Spring Security 访问控制-实现 RESTful API

要想实现 Spring Security 返回 JSON 格式串，只需重写以下几个处理器（JavaConfig）

• http.exceptionHandling().accessDeniedHandler()
• http.exceptionHandling().authenticationEntryPoint()
• http.formLogin().successHandler()
• http.formLogin().failureHandler()
• http.logout().logoutSuccessHandler()

最终实现的效果为：

//登录失败(账号不存在)
{"code":1,"message":"User is disabled"}
//登录失败(密码错误)
{"code":1,"message":"Bad credentials"}

//登录成功
{"code":0,"message":"登录成功"}

//访问拒绝
{"code":1,"message":"Access is denied"}

//注销成功
{"code":0,"message":"已注销"}

//未经授权就访问资源
{"code":1,"message":"Full authentication is required to access this resource"}

（1）build.gradle 添加项目依赖

compile 'org.springframework.security:spring-security-web:4.2.3.RELEASE'
compile group: 'org.springframework.security', name: 'spring-security-config', version: '4.2.3.RELEASE'

（2）访问控制配置（JavaConfig）：SecurityConfigurer《Filter, WebSecurity> 是 WebSecurityConfigurerAdapter 的父类，Spring Security 会在容器内寻找上述接口的实现类 Bean，因此只要我们新建一个派生类继承 WebSecurityConfigurerAdapter 并注入容器内，就能被自动配置（经由被重写的模板方法）

@Configuration
@Import(RootConfig.class)
public class GoWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

    //......

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .exceptionHandling()
                    .accessDeniedHandler(new GoAccessDeniedHandler())
                    .authenticationEntryPoint(new GoAuthenticationEntryPoint())
                .and().authorizeRequests()
                    .antMatchers("/", "/csrf").permitAll()
                    .antMatchers("/hello").hasAuthority("ADMIN")
                    .anyRequest().authenticated()
                .and().formLogin()
                    .loginProcessingUrl("/login").permitAll()
                    .successHandler(new GoAuthenticationSuccessHandler())
                    .failureHandler(new GoAuthenticationFailureHandler())
                .and().logout()
                    .logoutUrl("/logout")
                    .logoutSuccessHandler(new GoLogoutSuccessHandler())
                    .invalidateHttpSession(true)
                    .deleteCookies("JSESSIONID")
                .and().requiresChannel()
                    .antMatchers("/pomer").requiresSecure()
                    .anyRequest().requiresInsecure()
                .and().rememberMe()
                    .tokenValiditySeconds(1800)
                    .key("token_key");
    }
}

GoAccessDeniedHandler

public class GoAccessDeniedHandler implements AccessDeniedHandler {

    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response,
                       AccessDeniedException exception) throws IOException, ServletException {
        response.setHeader("Content-Type", "application/json;charset=utf-8");
        response.getWriter().print("{\"code\":1,\"message\":\""+exception.getMessage()+"\"}");
        response.getWriter().flush();
    }
}

GoAuthenticationEntryPoint

public class GoAuthenticationEntryPoint implements AuthenticationEntryPoint {

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response,
                         AuthenticationException exception) throws IOException, ServletException {
        response.setHeader("Content-Type", "application/json;charset=utf-8");
        response.getWriter().print("{\"code\":1,\"message\":\""+exception.getMessage()+"\"}");
        response.getWriter().flush();
    }
}

GoAuthenticationFailureHandler

public class GoAuthenticationFailureHandler implements AuthenticationFailureHandler {

    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
                                        AuthenticationException exception) throws IOException, ServletException {
        response.setHeader("Content-Type", "application/json;charset=utf-8");
        response.getWriter().print("{\"code\":1,\"message\":\""+exception.getMessage()+"\"}");
        response.getWriter().flush();
    }
}

GoAuthenticationSuccessHandler

public class GoAuthenticationSuccessHandler implements AuthenticationSuccessHandler {

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
                                        Authentication authentication) throws IOException, ServletException {
        response.setHeader("Content-Type", "application/json;charset=utf-8");
        response.getWriter().print("{\"code\":0,\"message\":\"登录成功\"}");
        response.getWriter().flush();
    }
}

GoLogoutSuccessHandler

public class GoLogoutSuccessHandler implements LogoutSuccessHandler {

    @Override
    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response,
                                Authentication authentication) throws IOException, ServletException {
        response.setHeader("Content-Type", "application/json;charset=utf-8");
        response.getWriter().print("{\"code\":0,\"message\":\"已注销\"}");
        response.getWriter().flush();
    }
}