渐进式学习springbootsecurity

1.装箱即用的spring security

加入依赖&＃xff0c;加个配置即可——应用场景&＃xff1a;eureka server,hystrix dashboard,springboot admin等&＃xff0c;用于增加登录验证&＃xff08;基于COOKIE&＃xff1a;jssessionId实现用户session的&＃xff0c;不能用postman等工具来测试&＃xff09;。该应用场景效果基本nginx配置账号密码验证差不多

org.springframework.bootspring-boot-starter-security

spring:security:user:name: jwolfpassword: 123456

2.追加几个内存用户并配置其访问权限


import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;&＃64;EnableWebSecurity
public class MemoryUserSecurityConfig extends WebSecurityConfigurerAdapter {//用户认证&＃64;Overrideprotected void configure(AuthenticationManagerBuilder auth) throws Exception {//内存里面初始化几个用户auth.inMemoryAuthentication().passwordEncoder(new MyPasswordEncoder())//添加用户&＃xff0c;密码&＃xff0c;角色.withUser("zs").password("123456").roles("AAA")//链式编程.and().withUser("ls").password("123456").roles("BBB").and().withUser("ww").password("123456").roles("CCC", "primary").authorities("PPP");//PPP权限}//用户授权 ant风格的path&＃64;Overrideprotected void configure(HttpSecurity http) throws Exception {http.authorizeRequests().antMatchers("/").permitAll() //应用首页所以用户都可以访问&＃xff0c;完全无限制.antMatchers("/test-user/addUs*").hasRole("BBB") // 允许 AAA 角色访问.antMatchers("/test-user/deleteUser/**").hasAnyAuthority("PPP") //允许有"PPP"权限的访问.antMatchers("/test-user/updateUser").hasAnyRole("AAA", "BBB", "CCC").antMatchers("/test-user/findAllUsers").permitAll().anyRequest().authenticated() //其它path都有登录才能访问.and().formLogin();//指定支持基于表单的身份验证&＃xff0c;会暴露出/login /logout等端点,默认登录成功调向登录前的,可以自定义登录页面登录成功和失败重定向的url,例如.formLogin().loginPage("/myLogin").successForwardUrl("/xxxx").failureForwardUrl("/yyy")}private class MyPasswordEncoder implements org.springframework.security.crypto.password.PasswordEncoder {&＃64;Overridepublic String encode(CharSequence charSequence) {return charSequence.toString(); //用户输入密码处理}&＃64;Overridepublic boolean matches(CharSequence charSequence, String s) {return s.equals(charSequence.toString());//与security上下文存储的用户密码比对}}
}

&＃64;RestController
&＃64;RequestMapping("/test-user")
public class TestUserController {&＃64;RequestMapping("/addUser")String addUser() {return "这是添加用户&＃xff01;&＃xff01;&＃xff01;";}&＃64;RequestMapping("/deleteUser")String deleteUser() {return "这是删除用户&＃xff01;&＃xff01;&＃xff01;";}&＃64;RequestMapping("/updateUser")String updateUser() {return "这是修改用户&＃xff01;&＃xff01;&＃xff01;";}&＃64;RequestMapping("/findAllUsers")String findAllUsers() {return "这是查询用户&＃xff01;&＃xff01;&＃xff01;";}
}

3.从DB获取用户信息进行权限控制

 配置类主要注入bean UserDetailsService

&＃64;Configuration
public class DBUserSecurityConfig extends WebSecurityConfigurerAdapter {&＃64;Autowiredprivate UserDetailsService userDetailsService;//这里从数据库中读取数据到spring security上下文&＃64;Overrideprotected void configure(AuthenticationManagerBuilder auth) throws Exception {auth.userDetailsService(userDetailsService).passwordEncoder(getPasswordEncoder());}//用户授权 ant风格的path&＃64;Overrideprotected void configure(HttpSecurity http) throws Exception {http.authorizeRequests().antMatchers("/").permitAll() //应用首页所以用户都可以访问&＃xff0c;完全无限制.antMatchers("/test-user/addUs*").hasRole("BBB") // 允许 AAA 角色访问.antMatchers("/test-user/deleteUser/**").hasAnyAuthority("PPP") //允许有"PPP"权限的访问.antMatchers("/test-user/updateUser").hasAnyRole("AAA", "BBB", "CCC").antMatchers("/test-user/findAllUsers").permitAll().anyRequest().authenticated() //其它path都有登录才能访问.and().formLogin();//指定支持基于表单的身份验证&＃xff0c;会暴露出/login /logout等端点}&＃64;Beanpublic PasswordEncoder getPasswordEncoder(){return new PasswordEncoder() {&＃64;Overridepublic String encode(CharSequence password) {return password.toString();}&＃64;Overridepublic boolean matches(CharSequence rawPassword, String encodedPassword) {String encodeStr &＃61; encode(rawPassword);return encodedPassword.equalsIgnoreCase(encodeStr);}};}
}

