建站
咨詢
售后
建站咨詢
新聞中心
這里有您想知道的互聯(lián)網(wǎng)營銷解決方案
實戰(zhàn)篇：Security+JWT組合拳
Good morning, everyone!
之前我們已經(jīng)說過用Shiro和JWT來實現(xiàn)身份認證和用戶授權(quán)，今天我們再來說一下「Security和JWT」的組合拳。
簡介
先贅述一下身份認證和用戶授權(quán)：
用戶認證(Authentication)：系統(tǒng)通過校驗用戶提供的用戶名和密碼來驗證該用戶是否為系統(tǒng)中的合法主體，即是否可以訪問該系統(tǒng);
用戶授權(quán)(Authorization)：系統(tǒng)為用戶分配不同的角色，以獲取對應的權(quán)限，即驗證該用戶是否有權(quán)限執(zhí)行該操作;
Web應用的安全性包括用戶認證和用戶授權(quán)兩個部分，而Spring Security(以下簡稱Security)基于Spring框架，正好可以完整解決該問題。
它的真正強大之處在于它可以輕松擴展以滿足自定義要求。
原理
Security可以看做是由一組filter過濾器鏈組成的權(quán)限認證。它的整個工作流程如下所示：
圖中綠色認證方式是可以配置的，橘黃色和藍色的位置不可更改：
- FilterSecurityInterceptor：最后的過濾器，它會決定當前的請求可不可以訪問Controller
- ExceptionTranslationFilter：異常過濾器，接收到異常消息時會引導用戶進行認證;
實戰(zhàn)
項目準備
我們使用Spring Boot框架來集成。
1.pom文件引入的依賴
org.springframework.boot spring-boot-starter org.springframework.boot spring-boot-starter-web org.springframework.boot spring-boot-starter-tomcat org.springframework.boot spring-boot-starter-undertow mysql mysql-connector-java com.baomidou mybatis-plus-boot-starter 3.4.0 org.projectlombok lombok com.alibaba fastjson 1.2.74 joda-time joda-time 2.10.6 org.springframework.boot spring-boot-starter-test
2.application.yml配置
- spring:
- application:
- name: securityjwt
- datasource:
- driver-class-name: com.mysql.cj.jdbc.Driver
- url: jdbc:mysql://127.0.0.1:3306/cheetah?characterEncoding=utf-8&useSSL=false&serverTimezone=UTC
- username: root
- password: 123456
- server:
- port: 8080
- mybatis:
- mapper-locations: classpath:mapper/*.xml
- type-aliases-package: com.itcheetah.securityjwt.entity
- configuration:
- map-underscore-to-camel-case: true
- rsa:
- key:
- pubKeyFile: C:\Users\Desktop\jwt\id_key_rsa.pub
- priKeyFile: C:\Users\Desktop\jwt\id_key_rsa
3.SQL文件
- /**
- * sys_user_info
- **/
- SET NAMES utf8mb4;
- SET FOREIGN_KEY_CHECKS = 0;
- -- ----------------------------
- -- Table structure for sys_user_info
- -- ----------------------------
- DROP TABLE IF EXISTS `sys_user_info`;
- CREATE TABLE `sys_user_info` (
- `id` bigint(20) NOT NULL AUTO_INCREMENT,
- `username` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
- `password` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
- PRIMARY KEY (`id`) USING BTREE
- ) ENGINE = InnoDB AUTO_INCREMENT = 3 CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Dynamic;
- SET FOREIGN_KEY_CHECKS = 1;
- /**
- * product_info
- **/
- SET NAMES utf8mb4;
- SET FOREIGN_KEY_CHECKS = 0;
- -- ----------------------------
- -- Table structure for product_info
- -- ----------------------------
- DROP TABLE IF EXISTS `product_info`;
- CREATE TABLE `product_info` (
- `id` bigint(20) NOT NULL AUTO_INCREMENT,
- `name` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
- `price` decimal(10, 4) NULL DEFAULT NULL,
- `create_date` datetime(0) NULL DEFAULT NULL,
- `update_date` datetime(0) NULL DEFAULT NULL,
- PRIMARY KEY (`id`) USING BTREE
- ) ENGINE = InnoDB AUTO_INCREMENT = 4 CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Dynamic;
- SET FOREIGN_KEY_CHECKS = 1;
引入依賴
org.springframework.boot spring-boot-starter-security io.jsonwebtoken jjwt 0.9.1
引入之后啟動項目，會有如圖所示：
其中用戶名為user，密碼為上圖中的字符串。
SecurityConfig類
- //開啟全局方法安全性
- @EnableGlobalMethodSecurity(prePostEnabled=true, securedEnabled=true)
- public class SecurityConfig extends WebSecurityConfigurerAdapter {
- //認證失敗處理類
- @Autowired
- private AuthenticationEntryPointImpl unauthorizedHandler;
- //提供公鑰私鑰的配置類
- @Autowired
- private RsaKeyProperties prop;
- @Autowired
- private UserInfoService userInfoService;
- @Override
- protected void configure(HttpSecurity httpSecurity) throws Exception {
- httpSecurity
- // CSRF禁用，因為不使用session
- .csrf().disable()
- // 認證失敗處理類
