Spring Security实现多种登录方式

1.Security 先容

• 官网链接：https://docs.spring.io/spring-security/reference/5.7.6/servlet/architecture.html
  

依靠导入

1.    <parent>
2.         <groupId>org.springframework.boot</groupId>
3.         <artifactId>spring-boot-starter-parent</artifactId>
4.         <version>2.7.8</version>
5.         <relativePath/> <!-- lookup parent from repository -->
6.     </parent>
7. <dependencys>
8.      <dependency>
9.             <groupId>org.springframework.boot</groupId>
10.             <artifactId>spring-boot-starter-security</artifactId>
11.         </dependency>
12. </dependencys>

复制代码

2.Security 自界说拦截器实现多种登录方式

1. 账户暗码登录

1. 1.自定义MyUsernamePasswordFilter

复制代码

1. /**
2. * 2023/2/26
3. *
4. * @author cyh
5. * 10:30
6. */
7. @Slf4j
8. public class MyUsernamePasswordFilter extends AbstractAuthenticationProcessingFilter {
9.     public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";
10.     public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";
11.     // 自定拦截路由
12.     private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER = new AntPathRequestMatcher("/user/login", "POST");
13.     private String usernameParameter = SPRING_SECURITY_FORM_USERNAME_KEY;
14.     private String passwordParameter = SPRING_SECURITY_FORM_PASSWORD_KEY;
15.     private boolean postOnly = true;
16.     private FormUser user;
18.     public MyUsernamePasswordFilter() {
19.         super(DEFAULT_ANT_PATH_REQUEST_MATCHER);
20.     }
22.     public MyUsernamePasswordFilter(AuthenticationManager authenticationManager) {
23.         super(DEFAULT_ANT_PATH_REQUEST_MATCHER, authenticationManager);
24.     }
26.     public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
27.         if (this.postOnly && !request.getMethod().equals("POST")) {
28.             throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
29.         } else {
30.             log.info("url:" + request.getRequestURI());
31.             // 获取登录表单
32.             getUser(request);
33.             String username = obtainUsername();
34.             username = username != null ? username.trim() : "";
35.             String password = obtainPassword();
36.             password = password != null ? password : "";
37.             MyUsernamePasswordToken authRequest = MyUsernamePasswordToken.unauthenticated(username, password);
38.             this.setDetails(request, authRequest);
39.             this.setContinueChainBeforeSuccessfulAuthentication(false);
40.             return this.getAuthenticationManager().authenticate(authRequest);
41.         }
42.     }
44.     @Nullable
45.     protected String obtainPassword() {
46.         return user.getPassword();
47.     }
49.     @Nullable
50.     protected String obtainUsername() {
51.         return user.getUsername();
52.     }
54.     protected void setDetails(HttpServletRequest request, MyUsernamePasswordToken authRequest) {
55.         authRequest.setDetails(this.authenticationDetailsSource.buildDetails(request));
56.     }
58.     public void setUsernameParameter(String usernameParameter) {
59.         Assert.hasText(usernameParameter, "Username parameter must not be empty or null");
60.         this.usernameParameter = usernameParameter;
61.     }
63.     public void setPasswordParameter(String passwordParameter) {
64.         Assert.hasText(passwordParameter, "Password parameter must not be empty or null");
65.         this.passwordParameter = passwordParameter;
66.     }
68.     public void setPostOnly(boolean postOnly) {
69.         this.postOnly = postOnly;
70.     }
72.     public final String getUsernameParameter() {
73.         return this.usernameParameter;
74.     }
76.     public final String getPasswordParameter() {
77.         return this.passwordParameter;
78.     }
80.     /**
81.      * 获取登录用户信息
82.      *
83.      * @param request
84.      * @return
85.      */
86.     private void getUser(HttpServletRequest request) {
87.         ObjectMapper objectMapper = new ObjectMapper();
88.         objectMapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
89.         try {
90.             user = objectMapper.readValue(request.getInputStream(), FormUser.class);
91.             log.info("user:" + user.toString());
92.         } catch (Exception e) {
93.             throw new NullPointerException("获取不到登录信息");
94.         }
95.     }
97. }

