SpringBoot使用Security认证框架（1.加类）

蚊子 2023年03月02日 669次浏览

前言：

本文章包含Security的认证和授权方法
并且在执行Security之前会执行自已编写的PowerFilter过滤器
而且登录信息会存入Redis，也会从Redis取

本文章只是加各种根据类
使用方法前往：https://www.0po.cn/archives/26

需要注意：

  1. SecurityConfig，45行需要改成你的登录接口地址
  2. LoginUser，需要改动一些东西，注意看注释
  3. PowerFilter，为自已的拦截器，在执行Security之前会执行自已编写的PowerFilter过滤器，可以按需改动，也可不动
  4. 一个个加类过程中，如果那个类里面报错了，不用管，先加完所有类。
  5. 加完后，在看报错的类，不出意外都是引入的包是我的com.zb报的错，改成你的包

依赖

  1. <dependency>
  2.             <groupId>org.springframework.boot</groupId>
  3.             <artifactId>spring-boot-starter-security</artifactId>
  4.         </dependency>
  5. <dependency>
  6.             <groupId>com.alibaba</groupId>
  7.             <artifactId>fastjson</artifactId>
  8.             <version>1.2.33</version>
  9.         </dependency>
  10. <dependency>
  11.             <groupId>org.springframework.boot</groupId>
  12.             <artifactId>spring-boot-starter-data-redis</artifactId>
  13.         </dependency>
  14. <dependency>
  15.             <groupId>io.jsonwebtoken</groupId>
  16.             <artifactId>jjwt</artifactId>
  17.             <version>0.9.0</version>
  18.         </dependency>

  20.         <dependency>
  21.             <groupId>org.projectlombok</groupId>
  22.             <artifactId>lombok</artifactId>
  23.             <version>1.18.10</version>
  24.         </dependency>

需要的工具类

新建config包，第一部分开始

FastJsonRedisSerializer

  1. package com.zb.config;

  3. import com.alibaba.fastjson.JSON;
  4. import com.alibaba.fastjson.parser.ParserConfig;
  5. import com.alibaba.fastjson.serializer.SerializerFeature;
  6. import com.fasterxml.jackson.databind.JavaType;
  7. import com.fasterxml.jackson.databind.type.TypeFactory;
  8. import org.springframework.data.redis.serializer.RedisSerializer;
  9. import org.springframework.data.redis.serializer.SerializationException;

  11. import java.nio.charset.Charset;

  13. /**
  14.  * Redis使用FastJson序列化
  15.  *
  16.  * @author sg
  17.  */
  18. public class FastJsonRedisSerializer<T> implements RedisSerializer<T>
  19. {

  21.     public static final Charset DEFAULT_CHARSET = Charset.forName("UTF-8");

  23.     private Class<T> clazz;

  25.     static
  26.     {
  27.         ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
  28.     }

  30.     public FastJsonRedisSerializer(Class<T> clazz)
  31.     {
  32.         super();
  33.         this.clazz = clazz;
  34.     }

  36.     @Override
  37.     public byte[] serialize(T t) throws SerializationException
  38.     {
  39.         if (t == null)
  40.         {
  41.             return new byte[0];
  42.         }
  43.         return JSON.toJSONString(t, SerializerFeature.WriteClassName).getBytes(DEFAULT_CHARSET);
  44.     }

  46.     @Override
  47.     public T deserialize(byte[] bytes) throws SerializationException
  48.     {
  49.         if (bytes == null || bytes.length <= 0)
  50.         {
  51.             return null;
  52.         }
  53.         String str = new String(bytes, DEFAULT_CHARSET);

  55.         return JSON.parseObject(str, clazz);
  56.     }


  59.     protected JavaType getJavaType(Class<?> clazz)
  60.     {
  61.         return TypeFactory.defaultInstance().constructType(clazz);
  62.     }
  63. }

JwtUtil

  1. package com.zb.config;