需要实现spring security的 UserDetailsService 接口&＃xff0c;下面基本就是常规的业务类型代码了&＃xff0c;这里注入的UserMapper

&＃64;Service
public class SecurityUserServiceImpl implements UserDetailsService {&＃64;Autowiredprivate UserMapper userMapper;&＃64;Overridepublic UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {SecurityUser user &＃61; userMapper.selectByUsername(username);if (user &＃61;&＃61; null) {throw new BadCredentialsException("用户名或密码错误");}return user;}
}


entity是这样的&＃xff0c;需要实现spring secury的UserDetails

import lombok.Getter;
import lombok.Setter;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import java.util.Collection;
import java.util.List;
&＃64;Getter
&＃64;Setter
public class SecurityUser implements UserDetails {private static final long serialVersionUID&＃61;1L;private long id;private String password;private String username;private List anthorities;&＃64;Overridepublic Collection getAuthorities() {return this.anthorities;}//账户是否未过期&＃64;Overridepublic boolean isAccountNonExpired() {return true;}//账户是否未锁定&＃64;Overridepublic boolean isAccountNonLocked() {return true;}//帐户密码是否未过期&＃xff0c;一般有的密码要求性高的系统会使用到&＃xff0c;比较每隔一段时间就要求用户重置密码&＃64;Overridepublic boolean isCredentialsNonExpired() {return true;}//账户是否可用&＃64;Overridepublic boolean isEnabled() {return true;}
}


userMapper.xml是这样的

select a.id,a.username,a.password,b.rolename from t_user a left join t_role b on a.role_id&＃61;b.idwhere a.username&＃61;#{username}

4.关于role 与authority区别及权限注解的开启

使用权限注解需要启动类开启&＃xff0c;该注解有几个参数&＃xff0c;默认都是关的&＃64;EnableGlobalMethodSecurity(prePostEnabled &＃61; true)&＃xff0c;&＃64;DenyAll &＃64;RolesAllowed({"USER", "ADMIN"}) &＃64;PermitAll 等开关需要通过jsr250Enabled &＃61; true来开启&＃64;EnableGlobalMethodSecurity(prePostEnabled &＃61; true,jsr250Enabled &＃61; true)


核心配置类DBUserSecurityConfig的.antMatchers("/test-user/deleteUser/**").hasAnyAuthority("PPP") 改为权限配置应该是接口使用注解&＃64;PreAuthorize("hasAnyAuthority(&＃39;PPP&＃39;)"),如果数据存的rolename为ROLE_XXX&＃xff0c;或存入SimpleGrantedAuthority的rolename有ROLE_前缀&＃xff0c;就应该使用&＃64;PreAuthorize("hasAnyRole(&＃39;PPP&＃39;)")&＃xff0c;role与authority区别参考https://www.cnblogs.com/Rocky_/p/11799772.html

5.整合JWT

增加jwt依赖

io.jsonwebtokenjjwt0.9.0


原生的security认证信息通过COOKIE-session保存会话session&＃xff0c;用户客户端或服务端重启都会导致重新登录&＃xff0c;多数情况需要整合jwt,这里较step3多了两个filter&＃xff0c;一个用于登录成功将jwt token写到浏览器&＃xff0c;一个用于访问资源时解析jwt token放入到security 认证上下文&＃xff0c;免密加密用的security亲生的BCryptPasswordEncoder


import org.apache.commons.codec.digest.Md5Crypt;
import org.apache.ibatis.javassist.bytecode.ByteArray;
import org.apache.tomcat.util.security.MD5Encoder;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import sun.security.provider.MD5;import java.util.ArrayList;
import java.util.Collection;&＃64;Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {&＃64;Autowiredprivate UserDetailsService userDetailsService;&＃64;Overridepublic void configure(AuthenticationManagerBuilder auth) throws Exception {auth.userDetailsService(userDetailsService).passwordEncoder(getPasswordEncoder());}&＃64;Overrideprotected void configure(HttpSecurity http) throws Exception {http.authorizeRequests().antMatchers("/").permitAll() //应用首页所以用户都可以访问&＃xff0c;完全无限制.antMatchers("/test-user/addUs*").hasRole("BBB") // 允许 AAA 角色访问//.antMatchers("/test-user/deleteUser/**").hasAnyAuthority("PPP") //允许有"PPP"权限的访问.antMatchers("/test-user/updateUser").hasAnyRole("AAA", "BBB", "CCC").antMatchers("/test-user/findAllUsers").permitAll().anyRequest().authenticated() //其它path都有登录才能访问.and().csrf().disable().formLogin()//指定支持基于表单的身份验证&＃xff0c;会暴露出/login /logout等端点.and().addFilter(new JWTLoginFilter(authenticationManager())).addFilter(new JWTAuthenticationFilter(authenticationManager()));}&＃64;Beanpublic PasswordEncoder getPasswordEncoder() {return new PasswordEncoder() {&＃64;Overridepublic String encode(CharSequence password) {//用户注册调用该方法进行密码加密// BCryptPasswordEncoder对相同字符串每次加密都结果都不一样&＃xff0c;但matches()时都能比较成功&＃xff0c;具有更高安全性return new BCryptPasswordEncoder().encode(password);}&＃64;Overridepublic boolean matches(CharSequence rawPassword, String encodedPassword) {//用户登录将用户表单传入的rawPassword与数据库的密码比对。return new BCryptPasswordEncoder().matches(rawPassword,encodedPassword);}};}}