复制代码

• 自界说provider
  

1. @Slf4j
2. public class MyUsernamePasswordProvider implements AuthenticationProvider, InitializingBean, MessageSourceAware {
4.     private final MyUserDetailsService userDetailsService;
5.     private final PasswordEncoder passwordEncoder;
6.     private MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
8.     public MyUsernamePasswordProvider(MyUserDetailsService userDetailsService, PasswordEncoder passwordEncoder) {
9.         this.userDetailsService = userDetailsService;
10.         this.passwordEncoder = passwordEncoder;
11.     }
13.     @Override
14.     public Authentication authenticate(Authentication authentication) throws AuthenticationException {
15.         try {
16.             MyUsernamePasswordToken tokenReq = (MyUsernamePasswordToken) authentication;
17.             String username = tokenReq.getPrincipal().toString();
18.             String password = tokenReq.getCredentials().toString();
19.             LoginUser loginUser = (LoginUser) userDetailsService.loadUserByUsername(username);
20.             if (!passwordEncoder.matches(password, loginUser.getPassword())) {
21.                 throw new RuntimeException("账号或者密码错误");
22.             }
23.             // 将权限列表加入MyUsernamePasswordToken
24.             MyUsernamePasswordToken myUsernameAuthenticationToken = MyUsernamePasswordToken.authenticated(loginUser, null, null);
25.             myUsernameAuthenticationToken.setDetails(authentication.getDetails());
26.             return myUsernameAuthenticationToken;
27.         } catch (Exception e) {
28.             e.printStackTrace();
29.             throw new BadCredentialsException(e.getMessage());
30.         }
31.     }
33.     @Override
34.     public boolean supports(Class<?> authentication) {
35.         return (MyUsernamePasswordToken.class.isAssignableFrom(authentication));
36.     }
38.     @Override
39.     public void afterPropertiesSet() throws Exception {
40.         Assert.notNull(userDetailsService, "userDetailsService must not be null");
41.         Assert.notNull(userDetailsService, "userDetailsService must not be null");
42.     }
44.     @Override
45.     public void setMessageSource(MessageSource messageSource) {
46.         this.messages = new MessageSourceAccessor(messageSource);
47.     }

复制代码

• 自界说Token
  

1. public class MyUsernamePasswordToken extends AbstractAuthenticationToken {
2.     private static final long serialVersionUID = 570L;
3.     private final Object principal;
4.     private Object credentials;
6.     public MyUsernamePasswordToken(Object principal, Object credentials) {
7.         super((Collection) null);
8.         this.principal = principal;
9.         this.credentials = credentials;
10.         this.setAuthenticated(false);
11.     }
13.     public MyUsernamePasswordToken(Object principal, Object credentials, Collection<? extends GrantedAuthority> authorities) {
14.         super(authorities);
15.         this.principal = principal;
16.         this.credentials = credentials;
17.         super.setAuthenticated(true);
18.     }
20.     public static MyUsernamePasswordToken unauthenticated(Object principal, Object credentials) {
21.         return new MyUsernamePasswordToken(principal, credentials);
22.     }
24.     public static MyUsernamePasswordToken authenticated(Object principal, Object credentials, Collection<? extends GrantedAuthority> authorities) {
25.         return new MyUsernamePasswordToken(principal, credentials, authorities);
26.     }
28.     public Object getCredentials() {
29.         return this.credentials;
30.     }
32.     public Object getPrincipal() {
33.         return this.principal;
34.     }
36.     public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
37.         Assert.isTrue(!isAuthenticated, "Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
38.         super.setAuthenticated(false);
39.     }
41.     public void eraseCredentials() {
42.         super.eraseCredentials();
43.         this.credentials = null;
44.     }
45. }

