java前后端分离权限_Spring Security实现前后端分离登录与权限控制

通过Security实现前后端分离的登录与权限控制

一、引入Security配置文件

org.springframework.boot

spring-boot-starter-security

二、新建SecurityConfiguration配置类

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.context.annotation.Configuration;

import org.springframework.http.HttpMethod;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.builders.WebSecurity;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.crypto.password.PasswordEncoder;

import org.springframework.security.web.AuthenticationEntryPoint;

import org.springframework.security.web.access.AccessDeniedHandler;

import org.springframework.security.web.authentication.AuthenticationFailureHandler;

import org.springframework.security.web.authentication.AuthenticationSuccessHandler;

import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;

import javax.annotation.Resource;

@Configuration

@EnableWebSecurity

public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

@Resource(name = "UserDetailsServiceImpl")

private UserDetailsService userDetailsService;

@Resource

private PasswordEncoder passwordEncoder;

@Autowired

private AuthenticationSuccessHandler loginSuccessHandler;

@Autowired

private AuthenticationFailureHandler loginFailureHandler;

@Autowired

private AuthenticationEntryPoint authenticationEntryPoint;

@Autowired

private AccessDeniedHandler accessDeniedHandler;

@Autowired

private LogoutSuccessHandler logoutSuccessHandler;

@Override

protected void configure(HttpSecurity httpSecurity) throws Exception {

httpSecurity

.authorizeRequests()

//认证规则

.anyRequest().access("@rbacService.hasPermission(request,authentication)")

.and()

//开启表单登录

.formLogin().loginPage("/login").permitAll()

//登录失败处理

.failureHandler(loginFailureHandler)

//登录成功处理

.successHandler(loginSuccessHandler)

.and()

//没有权限处理

.exceptionHandling().accessDeniedHandler(accessDeniedHandler)

.and()

//未登录处理

.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint)

.and()

//退出成功处理

.logout().logoutSuccessHandler(logoutSuccessHandler).permitAll();

//开启跨域访问

httpSecurity.cors().disable();

//开启模拟请求，比如API POST测试工具的测试，不开启时，API POST为报403错误

httpSecurity.csrf().disable();

}

@Override

public void configure(WebSecurity web) {

//对于在header里面增加token等类似情况，放行所有OPTIONS请求。

web.ignoring().antMatchers(HttpMethod.OPTIONS, "/**");

// web.ignoring().antMatchers("/index.html", "/static/**", "/login_p", "/favicon.ico")

// // 给 swagger 放行；不需要权限能访问的资源

// .antMatchers("/swagger-ui.html", "/swagger-resources/**", "/images/**", "/webjars/**", "/v2/api-docs", "/configuration/ui", "/configuration/security");

}

@Override

protected void configure(AuthenticationManagerBuilder auth) throws Exception {

auth.userDetailsService(userDetailsService)

.passwordEncoder(passwordEncoder);

}

三、实现未登录、登录成功、登录失败、没有权限、退出登录成功时的接口

1、未登录

@Component

public class AuthenticationEntryPointImpl implements AuthenticationEntryPoint {

@Autowired

private ObjectMapper objectMapper;

@Override

public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {

httpServletResponse.setContentType("application/json;charset=utf-8");

PrintWriter out = httpServletResponse.getWriter();

//ResponserJSON为自定义的用于返回JSON的类

out.write(objectMapper.writeValueAsString(new ResponseJSON().setUnLoginError()));

out.flush();

out.close();

}

}

2、登录成功

@Component

public class LoginSuccessHandlerImpl implements AuthenticationSuccessHandler {

@Autowired

private ObjectMapper objectMapper;

@Override

public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {

httpServletResponse.setContentType("application/json;charset=utf-8");

PrintWriter out = httpServletResponse.getWriter();

//ResponserJSON为自定义的用于返回JSON的类

out.write(objectMapper.writeValueAsString(new ResponseJSON().setSuccess("登录成功")));

out.flush();

out.close();

}

}

3、登录失败

@Component

public class LogoutSuccessHandlerImpl implements LogoutSuccessHandler {

@Autowired

private ObjectMapper objectMapper;

@Override

public void onLogoutSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {

httpServletResponse.setContentType("application/json;charset=utf-8");

PrintWriter out = httpServletResponse.getWriter();

//ResponserJSON为自定义的用于返回JSON的类

out.write(objectMapper.writeValueAsString(new ResponseJSON().setSuccess("注销成功")));

out.flush();

out.close();

}

}

4、没有权限

@Component

public class AccessDeniedHandlerImpl implements AccessDeniedHandler {

@Autowired

private ObjectMapper objectMapper;

@Override

public void handle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AccessDeniedException e) throws IOException, ServletException {

httpServletResponse.setContentType("application/json;charset=utf-8");