两个过滤器

import com.alibaba.fastjson.JSON;
import com.construn.vehicle.common.base.entity.ResultEntity;
import com.construn.vehicle.user.entity.SecurityUser;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;import javax.servlet.FilterChain;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;
import java.util.Date;
import java.util.stream.Collectors;/*** 验证用户名密码正确后&＃xff0c;生成一个token&＃xff0c;并将token返回给客户端* 该类继承自UsernamePasswordAuthenticationFilter&＃xff0c;重写了其中的2个方法 ,* attemptAuthentication&＃xff1a;接收并解析用户凭证。* successfulAuthentication&＃xff1a;用户成功登录后&＃xff0c;这个方法会被调用&＃xff0c;我们在这个方法里生成token并返回。*/
public class JWTLoginFilter extends UsernamePasswordAuthenticationFilter {private AuthenticationManager authenticationManager;public JWTLoginFilter(AuthenticationManager authenticationManager) {this.authenticationManager &＃61; authenticationManager;}&＃64;Overridepublic Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)throws AuthenticationException {String username &＃61; request.getParameter("username");String password &＃61; request.getParameter("password");return authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password, null));}&＃64;Overrideprotected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication auth) {Claims claims &＃61; Jwts.claims();SecurityUser user &＃61; (SecurityUser) auth.getPrincipal();claims.put("userId", user.getId());claims.put("role", auth.getAuthorities().stream().map(s -> s.getAuthority()).collect(Collectors.toList()));String token &＃61; Jwts.builder().setClaims(claims).setSubject(auth.getName()).setExpiration(new Date(System.currentTimeMillis() &＃43; 600 * 1000)).signWith(SignatureAlgorithm.HS512, "jwolf").compact();response.setCharacterEncoding("UTF-8");response.setContentType("application/json; charset&＃61;utf-8");ResultEntity result &＃61; ResultEntity.success(token, "登录成功");PrintWriter out;try {out &＃61; response.getWriter();out.print(JSON.toJSONString(result));out.flush();out.close();} catch (IOException e) {e.printStackTrace();}}
}

import java.io.IOException;
import java.util.List;
import java.util.stream.Collectors;import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;public class JWTAuthenticationFilter extends BasicAuthenticationFilter {public JWTAuthenticationFilter(AuthenticationManager authenticationManager) {super(authenticationManager);}/*** 从request中获取token并解析&＃xff0c;拿到用户信息&＃xff0c;放置到SecurityContextHolder&＃xff0c;这样便完成了springsecurity和jwt的整合。*/&＃64;Overrideprotected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)throws IOException, ServletException {String token &＃61; request.getHeader("Authorization");if (token &＃61;&＃61; null || !token.startsWith("Bearer ")) {chain.doFilter(request, response);return;}Claims claims &＃61; Jwts.parser().setSigningKey("jwolf").parseClaimsJws(token.replace("Bearer ", "")).getBody();List roles &＃61; claims.get("role", List.class);List auth &＃61; roles.stream().map(s -> new SimpleGrantedAuthority(s)).collect(Collectors.toList());//如果controller还需要userId等信息其它更多信息&＃xff0c;可以第一个参数传入甚至整个claims&＃xff0c;最好不要再次从header里获取token二次解析出用户信息&＃xff0c;//然后在controller直接SecurityContextHolder.getContext().getAuthentication()获取;UsernamePasswordAuthenticationToken authentication &＃61;new UsernamePasswordAuthenticationToken( claims.getSubject(), null, auth);SecurityContextHolder.getContext().setAuthentication(authentication);chain.doFilter(request, response);}}

其中登录过滤器可以优化&＃xff0c;抽出JWT工具类&＃xff0c;并可以不用该过滤器&＃xff0c;使用登录成功处理器AuthenticationSuccessHandler进行替换&＃xff0c;登录失败及登陆security也提供了类似的接口可以自己实现然后在security核心配置即可如登录成功: .successHandler(userLoginSuccessHandler)  参考https://www.tuicool.com/articles/Q7fU73E