复制代码

• 自界说UserDetails
  

1. @Data
2. @AllArgsConstructor
3. @NoArgsConstructor
4. public class LoginUser implements UserDetails, Serializable {
5.     private static final long serialVersionUID = -53711580203962796L;
7.     private User user;https://www.yuque.com/u37030796/eb88se/uekda8twfz1pdq50#db5c42be
8.     private List<Long> permissions;
10.     public LoginUser(User user, List<Long> permissions) {
11.         this.user = user;
12.         this.permissions = permissions;
13.     }
15.     private List<SimpleGrantedAuthority> authorities;
17.     @Override
18.     public Collection<? extends GrantedAuthority> getAuthorities() {
19.         if (authorities != null) {
20.             return authorities;
21.         }
22.         if (CollUtil.isEmpty(permissions)) {
23.             return null;
24.         }
25.         authorities = permissions.stream().filter(x -> !ObjectUtil.isNull(x)).map(x -> x.toString())
26.                 .map(SimpleGrantedAuthority::new)
27.                 .collect(Collectors.toList());
28.         return authorities;
29.     }
31.     @Override
32.     public String getPassword() {
33.         return user.getPassword();
34.     }
36.     @Override
37.     public String getUsername() {
38.         return user.getUsername();
39.     }
41.     @Override
42.     public boolean isAccountNonExpired() {
43.         return true;
44.     }
46.     @Override
47.     public boolean isAccountNonLocked() {
48.         return true;
49.     }
51.     @Override
52.     public boolean isCredentialsNonExpired() {
53.         return true;
54.     }
56.     @Override
57.     public boolean isEnabled() {
58.         return true;
59.     }
60. }

复制代码

• 自界说UserDetailsService
  

1. @Slf4j
2. @Service
3. public class MyUserDetailsService implements UserDetailsService {
5.     @Autowired
6.     UserMapper userMapper;
8.     @Override
9.     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
10.         log.info("userDetails");
11.         LambdaQueryWrapper<User> wrapper = new LambdaQueryWrapper<>();
12.         wrapper.eq(User::getUsername, username);
13.         User user = userMapper.selectOne(wrapper);
14.         if (Objects.isNull(user)) {
15.             throw new UserNotFindException("找不到用户");
16.         }
17.         if (user.getStatus() == 1) {
18.             throw new UserNotFindException("账户已经被禁用");
19.         }
20.         return new LoginUser(user, null);
21.     }
23. }

复制代码

1. 6.自定义成功行为

复制代码

1. /**
2. * 2023/2/26
3. *
4. * @author cyh
5. * 15:04
6. */
7. @Slf4j
8. @Component
9. public class MyUsernamePasswordSuccessHandler implements AuthenticationSuccessHandler {
11.     @Autowired
12.     RedisTemplate<String, String> redisTemplate;
13.     @Autowired
14.     UserRoleService userRoleService;
15.     @Autowired
16.     IUserService userService;
18.     @Override
19.     public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authentication) throws IOException, ServletException {
20.         chain.doFilter(request, response);
21.     }
23.     @Override
24.     public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
25.         response.setCharacterEncoding("utf-8");
26.         response.setContentType("application/json;charset=utf-8");
27.         LoginUser loginUser = (LoginUser) authentication.getPrincipal();
28.         Long uid = loginUser.getUser().getId();
30.         // 每次登录添加登录ip和时间
31.         //  获取权限列表并返回
32.         User user = loginUser.getUser();
33.         user.setLastLoginTime(LocalDateTime.now().toString());
34.         user.setLoginIp(ServletUtil.getClientIP(request));
35.         userService.updateById(user);
36.         String token = MyJwtUtil.getToken(uid, RequestKey.ADMIN_USER.getKey());
37.         redisTemplate.opsForValue().set(RequestKey.ADMIN_USER.getKey() + "login:" + uid, token, 60 * 60 * 72, TimeUnit.SECONDS);
38.         // TODO redis存放门店列表
39.         // TODO redis存放权限列表
40.         List<Long> permsByUserId = userRoleService.getPermsByUserId(uid);
41.         ResultAuthority resultAuthority = new ResultAuthority(token, permsByUserId);
42.         ResultData<ResultAuthority> ok = ResultData.success("ok", resultAuthority);
43.         response.getWriter().print(JSONUtil.parseObj(ok));
44.         log.info("登录成功：" + authentication.getPrincipal().toString());
45.     }
46. }

