spring security+jwt实现认证授权
执行流程
用户登录，根据url跳转到spring security内置好的UserDetailService中进行认证，最后会把返回的authentication放入到securityContext中，然后会调用认证成功的AuthenticationSuccessHandler，这里面会从authentication中获取用户对象，然后把这个对象转换成一个vo对象(这里随自己的喜好而定，主要目的是返回一个jwt，此jwt无论是后端还是前端封装，最后都会把他放入到以后的请求头或者请求体中)，并返回给前端，然后用户每次携带这个jwt进行访问时，首先会经过自定义的一个过滤器，他的目的是从request中解析出jwt(无论有没有jwt，都会放行进入下一个filter)，然后通过这个jwt解析出一个唯一的标识(我这里使用的是uuid，以这个uuid作为主键，存放此用户的权限和过期时间等信息)，然后通过uuid查询数据库，redis或者session获取这个用户的信息和权限，并把它封装到UsernamePasswordAuthenticationToken中，然后把这个对象放入securityContext中，调用其他过滤器，最后会走到controller中，判断接口是否有@PreAuthorize注解，若有则会取出authentication中的权限进行比较(这都是spring security自己内部做的)，若判断此用户有此权限则会调用方法，若没有则会返回没有权限
代码
首先自定义securityConfig继承WebSecurityConfigureAdapter，注意的是上面要加注解@EnableGlobalMethodSecurity(prePostEnabled = true)
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private AuthenticationSuccessHandler authenticationSuccessHandler;
@Autowired
private AuthenticationFailureHandler authenticationFailureHandler;
@Autowired
private LogoutSuccessHandler logoutSuccessHandler;
@Autowired
private AuthenticationEntryPoint authenticationEntryPoint;
@Autowired
private UserDetailServiceImpl userDetailService;
@Autowired
private TokenFilter tokenFilter;
@Bean
public BCryptPasswordEncoder bCryptPasswordEncoder() {
return new BCryptPasswordEncoder();
}
//自定义userDetailsService，并放入到security中
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailService).passwordEncoder(bCryptPasswordEncoder());
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()
.antMatchers("/", "/*.html", "/favicon.ico", "/css/**", "/js/**", "/fonts/**", "/layui/**", "/img/**",
"/v2/api-docs/**", "/swagger-resources/**", "/webjars/**", "/pages/**", "/druid/**",
"/statics/**").permitAll()
.anyRequest().authenticated()
.and()
.formLogin().loginProcessingUrl("/login")
.successHandler(authenticationSuccessHandler)
.failureHandler(authenticationFailureHandler)
.and()
.exceptionHandling()
.authenticationEntryPoint(authenticationEntryPoint)
.and()
.logout().logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler)
.and()
.addFilterBefore(tokenFilter, UsernamePasswordAuthenticationFilter.class);
}
}
然后把所有的登录成功，登录失败，游客，退出登录成功的处理器整合在一个类中
@Configuration
public class SecurityHandlerConfig {
@Autowired
private TokenService tokenService;
//登录认证成功返回token
@Bean
public AuthenticationSuccessHandler authenticationSuccessHandler() {
return new AuthenticationSuccessHandler() {
@Override
public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {
//这里之前已经调用过loaduserbyusername方法，security把loginuser封装成authentication，这里从authentication中获取loginuser
LoginUser loginUser = (LoginUser) authentication.getPrincipal();
//然后通过这个loginuser的信息，进行一些列的操作创建一个存有jwt的vo对象
Token token = tokenService.saveToken(loginUser);
ResponseUtil.responseJson(httpServletResponse, HttpStatus.OK.value(), token);
}
};
}
//登录失败
@Bean
public AuthenticationFailureHandler authenticationFailureHandler() {
return new AuthenticationFailureHandler() {
@Override
public void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {
String msg = e.getMessage();
ResponseUtil.responseJson(httpServletResponse, HttpStatus.UNAUTHORIZED.value(), new ResponseInfo(HttpStatus.UNAUTHORIZED.value()+"",msg));
}
};
}
//未登录，用来解决匿名用户访问无权限资源时的异常
@Bean
public AuthenticationEntryPoint authenticationEntryPoint() {
return new AuthenticationEntryPoint() {
@Override
public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {
ResponseUtil.responseJson(httpServletResponse, HttpStatus.UNAUTHORIZED.value(), new ResponseInfo(HttpStatus.UNAUTHORIZED.value()+"", "请先登录"));
}
};
}
//退出处理
@Bean
public LogoutSuccessHandler logoutSuccessHandler() {
return new LogoutSuccessHandler() {
@Override
public void onLogoutSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {
ResponseInfo info = new ResponseInfo(HttpStatus.OK.value() + "", "退出成功");
String token = TokenUtils.getToken(httpServletRequest);
tokenService.deleteToken(token);
ResponseUtil.responseJson(httpServletResponse, HttpStatus.OK.value(), info);
