3， 互联网安全架构协议：

蚂蚁课堂
1，如何保证Api 接口合理安全调用

2，OAuth2.0授权认证平台设计

3，OAuth2.0 认证协议四种模式

4，oauth2.0实现对接口的调用：

Oauth2.0****模式分类

1. 授权码模式

2. 简化模式

3. 密码模式

4. 客户端模式
   Oauth2.0模式分类
   1.授权码模式
   2.简化模式
   3.密码模式
   4.客户端模式
   授权码模式

授权码模式

Maven依赖

    org.springframework.boot
    spring-boot-starter-parent
    2.2.1.RELEASE




    
    
        org.springframework.boot
        spring-boot-starter-web
    
    
        org.projectlombok
        lombok
    

    
    
        org.springframework.boot
        spring-boot-starter-freemarker
    

    spring-boot 整合security -->
    
        org.springframework.boot
        spring-boot-starter-security
    

    
    
        org.springframework.security.oauth
        spring-security-oauth2
        2.2.1.RELEASE
    


    
        io.jsonwebtoken
        jjwt
        0.6.0
    
    
        com.alibaba
        fastjson
        1.2.62
    
    
        org.apache.commons
        commons-lang3
    

相关配置的类

@Component
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.
                inMemoryAuthentication()
                .withUser("mayikt")
                .password(passwordEncoder().encode("123456"))
                .authorities("/*");


    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .anyRequest().authenticated() //所有请求都需要通过认证
                .and()
                .httpBasic() //Basic登录
                .and()
                .csrf().disable(); //关跨域保护
    }
}

@Component
@EnableAuthorizationServer
public class AuthorizationConfig extends AuthorizationServerConfigurerAdapter {
    @Autowired
    private PasswordEncoder passwordEncoder;
    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
        //允许表单提交
        security.allowFormAuthenticationForClients()
                .checkTokenAccess("permitAll()");
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
                // appid
                .withClient("mayikt")
                // appsecret
                .secret(passwordEncoder.encode("mayikt_secret"))
                // 授权码
                .authorizedGrantTypes("authorization_code")
                // 作用域
                .scopes("all")
                // 资源的id
                .resourceIds("mayikt_resource")
                // 回调地址
                .redirectUris("http://www.mayikt.com/callback");

    }
}

访问授权链接获取授权码

http://localhost:8080/oauth/authorize?client_id=mayikt&response_type=code

image.png

根据授权码获取accessToken

接口：http://localhost:8080/oauth/token
Code:授权码
grant_type:authorization_code
redirect_uri:回调地址
Scope: 作用域

http://localhost:8080/oauth/token?code=IDXeHy&grant_type=authorization_code&redirect_uri=http://www.mayikt.com/callback&scope=all
访问/oauth/token401不足

image.png

解决办法：
需要BasicAuth认证授权 传递参数clent_id、client_secret

image.png

access_token=dc9bce8a-7657-44bb-b6b6-1e4baecdfd7b

资源端服务器端
相关配置的类

/**
 * 资源Server端
 */
@Configuration
@EnableResourceServer
public class ResourceConfig extends ResourceServerConfigurerAdapter {

    @Value("${mayikt.appid}")
    private String mayiktAppId;
    @Value("${mayikt.appsecret}")
    private String mayiktAppSecret;

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Primary
    @Bean
    public RemoteTokenServices remoteTokenServices() {
        final RemoteTokenServices tokenServices = new RemoteTokenServices();
        //设置授权服务器check_token端点完整地址
        tokenServices.setCheckTokenEndpointUrl("http://localhost:8080/oauth/check_token");
        //设置客户端id与secret，注意：client_secret值不能使用passwordEncoder加密！
        tokenServices.setClientId(mayiktAppId);
        tokenServices.setClientSecret(mayiktAppSecret);
        return tokenServices;
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        //设置创建session策略
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
        //@formatter:off
        //所有请求必须授权
        http.authorizeRequests()
                .anyRequest().authenticated();
        //@formatter:on
    }

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) {
        resources.resourceId("mayikt_resource").stateless(true);
    }
}

@RestController
public class MemberService {
    @GetMapping("/getMember")
    public String getMember() {
        return "我是会员服务接口";
    }
}

基于令牌访问接口

127.0.0.1:8081/getMember 访问该接口

image.png

或者直接在请求中传递

Authorization=Bearer a9011867-236b-4751-a508-48ceed63bffc

设计综合oatuh api接口

1.获取access_token请求（/oauth/token）

http://localhost:8080/oauth/token?code=IDXeHy&grant_type=authorization_code&redirect_uri=http://www.mayikt.com/callback&scope=all

2.检查头肯是否有效请求（/oauth/check_token）

http://localhost:8080/oauth/check_token?token=ea2c1b1e-5541-4018-8728-07f1ac87e9e8

3.刷新token

http://localhost:8080/oauth/token?grant_type=refresh_token&refresh_token=fbde81ee-f419-42b1-1234-9191f1f95be9&client_id=demoClientId&client_secret=demoClientSecret

image.png

image.png