复制代码

1. 7.自定义错误返回

复制代码

1. @Slf4j
2. public class MyUsernamePasswordErrorHandler implements AuthenticationFailureHandler {
3.     @Override
4.     public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
5.         log.info(exception.getMessage());
6.         response.setCharacterEncoding("utf-8");
7.         response.setContentType("application/json;charset=utf-8");
8.         response.setStatus(200);
9.         ResultData<ResultAuthority> ok = ResultData.fail(500, exception.getMessage());
10.         response.getWriter().print(JSONUtil.parseObj(ok));
11.     }
12. }

复制代码

3. 微信授权登录

• 微信登录拦截器
  

2. /**
3. * 2023/3/6
4. *
5. * @author cyh
6. * 9:29
7. */
8. @Slf4j
9. public class WxLoginFilter extends AbstractAuthenticationProcessingFilter {
11.     private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER = new AntPathRequestMatcher("/wxlogin/userinfo", "GET");
12.     private boolean postOnly = true;
14.     public WxLoginFilter() {
15.         super(DEFAULT_ANT_PATH_REQUEST_MATCHER);
16.     }
18.     public WxLoginFilter(AuthenticationManager authenticationManager) {
19.         super(DEFAULT_ANT_PATH_REQUEST_MATCHER, authenticationManager);
20.     }
22.     @Override
23.     public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException {
24.         log.info("正在进行拦截");
25.         if (!request.getMethod().equals("GET")) {
26.             throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
27.         } else {
28.             // 从请求头里获取到code
29.             String code = obtainCode(request);
30.             code = code != null ? code.trim() : "";
31.             WxUserToken wxUserToken = WxUserToken.unauthenticated(code, null);
32.             this.setDetails(request, wxUserToken);
33.             return this.getAuthenticationManager().authenticate(wxUserToken);
34.         }
35.     }
37.     protected void setDetails(HttpServletRequest request, WxUserToken authRequest) {
38.         authRequest.setDetails(this.authenticationDetailsSource.buildDetails(request));
39.     }
41.     @Nullable
42.     protected String obtainCode(HttpServletRequest request) {
43.         return request.getParameter("code");
44.     }
46.     public void setPostOnly(boolean postOnly) {
47.         this.postOnly = postOnly;
48.     }
49. }

复制代码

• 微信登录provider
  

1. /**
2. * 2023/3/6
3. *
4. * @author cyh
5. * 9:35
6. */
7. @Slf4j
8. public class WxLoginProvider implements AuthenticationProvider, InitializingBean, MessageSourceAware {
10.     private final WxLoginServiceImpl wxLoginService;
11.     private final WxLoginUtilService wxLoginUtilService;
12.     private MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
14.     public WxLoginProvider(WxLoginServiceImpl userDetailsService, WxLoginUtilService wxLoginUtilService) {
15.         this.wxLoginService = userDetailsService;
16.         this.wxLoginUtilService = wxLoginUtilService;
17.     }
19.     @Override
20.     public Authentication authenticate(Authentication authentication) throws AuthenticationException {
21.         WxUserToken tokenReq = (WxUserToken) authentication;
22.         String code = (String) tokenReq.getPrincipal();
23.         WxUserToken wxUserToken = null;
24.         String openid = null;
25.         // 根据code拿到access_token和openid
26.         try {
27.             // 向微信获取
28.             WxOAuth2AccessToken accessToken = wxLoginUtilService.getAccessTokenAndOpenID(code);
29.             openid = wxLoginUtilService.getWxUserInfo(accessToken);
30.         } catch (WxErrorException e) {
31.             throw new RuntimeException(e);
32.         }
33.         // 从数据库里获取用户信息并设置认证通过
34.         WxLoginEntity wxLoginEntity = wxLoginService.loadUserByUsername(openid);
35.         log.info("userDetails:{}", wxLoginEntity.toString());
36.         wxUserToken = WxUserToken.authenticated(wxLoginEntity, null, null);
37.         wxUserToken.setDetails(authentication.getDetails());
38.         return wxUserToken;
39.     }
41.     @Override
42.     public boolean supports(Class<?> authentication) {
43.         return (WxUserToken.class.isAssignableFrom(authentication));
44.     }
46.     @Override
47.     public void afterPropertiesSet() throws Exception {
48.         Assert.notNull(wxLoginService, "userDetailsService must not be null");
49.     }
51.     @Override
52.     public void setMessageSource(MessageSource messageSource) {
53.         this.messages = new MessageSourceAccessor(messageSource);
54.     }
55. }