- .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
- // 基于token，所以不需要session
- .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
- // 過濾請求
- .authorizeRequests()
- .antMatchers(
- HttpMethod.GET,
- "/*.html",
- "/**/*.html",
- "/**/*.css",
- "/**/*.js"
- ).permitAll()
- // 除上面外的所有請求全部需要鑒權(quán)認證
- .anyRequest().authenticated()
- .and()
- .headers().frameOptions().disable();
- // 添加JWT filter
- httpSecurity.addFilter(new TokenLoginFilter(super.authenticationManager(), prop))
- .addFilter(new TokenVerifyFilter(super.authenticationManager(), prop));
- }
- //指定認證對象的來源
- public void configure(AuthenticationManagerBuilder auth) throws Exception {
- auth.userDetailsService(userInfoService)
- //從前端傳遞過來的密碼就會被加密，所以從數(shù)據(jù)庫
- //查詢到的密碼必須是經(jīng)過加密的，而這個過程都是
- //在用戶注冊的時候進行加密的。
- .passwordEncoder(passwordEncoder());
- }
- //密碼加密
- @Bean
- public BCryptPasswordEncoder passwordEncoder(){
- return new BCryptPasswordEncoder();
- }
- }
「攔截規(guī)則」
- anyRequest：匹配所有請求路徑
- access：SpringEl表達式結(jié)果為true時可以訪問
- anonymous：匿名可以訪問
- `denyAll：用戶不能訪問
- fullyAuthenticated：用戶完全認證可以訪問(非remember-me下自動登錄)
- hasAnyAuthority：如果有參數(shù)，參數(shù)表示權(quán)限，則其中任何一個權(quán)限可以訪問
- hasAnyRole：如果有參數(shù)，參數(shù)表示角色，則其中任何一個角色可以訪問
- hasAuthority：如果有參數(shù)，參數(shù)表示權(quán)限，則其權(quán)限可以訪問
- hasIpAddress：如果有參數(shù)，參數(shù)表示IP地址，如果用戶IP和參數(shù)匹配，則可以訪問
- hasRole：如果有參數(shù)，參數(shù)表示角色，則其角色可以訪問
- permitAll：用戶可以任意訪問
- rememberMe：允許通過remember-me登錄的用戶訪問
- authenticated：用戶登錄后可訪問
認證失敗處理類
- /**
- * 返回未授權(quán)
- */
- @Component
- public class AuthenticationEntryPointImpl implements AuthenticationEntryPoint, Serializable {
- private static final long serialVersionUID = -8970718410437077606L;
- @Override
- public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException e)
- throws IOException {
- int code = HttpStatus.UNAUTHORIZED;
- String msg = "認證失敗，無法訪問系統(tǒng)資源，請先登陸";
- ServletUtils.renderString(response, JSON.toJSONString(AjaxResult.error(code, msg)));
- }
- }
認證流程
自定義認證過濾器
- public class TokenLoginFilter extends UsernamePasswordAuthenticationFilter {
- private AuthenticationManager authenticationManager;
- private RsaKeyProperties prop;
- public TokenLoginFilter(AuthenticationManager authenticationManager, RsaKeyProperties prop) {
- this.authenticationManager = authenticationManager;
- this.prop = prop;
- }
- /**
- * @author cheetah
- * @description 登陸驗證
- * @date 2021/6/28 16:17
- * @Param [request, response]
- * @return org.springframework.security.core.Authentication
- **/
- public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
- try {
- UserPojo sysUser = new ObjectMapper().readValue(request.getInputStream(), UserPojo.class);
- UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(sysUser.getUsername(), sysUser.getPassword());
- return authenticationManager.authenticate(authRequest);
- }catch (Exception e){
- try {
- response.setContentType("application/json;charset=utf-8");
- response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
- PrintWriter out = response.getWriter();
- Map resultMap = new HashMap();
- resultMap.put("code", HttpServletResponse.SC_UNAUTHORIZED);
- resultMap.put("msg", "用戶名或密碼錯誤！");
- out.write(new ObjectMapper().writeValueAsString(resultMap));
- out.flush();
- out.close();
- }catch (Exception outEx){
- outEx.printStackTrace();
- }
- throw new RuntimeException(e);
- }
- }
- /**
- * @author cheetah
- * @description 登陸成功回調(diào)
- * @date 2021/6/28 16:17
- * @Param [request, response, chain, authResult]
- * @return void
- **/
- public void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
- UserPojo user = new UserPojo();
- user.setUsername(authResult.getName());
- user.setRoles((List