  3. import io.jsonwebtoken.Claims;
  4. import io.jsonwebtoken.JwtBuilder;
  5. import io.jsonwebtoken.Jwts;
  6. import io.jsonwebtoken.SignatureAlgorithm;

  8. import javax.crypto.SecretKey;
  9. import javax.crypto.spec.SecretKeySpec;
  10. import java.util.Base64;
  11. import java.util.Date;
  12. import java.util.UUID;

  14. /**
  15.  * JWT工具类
  16.  */
  17. public class JwtUtil {

  19.     //有效期为
  20.     public static final Long JWT_TTL = 60 * 60 *1000L;// 60 * 60 *1000  一个小时
  21.     //设置秘钥明文
  22.     public static final String JWT_KEY = "abcd";

  24.     public static String getUUID(){
  25.         String token = UUID.randomUUID().toString().replaceAll("-", "");
  26.         return token;
  27.     }

  29.     /**
  30.      * 生成jtw
  31.      * @param subject token中要存放的数据（json格式）
  32.      * @return
  33.      */
  34.     public static String createJWT(String subject) {
  35.         JwtBuilder builder = getJwtBuilder(subject, null, getUUID());// 设置过期时间
  36.         return builder.compact();
  37.     }

  39.     /**
  40.      * 生成jtw
  41.      * @param subject token中要存放的数据（json格式）
  42.      * @param ttlMillis token超时时间
  43.      * @return
  44.      */
  45.     public static String createJWT(String subject, Long ttlMillis) {
  46.         JwtBuilder builder = getJwtBuilder(subject, ttlMillis, getUUID());// 设置过期时间
  47.         return builder.compact();
  48.     }

  50.     private static JwtBuilder getJwtBuilder(String subject, Long ttlMillis, String uuid) {
  51.         SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.HS256;
  52.         SecretKey secretKey = generalKey();
  53.         long nowMillis = System.currentTimeMillis();
  54.         Date now = new Date(nowMillis);
  55.         if(ttlMillis==null){
  56.             ttlMillis=JwtUtil.JWT_TTL;
  57.         }
  58.         long expMillis = nowMillis + ttlMillis;
  59.         Date expDate = new Date(expMillis);
  60.         return Jwts.builder()
  61.                 .setId(uuid)              //唯一的ID
  62.                 .setSubject(subject)   // 主题  可以是JSON数据
  63.                 .setIssuer("sg")     // 签发者
  64.                 .setIssuedAt(now)      // 签发时间
  65.                 .signWith(signatureAlgorithm, secretKey) //使用HS256对称加密算法签名, 第二个参数为秘钥
  66.                 .setExpiration(expDate);
  67.     }

  69.     /**
  70.      * 创建token
  71.      * @param id
  72.      * @param subject
  73.      * @param ttlMillis
  74.      * @return
  75.      */
  76.     public static String createJWT(String id, String subject, Long ttlMillis) {
  77.         JwtBuilder builder = getJwtBuilder(subject, ttlMillis, id);// 设置过期时间
  78.         return builder.compact();
  79.     }

  81.     /**
  82.      * 生成加密后的秘钥 secretKey
  83.      * @return
  84.      */
  85.     public static SecretKey generalKey() {
  86.         byte[] encodedKey = Base64.getDecoder().decode(JwtUtil.JWT_KEY);
  87.         SecretKey key = new SecretKeySpec(encodedKey, 0, encodedKey.length, "AES");
  88.         return key;
  89.     }

  91.     /**
  92.      * 解析
  93.      *
  94.      * @param jwt
  95.      * @return
  96.      * @throws Exception
  97.      */
  98.     public static Claims parseJWT(String jwt) throws Exception {
  99.         SecretKey secretKey = generalKey();
  100.         return Jwts.parser()
  101.                 .setSigningKey(secretKey)
  102.                 .parseClaimsJws(jwt)
  103.                 .getBody();
  104.     }


  107. }

RedisConfig

  1. package com.zb.config;