复制代码

• 微信登录的Token
  

1. /**
2. * 2023/3/6
3. *
4. * @author cyh
5. * 9:33
6. */
7. public class WxUserToken extends AbstractAuthenticationToken {
9.     private static final long serialVersionUID = 570L;
10.     private final Object principal;
11.     private Object credentials;
13.     public WxUserToken(Object principal, Object credentials) {
14.         super((Collection) null);
15.         this.principal = principal;
16.         this.credentials = credentials;
17.         this.setAuthenticated(false);
18.     }
20.     public WxUserToken(Object principal, Object credentials, Collection<? extends GrantedAuthority> authorities) {
21.         super(authorities);
22.         this.principal = principal;
23.         this.credentials = credentials;
24.         super.setAuthenticated(true);
25.     }
27.     public static WxUserToken unauthenticated(Object principal, Object credentials) {
28.         return new WxUserToken(principal, credentials);
29.     }
31.     public static WxUserToken authenticated(Object principal, Object credentials, Collection<? extends GrantedAuthority> authorities) {
32.         return new WxUserToken(principal, credentials, authorities);
33.     }
35.     public Object getCredentials() {
36.         return this.credentials;
37.     }
39.     public Object getPrincipal() {
40.         return this.principal;
41.     }
43.     public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
44.         Assert.isTrue(!isAuthenticated, "Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
45.         super.setAuthenticated(false);
46.     }
48.     public void eraseCredentials() {
49.         super.eraseCredentials();
50.         this.credentials = null;
51.     }
53. }

复制代码

• 微信登录的UserDetails
  

2. /**
3. * 2023/3/6
4. *
5. * @author cyh
6. * 14:12
7. */
8. @Data
9. @AllArgsConstructor
10. public class WxLoginEntity implements UserDetails {
12.     private OrderUser user;
14.     @Override
15.     public Collection<? extends GrantedAuthority> getAuthorities() {
16.         return null;
17.     }
19.     @Override
20.     public String getPassword() {
21.         return null;
22.     }
24.     @Override
25.     public String getUsername() {
26.         return user.getOpenid();
27.     }
29.     @Override
30.     public boolean isAccountNonExpired() {
31.         return true;
32.     }
34.     @Override
35.     public boolean isAccountNonLocked() {
36.         return true;
37.     }
39.     @Override
40.     public boolean isCredentialsNonExpired() {
41.         return true;
42.     }
44.     @Override
45.     public boolean isEnabled() {
46.         return true;
47.     }
48. }

复制代码

• 微信登录的UserDetailsService
  

1. @Slf4j
2. @Service
3. public class WxLoginServiceImpl implements UserDetailsService {
5.     @Autowired
6.     WxLoginUtilService wxLoginUtilService;
7.     @Autowired
8.     IOrderUserService orderUserService;
10.     @Value("${wxlogin.appid}")
11.     private String appid;
13.     /**
14.      * 获取数据库用户信息
15.      *
16.      * @param username
17.      * @return
18.      * @throws UsernameNotFoundException
19.      */
20.     @Override
21.     public WxLoginEntity loadUserByUsername(String username) throws UsernameNotFoundException {
22.         OrderUser orderUser;
23.         orderUser = orderUserService.getOne(new LambdaQueryWrapper<OrderUser>().eq(OrderUser::getOpenid, username));
24.         if (ObjectUtil.isNull(orderUser)) {
25.             throw new UsernameNotFoundException("找不到用户");
26.         }
27.         return new WxLoginEntity(orderUser);
28.     }
30. }

