1 篇博文 含有标签「Spring Security」

package space.jachen.yygh.order.security;

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Component;
import space.jachen.yygh.security.custom.CustomUser;
import space.jachen.yygh.user.PatientFeignClient;
import space.jachen.yygh.vo.user.LoginVo;

import javax.annotation.Resource;
import java.util.ArrayList;
import java.util.Collection;

/**
 * @author JaChen
 * @date 2022/12/23 22:35
 */
@Component
public class UserDetailsServiceImpl implements UserDetailsService {

    @Resource
    private PatientFeignClient userInfoFeignClient;

    @Override
    public UserDetails loadUserByUsername(String phone) throws UsernameNotFoundException {
        LoginVo login = userInfoFeignClient.loginSecurity(phone);
        if(login == null) {
            throw new UsernameNotFoundException("用户名不存在！");
        }
        // 这里不比较密码 ，后面通过PasswordEncoder比较
        // 返回数据、暂时不做授权
        Collection<GrantedAuthority> authorities = new ArrayList<>();
        return new CustomUser(login,authorities);
    }
}

package space.jachen.yygh.security.custom;

import lombok.Getter;
import lombok.Setter;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.User;
import space.jachen.yygh.vo.user.LoginVo;

import java.util.Collection;

/**
 * 访问数据库的方法loadUserByUsername，返回值为Userdetails，
 * 它封装了从数据库中返回的用户信息，但是和我们数据库表不一致，
 * 所以我们还需要自定义UserDetails实现类。
 *
 * @author JaChen
 * @date 2022/12/23 22:31
 */
@Getter
@Setter
public class CustomUser extends User {

    /**
     * 我们自己的用户实体对象，要调取用户信息时直接获取这个实体对象
     */
    private LoginVo loginVo;

    /**
     *
     * @param loginVo  从数据库中查询的用户信息
     * @param authorities  从数据库中查询的权限
     */
    public CustomUser(LoginVo loginVo,Collection<? extends GrantedAuthority> authorities) {
        super(loginVo.getPhone(), loginVo.getCode(), authorities);
        this.loginVo = loginVo;
    }
}

package space.jachen.yygh.security.custom;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.StringRedisTemplate;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Component;

/**
 *
 * 自定义密码组件 密码处理
 * 此项目不需要md5加密处理
 * 不需要开发者自己调用此类，SpringSecurity流程中进行密码比较时会自动调用。
 *
 * @author JaChen
 * @date 2022/12/23 22:25
 */
@Component  // 必须添加到IOC ,SpringSecurity才可以使用
public class CustomPasswordEncoder implements PasswordEncoder {


    @Autowired
    private StringRedisTemplate stringRedisTemplate;

    /**
     * 如果需要加密进行加密操作后返回，这里不需要处理，
     * 因为本项目没有对用户密码进行加密，
     * 采用的是手机号+验证码的方式进行登录
     * 验证码存在redis中，为了方便演示，特定此条验证码永不过期，当作密码使用，
     *
     * @param rawPassword  明文  用户输入的密码
     * @return  密文
     */
    public String encode(CharSequence rawPassword) {
        return rawPassword.toString();
    }

    /**
     *
     * @param rawPassword  用户输入的密码  即4位验证码
     * @param encodedPassword  从redis中查询出来的验证码
     * @return boolean
     */
    public boolean matches(CharSequence rawPassword, String encodedPassword) {
        // 写死
        encodedPassword = stringRedisTemplate.opsForValue().get("13243922402");
        return encodedPassword.equals(encode(encodedPassword));
    }
}

package space.jachen.yygh.security.filter;

/**
 * @author JaChen
 * @date 2022/12/23 22:45
 */

import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import space.jachen.yygh.common.result.JsonData;
import space.jachen.yygh.common.result.ResultCodeEnum;
import space.jachen.yygh.common.utils.JwtHelper;
import space.jachen.yygh.common.utils.ResponseUtil;
import space.jachen.yygh.security.custom.CustomUser;
import space.jachen.yygh.vo.user.LoginVo;

import javax.annotation.Resource;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;

/**
 * <p>
 * 登录过滤器，继承UsernamePasswordAuthenticationFilter，对用户名密码进行登录校验
 * </p>
 *
 */
public class TokenLoginFilter extends UsernamePasswordAuthenticationFilter {

    @Resource
    private RedisTemplate redisTemplate;
    public TokenLoginFilter(AuthenticationManager authenticationManager,
                            RedisTemplate redisTemplate ) {
        //设置认证管理器
        this.setAuthenticationManager(authenticationManager);
        //设置登录的地址和请求方式
        this.setRequiresAuthenticationRequestMatcher(
                new AntPathRequestMatcher("/yygh/user/loginSecurity", "POST"));
        this.redisTemplate = redisTemplate;
    }

    /**
     * 登录认证
     * 走这个登录认证流程 不走原先的登录接口了
     *
     * @param req
     * @param res
     * @return
     * @throws AuthenticationException
     */
    @Override
    public Authentication attemptAuthentication(HttpServletRequest req, HttpServletResponse res)
            throws AuthenticationException {
        try {
            // 获取用户名的方法  简单封装方法
            LoginVo loginVo = new ObjectMapper().readValue(req.getInputStream(), LoginVo.class);
            String pwd = (String) redisTemplate.opsForValue().get(loginVo.getPhone());
            // 将用户名和密码封装到Authentication
            Authentication authenticationToken =
                    new UsernamePasswordAuthenticationToken(loginVo.getPhone(), pwd);
            // 调取getAuthenticationManager认证
            return this.getAuthenticationManager().authenticate(authenticationToken);
        } catch (IOException e) {
            throw new RuntimeException(e);
        }
    }

