好的，下面是
SpringCloud Gateway 集成
SpringSecurity 的代码示例：
### 1.添加依赖
在pom.xml文件中添加以下依赖：
```xml
<dependencies>
<!--
Spring Cloud Gateway -->
<dependency>
<groupId>org.
springframework.cloud</groupId>
<artifactId>
spring-cloud-starter-gateway</artifactId>
</dependency>
<!--
Spring Security -->
<dependency>
<groupId>org.
springframework.boot</groupId>
<artifactId>
spring-boot-starter-security</artifactId>
</dependency>
</dependencies>
```
### 2.配置
Spring Security
在WebSecurityConfigurerAdapter中配置
Spring Security，如下所示：
```java
@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {
@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
http.authorizeExchange()
.pathMatchers("/auth/**").permitAll()
.pathMatchers(HttpMethod.OPTIONS).permitAll()
.anyExchange().authenticated()
.and()
.httpBasic().and()
.formLogin();
return http.build();
}
@Bean
public PasswordEncoder passwordEncoder() {
return PasswordEncoderFactories.createDelegatingPasswordEncoder();
}
}
```
上述代码中，我们配置了一个SecurityWebFilterChain，用于授权和认证请求。 其中，我们允许/auth/**下的所有请求不需要认证，OPTIONS请求也不需要认证。其他请求都需要进行认证。
### 3.配置Gateway
在Gateway中配置
Spring Security，如下所示：
```java
@Configuration
public class GatewayConfig {
@Autowired
private AuthenticationManager authenticationManager;
@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
http.authorizeExchange()
.pathMatchers("/auth/**").permitAll()
.pathMatchers(HttpMethod.OPTIONS).permitAll()
.anyExchange().authenticated()
.and()
.httpBasic().and()
.formLogin();
return http.build();
}
@Bean
public ReactiveAuthenticationManager reactiveAuthenticationManager() {
UserDetailsRepositoryReactiveAuthenticationManager authenticationManager =
new UserDetailsRepositoryReactiveAuthenticationManager(userDetailsService());
authenticationManager.setPasswordEncoder(passwordEncoder());
return authenticationManager;
}
@Bean
public ReactiveUserDetailsService userDetailsService() {
return new MapReactiveUserDetailsService(
User.withUsername("user")
.password(passwordEncoder().encode("password"))
.roles("USER")
.build()
);
}
@Bean
public PasswordEncoder passwordEncoder() {
return PasswordEncoderFactories.createDelegatingPasswordEncoder();
}
@Bean
public SecurityContextRepository securityContextRepository() {
return new WebSessionServerSecurityContextRepository();
}
@Bean
public
ServerAuthenticationSuccessHandler serverAuthenticationSuccessHandler() {
return new Redirect
ServerAuthenticationSuccessHandler("/index");
}
@Bean
public ServerAuthenticationFailureHandler serverAuthenticationFailureHandler() {
return new RedirectServerAuthenticationFailureHandler("/login
?error");
}
@Bean
public ServerLogoutSuccessHandler serverLogoutSuccessHandler() {
return new RedirectServerLogoutSuccessHandler("/login");
}
@Bean
public ServerSecurityContextRepository serverSecurityContextRepository() {
return new WebSessionServerSecurityContextRepository();
}
@Bean
public SecurityWebFilterChain
springSecurityFilterChain(ServerHttpSecurity http) {
http
.csrf().disable()
.httpBasic().disable()
.formLogin().disable()
.logout().disable()
.authenticationManager(authenticationManager)
.securityContextRepository(securityContextRepository())
.authorizeExchange()
.pathMatchers("/auth/**").permitAll()
.anyExchange().authenticated()
.and().exceptionHandling()
.authenticationEntryPoint(new HttpStatusServerEntryPoint(HttpStatus.UNAUTHORIZED))
.accessDeniedHandler(new HttpStatusServerAccessDeniedHandler(HttpStatus.FORBIDDEN))
.and().addFilterAt(new AuthenticationWebFilter(reactiveAuthenticationManager()), SecurityWebFiltersOrder.AUTHENTICATION)
.addFilterAt(new SecurityContextServerWebExchangeConfigurer(serverSecurityContextRepository()), SecurityWebFiltersOrder.SECURITY_CONTEXT)
.addFilterAt(new LogoutWebFilter(serverLogoutSuccessHandler()), SecurityWebFiltersOrder.LOGOUT)