PrintWriter out = httpServletResponse.getWriter();

//ResponserJSON为自定义的用于返回JSON的类

out.write(objectMapper.writeValueAsString(new ResponseJSON().setError("没有权限")));

out.flush();

out.close();

}

}

5、退出登录成功

@Component

public class LogoutSuccessHandlerImpl implements LogoutSuccessHandler {

@Autowired

private ObjectMapper objectMapper;

@Override

public void onLogoutSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {

httpServletResponse.setContentType("application/json;charset=utf-8");

PrintWriter out = httpServletResponse.getWriter();

//ResponserJSON为自定义的用于返回JSON的类

out.write(objectMapper.writeValueAsString(new ResponseJSON().setSuccess("注销成功")));

out.flush();

out.close();

}

}

四、实现UserDetail接口

import lombok.Data;

import org.springframework.security.core.GrantedAuthority;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.stereotype.Component;

import java.util.Collection;

@Component

@Data

//@Data为lombok的注解

public class User implements UserDetails {

//用户名

private String username;

//密码

private String password;

//非必须，根据需求可以定义更多的字段

private String phone;

private Collection extends GrantedAuthority> authorities;

public void setUsername(String username) {

this.username = username;

}

public void setPassword(String password) {

this.password = password;

}

public void setAuthorities(Collection extends GrantedAuthority> authorities) {

this.authorities = authorities;

}

@Override

public Collection extends GrantedAuthority> getAuthorities() {

return this.authorities;

}

@Override

public String getPassword() {

return this.password;

}

@Override

public String getUsername() {

return this.username;

}

@Override

public boolean isAccountNonExpired() {

return true;

}

@Override

public boolean isAccountNonLocked() {

return true;

}

@Override

public boolean isCredentialsNonExpired() {

return true;

}

@Override

public boolean isEnabled() {

return true;

}

}

五、实现UserDetailService接口

@Component("UserDetailsServiceImpl")

public class UserDetailsServiceImpl implements UserDetailsService {

//获取数据库中的user相关数据，自行设计

@Resource

private UserMapper userMapper;

@Override

public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

String password = userMapper.getPassword(username);

if (StringUtils.isBlank(password)){

throw new UsernameNotFoundException("账号不存在！");

}

User myUserDetail = new User();

myUserDetail.setUsername(username);

myUserDetail.setPassword(password);

return myUserDetail;

}

}

此类的作用是获取传入的username对应的密码，可以根据实际情况进行修改，账号不存在时可抛出UsernameNotFoundException异常

实现PasswordEncode接口

@Component

public class PasswordEncoderImpl implements PasswordEncoder {

@Override

public String encode(CharSequence charSequence) {

return charSequence.toString();

}

@Override

public boolean matches(CharSequence charSequence, String s) {

return encode(charSequence).equals(s);

}

}

此类主要用于对密码的加密以及与数据库中的密码进行比对，如果想要偷懒，也可以使用官方的NoOpPasswordEncoder(不推荐)类或BCryptPasswordEncoder类 ，使用方法为将SecurityConfiguration中的authenticationProvider方法的

authenticationProvider.setPasswordEncoder(passwordEncoder);

改为

authenticationProvider.setPasswordEncoder(NoOpPasswordEncoder.getInstance());

Spring5后强制要求密码不能明文传输，NoOpPasswordEncoder(不推荐)类为不加密的实现类，不安全，不推荐使用，可以使用Spring Security 中提供了BCryptPasswordEncoder密码编码工具

六、权限控制

通过编写自定义的service对权限进行控制

public interface RbacService {

boolean hasPermission(HttpServletRequest request, Authentication authentication);

}

@Component("rbacService")

public class RbacServiceImpl implements RbacService {

private AntPathMatcher antPathMatcher = new AntPathMatcher();

@Resource

private UserMapper userMapper;

@Override

public boolean hasPermission(HttpServletRequest request, Authentication authentication) {

Object principal = authentication.getPrincipal();

boolean hasPermission = false;

if (principal instanceof UserDetails) { //首先判断先当前用户是否是我们UserDetails对象。

String userName = ((UserDetails) principal).getUsername();

//连接数据库获取用户有权限的url,根据业务自行修改

List urls = userMapper.getMenuByUserName(userName);

// 注意这里不能用equal来判断，因为有些URL是有参数的，所以要用AntPathMatcher来比较

for (String url : urls) {

if (antPathMatcher.match(url, request.getRequestURI())) {

hasPermission = true;

break;

}

}

}

return hasPermission;

}

}

编写完后通过在SecurityConfiguation中添加如下代码实现权限控制

.anyRequest().access("@rbacService.hasPermission(request,authentication)")