spring security 原理自定义用户验证逻辑passwordEncoder验证

过滤器链 流程 filtersecurityInterceptor

UserDetails自定义验证流程

自定义插件

package com.imoke.web.Config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
@Configuration
public class brwoserConfig extends WebSecurityConfigurerAdapter {

    @Bean
    public PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.formLogin()

/* http.httpBasic()*/

                .and()
                .csrf().disable()//关闭csrf
                .authorizeRequests()
                //授权认证
                .anyRequest()//任何请求
                .authenticated();//都需要安全认证
    }
}

具体逻辑处理继承UserDetailsService，

package com.imoke.web.service;

import com.imoke.web.bean.Authorities;
import com.imoke.web.bean.User;
import com.imoke.web.dao.UserDao;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.security.SecurityProperties;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Component;

import javax.websocket.Session;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;

/**
 * @author liwenjie
 * @date 2019-06-20 10:27
 * @mail wenjieli@newbanker.cn
 */
@Component
@Slf4j
public class MyUserDetailsService implements UserDetailsService {
    @Autowired
    private UserDao userDao;
    @Autowired
    private PasswordEncoder passwordEncoder;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        log.info("username is " + username);

        User user = userDao.findUserByUserName(username);
        System.out.println(" user priessmisss is " + user.getPermissions());
        System.out.println(user.getUsername() + user.getPassword());
        /* return new User(username,user.getPassword(), AuthorityUtils.commaSeparatedStringToAuthorityList(user.getPermissions())*//*AuthorityUtils.commaSeparatedStringToAuthorityList("admin")*//*);*/
        /*return user*/
        ;
        System.out.println("passis"+passwordEncoder.encode("$2a$10$G/6AQQFLn9E5ewscUBFbf.ke06LoASYIBJUjo7wu6fnYfZeaofILW"));
        System.out.println(passwordEncoder.matches("123",user.getPassword()));
        return new
                org.springframework.security.core.userdetails.
                        User(username
                , passwordEncoder.encode(user.getPassword())
                , AuthorityUtils.commaSeparatedStringToAuthorityList(user.getPermissions()));
    }


}