccessHandler(userDetailService)).failureHandler(new MyAuthenticationFailureHandler())

UserDetailService新增Oauth2用户处理

如果没有用户就创建，否则返回绑定用户

public User loadUserByGiteeID(String id, String name){
        User user = userDao.loadUserByGiteeID(id);
        //新用户
        if (ObjectUtils.isEmpty(user)){
            try {
                String username = name + UUID.randomUUID();
                userDao.createUserByUsername(username);
                userDao.addUserGiteeInfoByUsername(username,id,name);
                userDao.addUserRoleByUsername(username,"ROLE_user");
                user = userDao.loadUserByGiteeID(id);
            }catch (Exception e){
                e.printStackTrace();
            }
        }
        user.setRoles(userDao.getRolesByUid(user.getId()));
        return user;
    }

新增登陆成功控制器

public class OAuth2AuthenticationSuccessHandler implements AuthenticationSuccessHandler {

    private final MyUserDetailServiceImpl userDetailsService;

    public OAuth2AuthenticationSuccessHandler(MyUserDetailServiceImpl myUserDetailService) {
        this.userDetailsService = myUserDetailService;
    }

    //拿着第三方登录的用户去找user，找到就返回user生成的token，没找到就创建新user,设置user角色

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        Map<String, Object> result = new HashMap<>();
        result.put("msg", "登录成功");
        result.put("status", 200);
        DefaultOAuth2User oAuth2User = (DefaultOAuth2User) authentication.getPrincipal();
        User user = userDetailsService.loadUserByGiteeID(oAuth2User.getAttributes().get("id").toString(),oAuth2User.getAttributes().get("login").toString());
        String token = JWTUtils.createToken(user.getUsername(), user.getRoles());
        result.put("token",token);
        response.setContentType("application/json;charset=UTF-8");
        String s = new ObjectMapper().writeValueAsString(result);
        response.getWriter().println(s);
    }
}

UserMapper,UserDao新增sql

<insert id="createUserByUsername">
        insert into user(username, enabled, accountNonExpired, accountNonLocked, credentialsNonExpired) value (#{username},1,1,1,1);
    </insert>
    <insert id="addUserGiteeInfoByUsername">
        insert into user_gitee value ((select id from user where username = #{username}),#{giteeID},#{giteeName});
    </insert>
    <insert id="addUserRoleByUsername">
        insert into user_role(uid,rid) value ((select id from user where username=#{username}),(select id from role where name = #{role}));
    </insert>
    <select id="loadUserByGiteeID" resultType="com.demo.security.entity.User">
        select user.* from user,user_gitee ug where #{giteeID} = ug.gitee_id and ug.uid = user.id;
    </select>

//根据giteeid查用户
    User loadUserByGiteeID(@Param("giteeID") String giteeID);
    
    //根据用户名创建新用户
    Integer createUserByUsername(@Param("username") String username);

    //绑定用户和gitee信息
    Integer addUserGiteeInfoByUsername(@Param("username") String username,@Param("giteeID") String giteeID,@Param("giteeName") String giteeName);

    //按用户名添加角色
    Integer addUserRoleByUsername(@Param("username") String username,@Param("role") String role);