复制代码

• 乐成返回
  

1. @Slf4j
2. @Component
3. public class WxLoginSuccessHandler implements AuthenticationSuccessHandler {
5.     @Autowired
6.     RedisTemplate<String, String> redisTemplate;
7.     private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
9.     @Override
10.     @IgnoreResponseAdvice
11.     public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException {
12.         // 获取当前认证的用户
13.         WxLoginEntity loginUser = (WxLoginEntity) authentication.getPrincipal();
14.         // 获取用户的id
15.         Long uid = loginUser.getUser().getId();
16.         // 获取token
17.         String token = MyJwtUtil.getToken(uid, RequestKey.WX_USER.getKey());
18.         redisTemplate.opsForValue().set(RequestKey.WX_USER.getKey() + "login:" + loginUser.getUser().getId(), token, 60 * 60 * 72, TimeUnit.SECONDS);
19.         // 设置返回的id和token
20.         response.setCharacterEncoding("utf-8");
21.         response.setContentType("application/json;charset=utf-8");
22.         Map<String, String> map = new HashMap<>();
23.         map.put("nickname", loginUser.getUser().getNickname());
24.         map.put("openid", loginUser.getUser().getOpenid());
25.         map.put("token", token);
26.         // 返回给前端
27.         ResultData<Map> ok = ResultData.success("ok", map);
28.         response.getWriter().print(JSONUtil.parseObj(ok));
29.     }
30. }

复制代码

• 失败返回
  

1. /**
2. * 2023/3/6
3. *
4. * @author cyh
5. * 9:35
6. */
7. public class WxLoginErrorHandler implements AuthenticationFailureHandler {
8.     @Override
9.     public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
10.         throw new RuntimeException("授权登录验证失败");
11.     }
12. }