  3. import org.springframework.context.annotation.Bean;
  4. import org.springframework.context.annotation.Configuration;
  5. import org.springframework.data.redis.connection.RedisConnectionFactory;
  6. import org.springframework.data.redis.core.RedisTemplate;
  7. import org.springframework.data.redis.serializer.StringRedisSerializer;

  9. @Configuration
  10. public class RedisConfig {

  12.     @Bean
  13.     @SuppressWarnings(value = { "unchecked", "rawtypes" })
  14.     public RedisTemplate<Object, Object> redisTemplate(RedisConnectionFactory connectionFactory)
  15.     {
  16.         RedisTemplate<Object, Object> template = new RedisTemplate<>();
  17.         template.setConnectionFactory(connectionFactory);

  19.         FastJsonRedisSerializer serializer = new FastJsonRedisSerializer(Object.class);

  21.         // 使用StringRedisSerializer来序列化和反序列化redis的key值
  22.         template.setKeySerializer(new StringRedisSerializer());
  23.         template.setValueSerializer(serializer);

  25.         // Hash的key也采用StringRedisSerializer的序列化方式
  26.         template.setHashKeySerializer(new StringRedisSerializer());
  27.         template.setHashValueSerializer(serializer);


  30.         template.afterPropertiesSet();
  31.         return template;
  32.     }
  33. }

SecurityConfig，45行需要改成你的登录接口地址


  2. import com.zb.filters.PowerFilter;
  3. import org.springframework.beans.factory.annotation.Autowired;
  4. import org.springframework.context.annotation.Bean;
  5. import org.springframework.context.annotation.Configuration;
  6. import org.springframework.security.authentication.AuthenticationManager;
  7. import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
  8. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  9. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  10. import org.springframework.security.config.http.SessionCreationPolicy;
  11. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  12. import org.springframework.security.web.AuthenticationEntryPoint;
  13. import org.springframework.security.web.access.AccessDeniedHandler;
  14. import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

  16. @Configuration
  17. @EnableGlobalMethodSecurity(prePostEnabled = true)
  18. public class SecurityConfig extends WebSecurityConfigurerAdapter {

  20.     @Bean
  21.     public BCryptPasswordEncoder cryptPasswordEncoder() {
  22.         return new BCryptPasswordEncoder();
  23.     }

  25.     @Autowired
  26.     private PowerFilter powerFilter;

  28.     @Autowired
  29.     private AuthenticationEntryPoint authenticationEntryPoint;

  31.     @Autowired
  32.     private AccessDeniedHandler accessDeniedHandler;

  34.     @Override
  35.     protected void configure(HttpSecurity http) throws Exception {
  36.         http
  37.                 //关闭csrf
  38.                 .csrf().disable()
  39.                 //不通过Session获取SecurityContext
  40.                 .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
  41.                 .and()
  42.                 .authorizeRequests()
  43.                 // 对于登录接口 允许匿名访问（需要改成你的登录接口地址）
  44.                 .antMatchers("/user/login/**").anonymous()
  45.                 // 除上面外的所有请求全部需要鉴权认证
  46.                 .anyRequest().authenticated();
  47.         //将用户开发的过滤器添加到用户登陆之前的过滤器上
  48.         http.addFilterBefore(powerFilter, UsernamePasswordAuthenticationFilter.class);
  49.         //添加自定义异常处理
  50.         http.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint).accessDeniedHandler(accessDeniedHandler);
  51.     }

  53.     @Bean
  54.     public AuthenticationManager createAuthenticationManager() throws Exception {
  55.         return super.authenticationManagerBean();
  56.     }

  58. }

WebUtils

  1. package com.zb.config;

  3. import javax.servlet.http.HttpServletResponse;
  4. import java.io.IOException;

