爆破专栏丨SpringSecurity系列之前后端分离时的安全处理方案

/**
 * 处理登录成功时的业务逻辑
 */
public class SecurityAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {
    /**
     * Authentication:携带登录的用户名及角色等信息
     */
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws ServletException, IOException {
        //直接输出json格式的响应信息
        Object principal = authentication.getPrincipal();
        response.setContentType("application/json;charset=utf-8");
        PrintWriter out = response.getWriter();
        //以json格式对外输出身份信息
        out.write(new ObjectMapper().writeValueAsString(principal));
        out.flush();
        out.close();
    }
}

/**
 * @Author: 一一哥
 * @Blame: yyg
 * @Since: Created in 2021/4/14
 *
 * 前后端分离时处理json响应信息
 */
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
                http.authorizeRequests()
                .anyRequest()
                .authenticated()
                .and()
                .formLogin()
                .permitAll()
                //认证成功时的处理器
                .successHandler(new SecurityAuthenticationSuccessHandler())
                .and()
                .csrf()
                .disable();
    }
}

/**
 * 处理登录失败时的业务逻辑
 */
public class SecurityAuthenticationFailureHandler extends ExceptionMappingAuthenticationFailureHandler {
    /**
     * AuthenticationException:异常信息
     */
    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException e) throws IOException, ServletException {
        //直接输出json格式的响应信息
        response.setContentType("application/json;charset=utf-8");
        PrintWriter out = response.getWriter();
        out.write(e.getMessage());
        out.flush();
        out.close();
    }
}

3. 配置failureHandler

接着我们在SecurityConfig配置类中，调用failureHandler()方法来关联上面定义的SecurityAuthenticationFailureHandler类对象。

核心代码如下:

/**
 * @Author: 一一哥
 * @Blame: yyg
 * @Since: Created in 2021/5/26
 *
 * 处理退出登录时的响应信息
 */
public class SecurityLogoutSuccessHandler implements LogoutSuccessHandler {
    @Override
    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        response.setContentType("application/json;charset=utf-8");
        PrintWriter out = response.getWriter();
        out.write("注销成功");
        out.flush();
        out.close();
    }
}

/**
 * @Author: 一一哥
 * @Blame: yyg
 * @Since: Created in 2021/5/26
 *
 * 处理退出登录时的响应信息
 */
public class SecurityLogoutSuccessHandler implements LogoutSuccessHandler {
    @Override
    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        response.setContentType("application/json;charset=utf-8");
        PrintWriter out = response.getWriter();
        out.write("注销成功");
        out.flush();
        out.close();
    }
}

/**
 * @Author: 一一哥
 * @Blame: yyg
 * @Since: Created in 2021/5/26
 *
 * 处理未登录认证时的响应信息
 */
public class SecurityAuthenticationEntryPoint implements AuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
        response.setContentType("application/json;charset=utf-8");
        PrintWriter out = response.getWriter();
        out.write("尚未登录，请先登录");
        out.flush();
        out.close();
    }
}

/**
 * @Author: 一一哥
 * @Blame: yyg
 * @Since: Created in 2021/4/14
 *
 * 前后端分离时处理json响应信息
 */
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
                http.authorizeRequests()
                .anyRequest()
                .authenticated()
                .and()
                .formLogin()
                .permitAll()
                //认证成功时的处理器
                .successHandler(new SecurityAuthenticationSuccessHandler())
                //认证失败时的处理器
                .failureHandler(new SecurityAuthenticationFailureHandler())
                .and()
                .logout()
                //退出登录时的处理器
                .logoutSuccessHandler(new SecurityLogoutSuccessHandler())
                .and()
                .csrf()
                .disable();
    }
}

4. 验证结果

配置完成后，我们在未登录时，直接去访问项目中的某个接口，就会看到未登录时返回的JSON信息，如下图所示:

关注公众号，回复【SS】获取专栏大纲脑图