}
};
}
}
之后是security经典的UserDetailService
首先定义User类，对应数据库的User表，然后定义一个LoginUser实现UserDetail对象，尤其实现getAuthorities方法
@Data
public class SysUser extends BaseEntity<Long> {
private static final long serialVersionUID = -6525908145032868837L;
private String username;
private String password;
private String nickname;
private String headImgUrl;
private String phone;
private String telephone;
private String email;
@JsonFormat(pattern = "yyyy-MM-dd")
private Date birthday;
private Integer sex;
private Integer status;
private String intro;
}
public class LoginUser extends SysUser implements UserDetails {
private static final long serialVersionUID = -1379274258881257107L;
private List<Permission> permissions;
private String token;
/** 登陆时间戳（毫秒） */
private Long loginTime;
/** 过期时间戳 */
private Long expireTime;
public List<Permission> getPermissions() {
return permissions;
}
public void setPermissions(List<Permission> permissions) {
this.permissions = permissions;
}
public String getToken() {
return token;
}
public void setToken(String token) {
this.token = token;
}
@Override
@JsonIgnore
public Collection<? extends GrantedAuthority> getAuthorities() {
return permissions.parallelStream().filter(p -> !StringUtils.isEmpty(p.getPermission()))
.map(p -> new SimpleGrantedAuthority(p.getPermission())).collect(Collectors.toSet());
}
public void setAuthorities(Collection<? extends GrantedAuthority> authorities) {
// do nothing
}
// 账户是否未过期
@JsonIgnore
@Override
public boolean isAccountNonExpired() {
return true;
}
// 账户是否未锁定
@JsonIgnore
@Override
public boolean isAccountNonLocked() {
return getStatus() != Status.LOCKED;
}
// 密码是否未过期
@JsonIgnore
@Override
public boolean isCredentialsNonExpired() {
return true;
}
// 账户是否激活
@JsonIgnore
@Override
public boolean isEnabled() {
return true;
}
public Long getLoginTime() {
return loginTime;
}
public void setLoginTime(Long loginTime) {
this.loginTime = loginTime;
}
public Long getExpireTime() {
return expireTime;
}
public void setExpireTime(Long expireTime) {
this.expireTime = expireTime;
}
}
然后是UserDetailServiceImpl实现UserDetailService实现loadUserByUsername方法
@Service
public class UserDetailServiceImpl implements UserDetailsService {
@Autowired
private UserService userService;
@Autowired
private PermissionDao permissionDao;
//逻辑为获取用户表sysuser和permission，并把他们封装成loginuser，之后会调用认证成功的方法
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
SysUser sysUser = userService.getUser(username);
if (ObjectUtils.isEmpty(sysUser)) {
throw new AuthenticationCredentialsNotFoundException("用户名不存在");
} else if (sysUser.getStatus() == SysUser.Status.LOCKED) {
throw new LockedException("用户被锁定，请联系管理员");
} else if (sysUser.getStatus() == SysUser.Status.DISABLED) {
throw new DisabledException("用户已作废");
}
LoginUser loginUser = new LoginUser();
BeanUtils.copyProperties(sysUser, loginUser);
List<Permission> permissions = permissionDao.listByUserId(sysUser.getId());
loginUser.setPermissions(permissions);
return loginUser;
}
}
sql就不贴了，烂大街
此时security已经把获取的loginUser封装成authentication，并把他放入到securityContext中了，已经执行到登录成功的处理器方法中，他会通过获取的loginUser保存到数据库，并生成jwt
@Service
public class TokenServiceImpl implements TokenService {
/**
* token过期秒数
*/
@Value("${token.expire.seconds}")
private Integer expireSeconds;
/**
* 私钥
*/
@Value("${token.jwtSecret}")
private String jwtSecret;
private static Key KEY = null;
private static final String LOGIN_USER_KEY = "LOGIN_USER_KEY";
@Autowired
private TokenDao tokenDao;
// 首先是通过随机生成的uuid，存储到loginUser中的token属性中，然后把uuid存放到token的id字段中，最后把uuid封装成jwt返回给前端，
// 每次请求前端会携带这个jwt经过tokenFilter过滤，而后端获取到jwt之后，对jwt进行解码获取uuid，然后查询数据库获取这个用户的val也就是此用户的LoginUser
@Override
public Token saveToken(LoginUser loginUser) {
//设置loginUser的属性，，保存一个通过uuid为主键的对象，并通过uuid生成jwt
loginUser.setToken(UUID.randomUUID().toString());
loginUser.setLoginTime(System.currentTimeMillis());
loginUser.setExpireTime(loginUser.getLoginTime() + expireSeconds * 1000);
//把用户的token和用户的信息存放到数据库中