)authResult.getAuthorities()); - //通過私鑰進行加密：token有效期一天
- String token = JwtUtils.generateTokenExpireInMinutes(user, prop.getPrivateKey(), 24 * 60);
- response.addHeader("Authorization", "Bearer "+token);
- try {
- response.setContentType("application/json;charset=utf-8");
- response.setStatus(HttpServletResponse.SC_OK);
- PrintWriter out = response.getWriter();
- Map resultMap = new HashMap();
- resultMap.put("code", HttpServletResponse.SC_OK);
- resultMap.put("msg", "認證通過！");
- resultMap.put("token", token);
- out.write(new ObjectMapper().writeValueAsString(resultMap));
- out.flush();
- out.close();
- }catch (Exception outEx){
- outEx.printStackTrace();
- }
- }
- }
流程
Security默認登錄路徑為/login，當我們調(diào)用該接口時，它會調(diào)用上邊的attemptAuthentication方法;圖片圖片圖片圖片所以我們要自定義UserInfoService繼承UserDetailsService實現(xiàn)loadUserByUsername方法;
所以我們要自定義UserInfoService繼承UserDetailsService實現(xiàn)loadUserByUsername方法；
- public interface UserInfoService extends UserDetailsService {
- }
- @Service
- @Transactional
- public class UserInfoServiceImpl implements UserInfoService {
- @Autowired
- private SysUserInfoMapper userInfoMapper;
- @Override
- public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
- UserPojo user = userInfoMapper.queryByUserName(username);
- return user;
- }
- }
其中的loadUserByUsername返回的是UserDetails類型，所以UserPojo繼承UserDetails類
- @Data
- public class UserPojo implements UserDetails {
- private Integer id;
- private String username;
- private String password;
- private Integer status;
- private List
roles; - @JsonIgnore
- @Override
- public Collection getAuthorities() {
- //理想型返回 admin 權(quán)限，可自已處理這塊
- List
auth = new ArrayList<>(); - auth.add(new SimpleGrantedAuthority("ADMIN"));
- return auth;
- }
- @Override
- public String getPassword() {
- return this.password;
- }
- @Override
- public String getUsername() {
- return this.username;
- }
- /**
- * 賬戶是否過期
- **/
- @JsonIgnore
- @Override
- public boolean isAccountNonExpired() {
- return true;
- }
- /**
- * 是否禁用
- */
- @JsonIgnore
- @Override
- public boolean isAccountNonLocked() {
- return true;
- }
- /**
- * 密碼是否過期
- */
- @JsonIgnore
- @Override
- public boolean isCredentialsNonExpired() {
- return true;
- }
- /**
- * 是否啟用
- */
- @JsonIgnore
- @Override
- public boolean isEnabled() {
- return true;
- }
- }
當認證通過之后會在SecurityContext中設置Authentication對象，回調(diào)調(diào)用successfulAuthentication方法返回token信息，
整體流程圖如下
鑒權(quán)流程
自定義token過濾器
- public class TokenVerifyFilter extends BasicAuthenticationFilter {
- private RsaKeyProperties prop;
- public TokenVerifyFilter(AuthenticationManager authenticationManager, RsaKeyProperties prop) {
- super(authenticationManager);
- this.prop = prop;
- }
- public void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
- String header = request.getHeader("Authorization");
- if (header == null || !header.startsWith("Bearer ")) {
- //如果攜帶錯誤的token，則給用戶提示請登錄！
- chain.doFilter(request, response);
- } else {
- //如果攜帶了正確格式的token要先得到token
- String token = header.replace("Bearer ", "");
- //通過公鑰進行解密：驗證tken是否正確
- Payload
payload = JwtUtils.getInfoFromToken(token, prop.getPublicKey(), UserPojo.class); - UserPojo user = payload.getUserInfo();
- if(user!=null){
- UsernamePasswordAuthenticationToken authResult = new UsernamePasswordAuthenticationToken(user.getUsername(), null, user.getAuthorities());
- //將認證信息存到安全上下文中
- SecurityContextHolder.getContext().setAuthentication(authResult);
- chain.doFilter(request, response);
- }
- }
- }
- }
當我們訪問時需要在header中攜帶token信息
本文轉(zhuǎn)載自微信公眾號「阿Q說代碼」，可以通過以下二維碼關(guān)注。轉(zhuǎn)載本文請聯(lián)系阿Q說代碼公眾號。
分享名稱：實戰(zhàn)篇：Security+JWT組合拳
瀏覽地址：http://www.dlmjj.cn/article/dhsspcj.html