复制代码

自界说token拦截器

1. @Slf4j
2. public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
3.     /**
4.      * 请求头token的key
5.      */
6.     private String tokenKey = RequestKey.TOKEN_KEY.getKey();
8.     /**
9.      * 用户的value
10.      */
11.     private String wxUser = RequestKey.WX_USER.getKey();
12.     /**
13.      * 管理用户的value
14.      */
15.     private String adminUser = RequestKey.ADMIN_USER.getKey();
16.     /**
17.      * redis 工具
18.      */
19.     private RedisTemplate<String, String> redisTemplate;
20.     /**
21.      * 微信登录用户
22.      */
23.     private IOrderUserService orderUserService;
24.     /**
25.      * 管理用户
26.      */
27.     private IUserService userService;
28.     /**
29.      * 用户权限
30.      */
31.     private UserRoleService userRoleService;
33.     public JwtAuthenticationTokenFilter(IOrderUserService orderUserService, IUserService userService, UserRoleService userRoleService, RedisTemplate<String, String> redisTemplate) {
34.         this.orderUserService = orderUserService;
35.         this.userService = userService;
36.         this.userRoleService = userRoleService;
37.         this.redisTemplate = redisTemplate;
38.     }
40.     @Override
41.     protected void doFilterInternal(HttpServletRequest request,
42.                                     HttpServletResponse response,
43.                                     FilterChain chain) throws ServletException, IOException {
44.         String reqToken = request.getHeader(this.tokenKey);
45.         log.info("现在{}正在进行jwt认证:{}", request.getRequestURI(), reqToken);
46.         // 判断token和请求用户是否存在
47.         if (Strings.isBlank(reqToken)) {
48.             chain.doFilter(request, response);
49.             return;
50.         }
51.         try {
52.             // 判断token是否过期
53.             if (!MyJwtUtil.verifyToken(reqToken)) {
54.                 throw new TokenException("非法token, token已过期");
55.             }
56.             // 从token上获取uid
57.             Long uid = MyJwtUtil.getUid(reqToken);
58.             String reqUser = MyJwtUtil.getRoleUser(reqToken);
59.             if (ObjectUtil.isNull(uid) || ObjectUtil.isNull(reqUser)) {
60.                 throw new TokenException("非法token.uid获取不到");
61.             }
62.             if (StrUtil.equals(reqUser, wxUser)) {
63.                 // 与redis中的用户token对比
64.                 String redisToken = redisTemplate.opsForValue().get(wxUser + "login:" + uid);
65.                 log.info("redisToken:{}", redisToken);
66.                 if (StrUtil.isBlankIfStr(redisToken) || !StrUtil.equals(redisToken, reqToken)) {
67.                     throw new TokenException("非法token，与redis中不一致");
68.                 }
69.                 // 判断获取的用户存不存在
70.                 OrderUser user = orderUserService.getById(uid);
71.                 if (ObjectUtil.isNull(user)) {
72.                     throw new TokenException("非法token，登录用户类别获取不到");
73.                 }
74.                 // 存在设置认证通过
75.                 WxLoginEntity wxLoginEntity = new WxLoginEntity(user);
76.                 WxUserToken wxUserToken = WxUserToken.authenticated(wxLoginEntity, null, null);
77.                 SecurityContextHolder.getContext().setAuthentication(wxUserToken);
78.                 chain.doFilter(request, response);
79.                 return;
80.             }
81.             if (StrUtil.equals(reqUser, adminUser)) {
82.                 // 与redis中的用户token对比
83.                 String redisToken = redisTemplate.opsForValue().get(adminUser + "login:" + uid);
84.                 log.info("redisToken:{}", redisToken);
85.                 if (StrUtil.isBlankIfStr(redisToken) || !StrUtil.equals(redisToken, reqToken)) {
86.                     throw new TokenException("非法token，与redis中不一致");
87.                 }
88.                 // TODO 从redis获取用户信息
89.                 User byId = userService.getById(uid);
90.                 // TODO 将用户信息放入MyUsernamePasswordToken
91.                 List<Long> permsByUserId = userRoleService.getPermsByUserId(uid);
92.                 LoginUser loginUser = new LoginUser(byId, permsByUserId);
93.                 if (loginUser.getUser().getStatus() == 1) {
94.                     redisTemplate.delete(adminUser + "login:" + uid);
95.                     throw new TokenException("账户被禁用，请重新登录");
96.                 }
97.                 MyUsernamePasswordToken myUsernamePasswordToken = new MyUsernamePasswordToken(loginUser, null,
98.                         loginUser.getAuthorities());
99.                 // TODO 将认证的信息放入 SecurityContextHolder.getContext()
100.                 SecurityContextHolder.getContext().setAuthentication(myUsernamePasswordToken);
101.                 chain.doFilter(request, response);
102.                 return;
103.             }
104.             throw new TokenException("非法token");
105.         } catch (TokenException exception) {
106.             JwtUnAuthorizedResponseAuthenticationEntryPoint point = new JwtUnAuthorizedResponseAuthenticationEntryPoint();
107.             point.commence(request, response, exception);
108.         }
110.     }
112. }