  6. public class WebUtils
  7. {
  8.     /**
  9.      * 自定义返回没有认证和授权信息用的
  10.      * 将字符串渲染到客户端
  11.      * 
  12.      * @param response 渲染对象
  13.      * @param string 待渲染的字符串
  14.      * @return null
  15.      */
  16.     public static String renderString(HttpServletResponse response, String string) {
  17.         try
  18.         {
  19.             response.setStatus(200);
  20.             response.setContentType("application/json");
  21.             response.setCharacterEncoding("utf-8");
  22.             response.getWriter().print(string);
  23.         }
  24.         catch (IOException e)
  25.         {
  26.             e.printStackTrace();
  27.         }
  28.         return null;
  29.     }
  30. }

config包结束，第一部分结束

entity包，第二部分开始

LoginUser，需要改动一些东西，注意看注释

  1. package com.zb.entity;

  3. import com.alibaba.fastjson.annotation.JSONField;
  4. import lombok.AllArgsConstructor;
  5. import lombok.Data;
  6. import lombok.NoArgsConstructor;
  7. import org.springframework.security.core.GrantedAuthority;
  8. import org.springframework.security.core.authority.SimpleGrantedAuthority;
  9. import org.springframework.security.core.userdetails.UserDetails;

  11. import java.util.ArrayList;
  12. import java.util.Collection;
  13. import java.util.List;

  15. @Data
  16. @NoArgsConstructor
  17. public class LoginUser implements UserDetails {

  19.     //登录信息实体类，换成你的
  20.     private User user;
  21.     //存放查出来的用户有的权限
  22.     private List<String> powers;
  23.     //将用户信息和权限全放进去
  24.     //User需要换成你的
  25.     public LoginUser(User user, List<String> powers) {
  26.         this.user = user;
  27.         this.powers = powers;
  28.     }

  30.     @JSONField(serialize = false)
  31.     private List<SimpleGrantedAuthority> authorities;

  33.     @Override
  34.     public Collection<? extends GrantedAuthority> getAuthorities() {
  35.         if (authorities != null && authorities.size() > 0) {
  36.             return authorities;
  37.         }
  38.         authorities = new ArrayList<>();
  39.         for (String power : powers) {
  40.             SimpleGrantedAuthority simpleGrantedAuthority = new SimpleGrantedAuthority(power);
  41.             authorities.add(simpleGrantedAuthority);
  42.         }
  43.         return authorities;
  44.     }

  46.     //user.getPasswd()为获取密码，换成你的
  47.     @Override
  48.     public String getPassword() {
  49.         return user.getPasswd();
  50.     }

  52.     //user.getNickName();为获取用户名，换成你的
  53.     @Override
  54.     public String getUsername() {
  55.         return user.getNickName();
  56.     }

  58.     @Override
  59.     public boolean isAccountNonExpired() {
  60.         return true;
  61.     }

  63.     @Override
  64.     public boolean isAccountNonLocked() {
  65.         return true;
  66.     }

  68.     @Override
  69.     public boolean isCredentialsNonExpired() {
  70.         return true;
  71.     }

  73.     @Override
  74.     public boolean isEnabled() {
  75.         return true;
  76.     }
  77. }

entity包，第二部分结束

exception包，第三部分开始

AccessDeniedHandlerImpl

  1. package com.zb.exception;

  3. import com.alibaba.fastjson.JSON;
  4. import com.zb.config.WebUtils;
  5. import org.springframework.http.HttpStatus;
  6. import org.springframework.security.access.AccessDeniedException;
  7. import org.springframework.security.web.access.AccessDeniedHandler;
  8. import org.springframework.stereotype.Component;

  10. import javax.servlet.ServletException;
  11. import javax.servlet.http.HttpServletRequest;
  12. import javax.servlet.http.HttpServletResponse;
  13. import java.io.IOException;
  14. import java.util.HashMap;
  15. import java.util.Map;

  17. @Component
  18. public class AccessDeniedHandlerImpl implements AccessDeniedHandler {
  19.     @Override
  20.     public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
  21.         Map<String, Object> result = new HashMap<>();
  22.         result.put("msg", "授权失败!");
  23.         String json = JSON.toJSONString(result);
  24.         WebUtils.renderString(response, json);
  25.     }
  26. }

