SpringSecurity事件监听

---

前言

• 内容搜集于网上多篇优秀文章，结合自己理解，写下该文，如https://blog.csdn.net/arjun_yu/article/details/110916988

事件监听

• Spring Security设计了多种的扩展点，我们可以使用事件监听器来监听一些事件，从而做一些操作，如 日志记录、密码输入错误次数限制等
• 在org.springframework.security.authentication.event包下定义了发生认证时的所有事件类型，其中AbstractAuthenticationEvent是所有事件的父类，其它事件都继承于AbstractAuthenticationEvent，其子类有
  • AbstractAuthenticationFailureEvent
  • AuthenticationFailureBadCredentialsEvent //认证失败事件
  • AuthenticationFailureCredentialsExpiredEvent
  • AuthenticationFailureDisabledEvent
  • AuthenticationFailureExpiredEvent
  • AuthenticationFailureLockedEvent
  • AuthenticationFailureProviderNotFoundEvent
  • AuthenticationFailureProxyUntrustedEvent
  • AuthenticationFailureServiceExceptionEvent
  • AuthenticationSuccessEvent //认证成功事件
  • InteractiveAuthenticationSuccessEvent //认证成功事件,通过自动交互的手段来登录成功，比如cookie自动登录

@EventListener注解方式

• 该方式需在自定义方法上添加注解即可，方法的参数是事件，无返回值

/**
 * security事件监听
 *
 * @author kimi
 * @date 2022/10/1
 */
@Component
public class SpringSecurityListener{

    private final Logger log= LoggerFactory.getLogger(this.getClass());

    /**
     * 认证成功
     * @param authenticationSuccessEvent
     */
    @EventListener
    public void successListener(AuthenticationSuccessEvent authenticationSuccessEvent){
        //获取认证信息,即authenticationManager.authenticate()返回的Authentication
        Authentication authentication=authenticationSuccessEvent.getAuthentication();
 		//逻辑代码
    }

    /**
     * 认证失败
     * @param authenticationFailureBadCredentialsEvent
     */
    @EventListener
    public void failListener(AuthenticationFailureBadCredentialsEvent authenticationFailureBadCredentialsEvent){
        //获取认证信息,即authenticationManager.authenticate()返回的Authentication
        Authentication authentication=authenticationFailureBadCredentialsEvent.getAuthentication();

        //获取认证失败异常,认证失败的用户名不存在/密码错误BadCredentialsException
        AuthenticationException authenticationException=authenticationFailureBadCredentialsEvent.getException();
        log.info("login fail exception: {}",authenticationException.toString());

        //获取认证用户信息,认证失败无论用户名不存在/密码错误都返回输入的用户名(String)
        String principal=authentication.getPrincipal().toString();
        log.info("login fail principal: {}",principal);
    }
}

实现ApplicationListener接口

• 实现ApplicationListener泛型接口是Spring之前比较常用的监听事件的方式，在实现ApplicationListener接口时需要将监听事件作为接口的泛型传递，重写onApplicationEvent方法

@Component
public class AuthenticationSuccessListener implements ApplicationListener<AuthenticationSuccessEvent> {

    @Override
    public void onApplicationEvent(AuthenticationSuccessEvent authenticationSuccessEvent) {
    }
}