复制代码

4. Security设置类

1. @Configuration
2. @EnableWebSecurity    // 添加 security 过滤器\
3. @EnableGlobalMethodSecurity(prePostEnabled = true)
4. public class SecurityConfig {
6.     /**
7.      * token认证器
8.      */
9.     @Autowired
10.     IOrderUserService orderUserService;
11.     @Autowired
12.     IUserService userService;
13.     @Autowired
14.     MyJwtUtil myJwtUtil;
15.     @Autowired
16.     UserRoleService userRoleService;
17.     @Autowired
18.     RedisTemplate<String, String> redisTemplate;
20.     JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter() {
21.         return new JwtAuthenticationTokenFilter(orderUserService, userService, myJwtUtil, userRoleService, redisTemplate);
22.     }
24.     /**
25.      * 放行路径配置类
26.      */
27.     @Autowired
28.     SecurityRelease securityRelease;
30.     /**
31.      * 放行路径
32.      */
34.     @Bean
35.     public PasswordEncoder passwordEncoder() {
36.         return new BCryptPasswordEncoder();
37.     }
39.     /**
40.      * 获取AuthenticationManager（认证管理器），登录时认证使用
41.      *
42.      * @return
43.      * @throws Exception
44.      */
45.     @Bean
46.     public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
47.         AuthenticationManager authenticationManager = authenticationConfiguration.getAuthenticationManager();
48.         return authenticationManager;
49.     }
51.     @Bean
52.     SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
53.         http.exceptionHandling().accessDeniedHandler(new AccessDeniedHandlerImpl());
54.         return
55.                 http.authorizeRequests(authorize -> authorize
56.                                 .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
57.                                 // 请求放开
58.                                 .antMatchers(securityRelease.getReleaseUrl()).permitAll()
59.                                 // 其他地址的访问均需验证权限
60.                                 .anyRequest().authenticated()
61.                         ) // 基于 token，不需要 csrf
62.                         .csrf().disable()
63.                         .formLogin().disable()
64.                         // 基于 token，不需要 session
65.                         .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
66.                         .addFilterAt(wxLoginFilter(), UsernamePasswordAuthenticationFilter.class)
67.                         .addFilterAt(usernamePasswordFilter(), UsernamePasswordAuthenticationFilter.class)
68.                         .addFilterBefore(jwtAuthenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class)
69.                         .build();
71.     }
73.     /**
74.      * 配置跨源访问(CORS)
75.      *
76.      * @return
77.      */
78.     @Bean
79.     CorsConfigurationSource corsConfigurationSource() {
80.         UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
81.         source.registerCorsConfiguration("/**", new CorsConfiguration().applyPermitDefaultValues());
82.         return source;
83.     }
85.     @Autowired
86.     WxLoginServiceImpl wxLoginService;
87.     @Autowired
88.     WxLoginUtilService wxLoginUtilService;
89.     @Autowired
90.     WxLoginSuccessHandler wxLoginSuccessHandler;
92.     // 添加微信用户登录拦截器
93.     WxLoginFilter wxLoginFilter() throws Exception {
94.         WxLoginFilter myUsernameFilter = new WxLoginFilter();
95.         ProviderManager providerManager = new ProviderManager(Collections.singletonList(wxLoginProvider()));
96.         myUsernameFilter.setAuthenticationManager(providerManager);
97.         myUsernameFilter.setAuthenticationSuccessHandler(wxLoginSuccessHandler);
98.         myUsernameFilter.setAuthenticationFailureHandler(new WxLoginErrorHandler());
99.         myUsernameFilter.setContinueChainBeforeSuccessfulAuthentication(true);
100.         return myUsernameFilter;
101.     }
103.     WxLoginProvider wxLoginProvider() {
104.         WxLoginProvider provider = new WxLoginProvider(wxLoginService, wxLoginUtilService);
105.         return provider;
106.     }
108.     @Autowired
109.     MyUsernamePasswordSuccessHandler myUsernamePasswordSuccessHandler;
110.     @Autowired
111.     MyUserDetailsService userDetailsService;
113.     /**
114.      * 添加用户登录拦截器
115.      *
116.      * @return
117.      */
118.     MyUsernamePasswordFilter usernamePasswordFilter() {
119.         MyUsernamePasswordFilter filter = new MyUsernamePasswordFilter();
120.         ProviderManager manager = new ProviderManager(Collections.singletonList(usernamePasswordProvider()));
121.         filter.setAuthenticationManager(manager);
122.         filter.setAuthenticationFailureHandler(new MyUsernamePasswordErrorHandler());
123.         filter.setAuthenticationSuccessHandler(myUsernamePasswordSuccessHandler);
124.         return filter;
125.     }
127.     MyUsernamePasswordProvider usernamePasswordProvider() {
128.         return new MyUsernamePasswordProvider(userDetailsService, passwordEncoder());
129.     }
130. }

复制代码

4.yml 文件设置放行路径

1. my-security:
2.   releaseUrl:
3.     - /wxlogin/**
4.     - /user/login
5.     - /user/logout
6.     - /doc.html
7.     - /webjars/**
8.     - /swagger-resources/**
9.     - /v2/**
10.     - /wx-pay/**
11.     - /**

复制代码

5. 放行路径设置类

1. /**
2. * 2023/3/13
3. * security 放行路径配置类
4. *
5. * @author cyh
6. * 14:27
7. */
8. @Configuration
9. @Data
10. @ConfigurationProperties(prefix = "my-security")
11. public class SecurityRelease {
12.     private String[] releaseUrl;
13. }

复制代码