AuthenticationEntryPointImpl

  1. package com.zb.exception;

  3. import com.alibaba.fastjson.JSON;
  4. import com.zb.config.WebUtils;
  5. import org.springframework.http.HttpStatus;
  6. import org.springframework.security.core.AuthenticationException;
  7. import org.springframework.security.web.AuthenticationEntryPoint;
  8. import org.springframework.stereotype.Component;

  10. import javax.servlet.ServletException;
  11. import javax.servlet.http.HttpServletRequest;
  12. import javax.servlet.http.HttpServletResponse;
  13. import java.io.IOException;
  14. import java.util.HashMap;
  15. import java.util.Map;

  17. @Component
  18. public class AuthenticationEntryPointImpl implements AuthenticationEntryPoint {
  19.     @Override
  20.     public void commence(HttpServletRequest request, HttpServletResponse response,
  21.                          AuthenticationException authException) throws IOException, ServletException {
  22.         Map<String, Object> result = new HashMap<>();
  23.         result.put("code", HttpStatus.UNAUTHORIZED);
  24.         result.put("msg", "认证失败!");
  25.         String json = JSON.toJSONString(result);
  26.         WebUtils.renderString(response, json);

  28.     }
  29. }

exception包，第三部分结束

filters包，第四部分开始

PowerFilter，为自已的拦截器，在执行Security之前会执行自已编写的PowerFilter过滤器，可以按需改动，也可不动

  1. package com.zb.filters;

  3. import com.alibaba.fastjson.JSON;
  4. import com.zb.config.JwtUtil;
  5. import com.zb.entity.LoginUser;
  6. import io.jsonwebtoken.Claims;
  7. import org.springframework.beans.factory.annotation.Autowired;
  8. import org.springframework.data.redis.core.RedisTemplate;
  9. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  10. import org.springframework.security.core.context.SecurityContextHolder;
  11. import org.springframework.stereotype.Component;
  12. import org.springframework.util.ObjectUtils;
  13. import org.springframework.util.StringUtils;
  14. import org.springframework.web.filter.OncePerRequestFilter;

  16. import javax.servlet.FilterChain;
  17. import javax.servlet.ServletException;
  18. import javax.servlet.http.HttpServletRequest;
  19. import javax.servlet.http.HttpServletResponse;
  20. import java.io.IOException;

  22. @Component
  23. public class PowerFilter extends OncePerRequestFilter {

  25.     @Autowired
  26.     private RedisTemplate redisTemplate;

  28.     @Override
  29.     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
  30.         String token = request.getHeader("token");
  31.         //登陆接口放行
  32.         if (!StringUtils.hasText(token)) {
  33.             System.out.println("登陆接口放行...");
  34.             filterChain.doFilter(request, response);
  35.             return;
  36.         }
  37.         String username = "";
  38.         try {//验证令牌的有效性
  39.             Claims claims = JwtUtil.parseJWT(token);
  40.             username = claims.getSubject();
  41.         } catch (Exception e) {
  42.             e.printStackTrace();
  43.             throw new RuntimeException("认证失败！");
  44.         }
  45.         //从redis中获取用户信息
  46.         Object obj = redisTemplate.boundValueOps("token:" + username).get();
  47.         if (ObjectUtils.isEmpty(obj)) {
  48.             throw new RuntimeException("认证失败！");
  49.         }

  51.         LoginUser loginUser = JSON.parseObject(obj.toString(), LoginUser.class);
  52.         //登陆的用户存储到上下文中
  53.         UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(loginUser, null, loginUser.getAuthorities());
  54.         SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
  55.         //转发到下一过滤器或者是控制器
  56.         filterChain.doFilter(request, response);
  57.     }
  58. }

filters包，第四部分开始

至此，所有工具包结束

使用方法前往：https://www.0po.cn/archives/26

上一篇： Nginx为网关等提供负载均衡+抗并发