    /**
     * 登录成功 认证成功调用的方法
     *
     * @param request
     * @param response
     * @param chain
     * @param auth
     * @throws IOException
     * @throws ServletException
     */
    @Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,Authentication auth) throws IOException, ServletException {
        // 1、通过Authentication获取认证的对象
        CustomUser customUser = (CustomUser) auth.getPrincipal();
        // 2、通过JwtHelper生成token
        String token = JwtHelper.createToken(Long.parseLong(customUser.getLoginVo().getOpenid()), customUser.getLoginVo().getPhone());
        // 3、获取用户的权限
        // Collection<GrantedAuthority> authorities = customUser.getAuthorities();
        // 4、将权限保存到Redis中
        // redisTemplate.boundValueOps(customUser.getUsername()).set(authorities);

        // 5、保存登录日志
        // loginLogService.recordLoginLog(customUser.getUsername(), IpUtil.getIpAddress(request),1,"登录成功");

        // 创建一个Map
        Map<String, Object> map = new HashMap<>();
        map.put("token", token);
        // 6、通过ResponseUtil工具类响应到前端
        ResponseUtil.out(response, JsonData.ok(map));
    }

    /**
     * 登录失败
     *
     * @param request
     * @param response
     * @param e
     * @throws IOException
     * @throws ServletException
     */
    @Override
    protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException e) throws IOException, ServletException {
        if (e.getCause() instanceof RuntimeException){
            ResponseUtil.out(response, JsonData.build(null,204,e.getMessage()));
        }else {
            ResponseUtil.out(response,JsonData.build(null, ResultCodeEnum.LOGIN_MOBLE_ERROR));
        }
    }
}

package space.jachen.yygh.security.config;

import org.springframework.context.annotation.Configuration;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import space.jachen.yygh.security.filter.TokenLoginFilter;

import javax.annotation.Resource;

/**
 * @author JaChen
 * @date 2022/12/23 22:24
 */
@Configuration
@EnableWebSecurity //@EnableWebSecurity是开启SpringSecurity的默认行为
@EnableGlobalMethodSecurity(prePostEnabled = true)//开启注解功能，默认禁用注解
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {


    @Resource
    private RedisTemplate redisTemplate;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // 这是配置的关键，决定哪些接口开启防护，哪些接口绕过防护
        http
                //关闭csrf
                .csrf().disable()
                // 开启跨域以便前端调用接口
                .cors().and()
                .authorizeRequests()
                // 指定某些接口不需要通过验证即可访问。登陆接口肯定是不需要认证的
                .antMatchers("/yygh/user/login").permitAll()
                // 这里意思是其它所有接口需要认证才能访问
                .anyRequest().authenticated()
                .and()
                //TokenAuthenticationFilter放到UsernamePasswordAuthenticationFilter的前面，
                // 这样做就是为了除了登录的时候去查询数据库外，其他时候都用token进行认证。
//                .addFilterBefore(new TokenAuthenticationFilter(redisTemplate), UsernamePasswordAuthenticationFilter.class)
                .addFilter(new TokenLoginFilter(authenticationManager(), redisTemplate));

        //禁用session
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }

    /**
     * 配置哪些请求不拦截
     * 排除swagger相关请求
     * @param web
     * @throws Exception
     */
    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/favicon.ico","/swagger-resources/**", "/webjars/**", "/v2/**", "/swagger-ui.html/**", "/doc.html");
    }
}

package space.jachen.yygh.security.filter;

/**
 * @author JaChen
 * @date 2022/12/23 23:04
 */

import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.util.StringUtils;
import org.springframework.web.filter.OncePerRequestFilter;
import space.jachen.yygh.common.result.JsonData;
import space.jachen.yygh.common.result.ResultCodeEnum;
import space.jachen.yygh.common.utils.JwtHelper;
import space.jachen.yygh.common.utils.ResponseUtil;

import javax.annotation.Resource;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Collection;

/**
 * <p>
 * 认证解析token过滤器
 * </p>
 */
public class TokenAuthenticationFilter extends OncePerRequestFilter {

    @Resource
    private RedisTemplate redisTemplate;

    public TokenAuthenticationFilter(RedisTemplate redisTemplate) {
        this.redisTemplate = redisTemplate;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)throws IOException, ServletException {
        logger.info("认证解析token过滤器的url:"+request.getRequestURI());
        //如果是登录接口，直接放行
        if("/yygh/user/login".equals(request.getRequestURI())) {
            chain.doFilter(request, response);
            return;
        }

        UsernamePasswordAuthenticationToken authentication = getAuthentication(request);
        if(null != authentication) {
            SecurityContextHolder.getContext().setAuthentication(authentication);
            //放行请求
            chain.doFilter(request, response);
        } else {
            ResponseUtil.out(response, JsonData.build(null, ResultCodeEnum.PERMISSION));//209  没有权限
        }
    }

    private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request) {
        // token置于header里
        String token = request.getHeader("token");
        logger.info("token:"+token);
        if (!StringUtils.isEmpty(token)) {
            String username = JwtHelper.getUserName(token);
            logger.info("username:"+username);
            if (!StringUtils.isEmpty(username)) {
                //从Redis中获取权限
                Collection<GrantedAuthority> authorities = (Collection<GrantedAuthority>) redisTemplate.boundValueOps(username).get();
                return new UsernamePasswordAuthenticationToken(username, null, authorities);
                //返回一个认证对象
                //return new UsernamePasswordAuthenticationToken(username, null, Collections.emptyList());
            }
        }
        return null;
    }
}