.addFilterAt(new GatewayAuthFilter(), SecurityWebFiltersOrder.AUTHENTICATION)
.addFilterAt(new GatewayRateLimitFilter(), SecurityWebFiltersOrder.AUTHENTICATION);
return http.build();
}
}
```
上述代码中，我们配置了一个GatewayAuthFilter，用于验证请求的token是否有效，以及一个GatewayRateLimitFilter，用于限流。
### 4.编写GatewayAuthFilter
在GatewayAuthFilter中编写登录鉴权逻辑，如下所示：
```java
@Component
public class GatewayAuthFilter extends OncePerRequestFilter {
private static final String JWT_SECRET = "secret";
private static final long JWT_EXPIRE_TIME = 3600 * 1000; // 1 hour
@Override
protected void doFilterInternal(ServerHttpRequest request, ServerHttpResponse response, FilterChain filterChain) throws ServletException, IOException {
String token = request.getHeaders().getFirst("Authorization");
if (StringUtils.isNotEmpty(token) && token.startsWith("Bearer ")) {
token = token.substring(7);
try {
Jws<Claims> jwt = Jwts.parser().setSigningKey(JWT_SECRET).parseClaimsJws(token);
Claims claims = jwt.getBody();
String username = claims.getSubject();
if (StringUtils.isNotEmpty(username)) {
List<String> authorities = (List<String>) claims.get("authorities");
UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(username, null, authorities.stream().map(SimpleGrantedAuthority::new).collect(Collectors.toList()));
SecurityContextHolder.getContext().setAuthentication(authenticationToken);
}
} catch (Exception e) {
// ignore
}
}
filterChain.doFilter(request, response);
}
public static String generateToken(String username, List<String> authorities) {
long now = System.currentTimeMillis();
return Jwts.builder()
.setSubject(username)
.claim("authorities", authorities)
.setIssuedAt(new Date(now))
.setExpiration(new Date(now + JWT_EXPIRE_TIME))
.signWith(SignatureAlgorithm.HS512, JWT_SECRET)
.compact();
}
}
```
上述代码中，我们编写了一个GatewayAuthFilter，用于验证请求的token是否有效。如果token有效，则设置用户的权限信息，并将用户信息保存在SecurityContextHolder中。
### 5.编写GatewayRateLimitFilter
在GatewayRateLimitFilter中编写限流逻辑，如下所示：
```java
@Component
public class GatewayRateLimitFilter extends AbstractGatewayFilterFactory<GatewayRateLimitFilter.Config> {
private final RateLimiter rateLimiter;
public GatewayRateLimitFilter(RateLimiter rateLimiter) {
super(Config.class);
this.rateLimiter = rateLimiter;
}
@Override
public GatewayFilter apply(Config config) {
return (exchange, chain) -> {
if (!rateLimiter.tryAcquire()) {
exchange.getResponse().setStatusCode(HttpStatus.TOO_MANY_REQUESTS);
return exchange.getResponse().setComplete();
}
return chain.filter(exchange);
};
}
public static class Config {
}
}
```
上述代码中，我们编写了一个GatewayRateLimitFilter，用于限流。我们使用了Google的Guava库中的RateLimiter进行限流。
### 6.测试
现在，我们已经完成了
SpringCloud Gateway 集成
SpringSecurity 的代码编写。我们可以启动应用程序并进行测试。首先，我们需要生成一个token，然后将其添加到Authorization头中，如下所示：
```bash
curl -X POST -d "username=user&password=password" http://localhost:8080/auth/login
# {"token":"eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJ1c2VyIiwidXNlcl9uYW1lIjoidXNlciIsImF1dGhvcml0aWVzIjpbIlVTRVIiXSwiaWF0IjoxNjIzMjU4NTM5LCJleHAiOjE2MjMyNjI5MzksImp0aSI6ImM2YjMxYjU2LWY5ZjktNDIwOS04ZjU1LWYyY2E3ZjkwMWYxYyJ9.C9y2vBZ5qM0C2xL8lG24Lj5r5y-1o6wHqxJlC6BhYt8L4jZr2WJWvZb5vz7VQZbC7H7t0l2SJRn9y5kYJ4IBw"}
```
然后，我们可以测试请求，如下所示：
```bash
curl -H "Authorization: Bearer eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJ1c2VyIiwidXNlcl9uYW1lIjoidXNlciIsImF1dGhvcml0aWVzIjpbIlVTRVIiXSwiaWF0IjoxNjIzMjU4NTM5LCJleHAiOjE2MjMyNjI5MzksImp0aSI6ImM2YjMxYjU2LWY5ZjktNDIwOS04ZjU1LWYyY2E3ZjkwMWYxYyJ9.C9y2vBZ5qM0C2xL8lG24Lj5r5y-1o6wHqxJlC6BhYt8L4jZr2WJWvZb5vz7VQZbC7H7t0l2SJRn9y5kYJ4IBw" http://localhost:8080/hello
```
如果请求成功，则可以看到返回的结果。如果请求失败，则可以看到错误信息。
SpringSecurityWebFlux中的onAuthenticationSuccess方法及其作用
文章讲述了SpringSecurity在WebFlux环境下，onAuthenticationSuccess方法如何在用户认证成功后处理定制逻辑，包括使用Oauth2AuthSuccessHandler添加HTTP头，以及在过滤器链中的作用。
扫一扫
1353
到【灌水乐园】发言