TokenDB tokenDB = new TokenDB();
tokenDB.setId(loginUser.getToken());
tokenDB.setCreateTime(new Date());
tokenDB.setUpdateTime(new Date());
tokenDB.setExpireTime(new Date());
tokenDB.setVal(JSONObject.toJSONString(loginUser));
tokenDao.save(tokenDB);
String jwtToken = createJWTToken(loginUser);
//最后返回一个带有jwt的vo
return new Token(jwtToken, loginUser.getLoginTime());
}
// 用于用户退出
@Override
public boolean deleteToken(String token) {
String uuid = this.getUUIDFromJWT(token);
if (!StringUtils.isEmpty(uuid)) {
TokenDB tokenDB = tokenDao.getById(uuid);
LoginUser loginUser = this.toLoginUser(tokenDB);
if (!ObjectUtils.isEmpty(loginUser)) {
tokenDao.delete(uuid);
return true;
}
}
return false;
}
// 当用户的token快过期的时候，会通过此方法刷新过期时间
@Override
public void refresh(LoginUser loginUser) {
loginUser.setLoginTime(System.currentTimeMillis());
loginUser.setExpireTime(loginUser.getLoginTime() + expireSeconds * 1000);
TokenDB tokenDB = tokenDao.getById(loginUser.getToken());
tokenDB.setExpireTime(new Date());
tokenDB.setUpdateTime(new Date());
tokenDB.setVal(JSONObject.toJSONString(loginUser));
tokenDao.update(tokenDB);
}
// 从tokenDB中获取loginUser
@Override
public LoginUser getLoginUser(String token) {
String uuid = getUUIDFromJWT(token);
if (!StringUtils.isEmpty(uuid)) {
TokenDB tokenDB = tokenDao.getById(uuid);
return this.toLoginUser(tokenDB);
}
return null;
}
//通过从数据库中的token表中获取的用户的val并转换成loginUser
private LoginUser toLoginUser(TokenDB tokenDB) {
if ((!ObjectUtils.isEmpty(tokenDB)) && tokenDB.getExpireTime().getTime() > System.currentTimeMillis()) {
return JSONObject.parseObject(tokenDB.getVal(), LoginUser.class);
}
return null;
}
/**
* 生成jwt
* 也就是把uuid生成的token进行加密
*
* @param loginUser
* @return
*/
private String createJWTToken(LoginUser loginUser) {
Map<String, Object> claims = new HashMap<>();
claims.put(LOGIN_USER_KEY, loginUser.getToken());// 放入一个随机字符串，通过该串可找到登陆用户
String jwtToken = Jwts.builder().setClaims(claims).signWith(SignatureAlgorithm.HS256, getKeyInstance())
.compact();
return jwtToken;
}
private Key getKeyInstance() {
if (KEY == null) {
synchronized (TokenServiceImpl.class) {
if (KEY == null) {// 双重锁
byte[] apiKeySecretBytes = DatatypeConverter.parseBase64Binary(jwtSecret);
KEY = new SecretKeySpec(apiKeySecretBytes, SignatureAlgorithm.HS256.getJcaName());
}
}
}
return KEY;
}
private String getUUIDFromJWT(String jwt) {
if ("null".equals(jwt) || StringUtils.isEmpty(jwt)) {
return null;
}
Map<String, Object> jwtClaims = null;
try {
jwtClaims = Jwts.parser().setSigningKey(getKeyInstance()).parseClaimsJws(jwt).getBody();
return MapUtils.getString(jwtClaims, LOGIN_USER_KEY);
} catch (ExpiredJwtException e) {
System.out.println(jwt+"已过期");
} catch (Exception e) {
System.out.println(e.getMessage());
}
return null;
}
}
public class Token implements Serializable {
private static final long serialVersionUID = 6314027741784310221L;
private String token;
/** 登陆时间戳（毫秒） */
private Long loginTime;
public Token(String token, Long loginTime) {
super();
this.token = token;
this.loginTime = loginTime;
}
public String getToken() {
return token;
}
public void setToken(String token) {
this.token = token;
}
public Long getLoginTime() {
return loginTime;
}
public void setLoginTime(Long loginTime) {
this.loginTime = loginTime;
}
}
@Data
public class TokenDB extends BaseEntity<String> {
private static final long serialVersionUID = 4566334160572911795L;
/**
* 过期时间
*/
private Date expireTime;
/**
* LoginUser的json串
*/
private String val;
}
工具类啥的不贴了
@RestController
@RequestMapping("/users")
public class UserController {
@Autowired
private UserService userService;
@GetMapping("/hello")
@PreAuthorize("hasAuthority('sys:user:hello')")
public String hello() {
return "hello security";
}
@GetMapping("/current")
public SysUser currentUser() {
return UserUtil.getLoginUser();
}
@GetMapping("/{id}")
@PreAuthorize("hasAuthority('sys:user:query')")
public SysUser user(@PathVariable Long id) {
return userService.getById(id);
}
}