spring boot 之 security(五) 记住我RememberMe

原理图

RememberMe在security过滤连中的位置

当RememberMe之前的所有过滤器都无法认证用户信息，则会尝试去做认证。

注意RememberMe在html页面的参数名

 记住我

配置 WebSecurityConfig

.and()
// 记住我
.rememberMe()
// 设置存储库
.tokenRepository(persistentTokenRepository())
// 设置token 失效时间
.tokenValiditySeconds(3600)
// 获取 userDetailsService 做登陆
.userDetailsService(userDetailsService)

package com.wt.cloud.config;

import com.wt.cloud.filter.ValidateCodeFilter;
import com.wt.cloud.properties.SecurityProperties;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl;
import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository;

import javax.sql.DataSource;


/**
 * 功能描述: WebSecurityConfigurerAdapter web安全应用的适配器
 * @author : big uncle
 * @date : 2019/10/10 10:26
 */
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private SecurityProperties securityProperties;

    @Autowired
    private MyAuthenticationSuccessHandle myAuthenticationSuccessHandle;
    @Autowired
    private MyAuthenticationFailureHandler myAuthenticationFailureHandler;
    // 会读取配置文件数据
    @Autowired
    private DataSource dataSource;

    @Autowired
    private UserDetailsService userDetailsService;

    @Bean
    public PersistentTokenRepository persistentTokenRepository(){
        JdbcTokenRepositoryImpl tokenRepository = new JdbcTokenRepositoryImpl();
        // 设置数据源
        tokenRepository.setDataSource(dataSource);
        // 启动的时候创建存储token的表
        tokenRepository.setCreateTableOnStartup(true);
        return tokenRepository;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // 关闭默认的basic认证拦截
//        http
//        .authorizeRequests()
//        .anyRequest()
//        .permitAll().and()
//        .logout()
//        .permitAll();
        // 让使用form表单认证
        ValidateCodeFilter validateCodeFilter = new ValidateCodeFilter();
        validateCodeFilter.setAuthenticationFailureHandler(myAuthenticationFailureHandler);
        http
                // 在 UsernamePasswordAuthenticationFilter 之前添加一个过滤器
                .addFilterBefore(validateCodeFilter, UsernamePasswordAuthenticationFilter.class)
                .formLogin()
                // 自定义登陆页面 或 controller
                .loginPage("/web/authentication")
                // 覆盖spring security默认登陆地址。默认是login
                .loginProcessingUrl("/authentication/login")
                // 配置成功处理类
                .successHandler(myAuthenticationSuccessHandle)
                // 配置失败处理类
                .failureHandler(myAuthenticationFailureHandler)
                .and()
                // 记住我
                .rememberMe()
                // 设置存储库
                .tokenRepository(persistentTokenRepository())
                 // 设置token 失效时间
                .tokenValiditySeconds(3600)
                // 获取 userDetailsService 做登陆
                .userDetailsService(userDetailsService)
                .and()
                // 以下都是授权的配置
                .authorizeRequests()
                // 剔除登陆页面的认证拦截，否则会在进登陆页面一直跳转；permitAll 指任何人都可以访问这个url
                .antMatchers(
                        "/web/authentication",
                        "/code/imageCode",
                        securityProperties.getWebProperties().getLoginPage()
                ).permitAll()
                // 任何请求
                .anyRequest()
                // 都需要身份认证
                .authenticated()
                .and()
                // 关闭跨站请求伪造拦截
                .csrf().disable();

    }
}