Spring Security+JWT实现身份认证与权限控制

接着是配置UsernameLoginSuccessHandler，这个是用来处理登录成功后的流程，我们要做的是JWT的鉴权，因此在这个handler里应当生成jwt并给前端返回

public class UsernameLoginSuccessHandler implements AuthenticationSuccessHandler {
    private final static Gson gson = new Gson();

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
                                        Authentication authentication) throws IOException{
        //生成token,并放置在header里
        String token = JwtUtils.createToken(((BallUser)authentication.getPrincipal()).getUserId());
        Map.Entry entry = JwtUtils.tokenToEntry(token);
        response.setHeader(entry.getKey(), entry.getValue());
        response.setCharacterEncoding("UTF-8");
        response.getWriter().print(gson.toJson(ResultEntity.data(token)));
    }

}

这里放出来一个略微封装的jwt生成工具,可以根据项目自行定制

public class JwtUtils {
    public static final String TOKEN_HEADER = "Authorization"; //Header标识JWT
    private static final String TOKEN_PREFIX = "Bearer "; //JWT标准开头,注意空格
    private static final String SECRET = "jwt-key"; //JWT签证密钥
    private static final String ROLE = "role"; //Jwt中携带的身份key
    private static final String USER_ID = "uid"; //Jwt中携带的用户ID的key
    private static final long EXPIRATION = 60 * 60 * 24 * 7L; //过期时间7天

    
    public static String tokenFromHeaders(Map headers) {
        if (headers == null) {
            return null;
        }
        for (Map.Entry entry : headers.entrySet()) {
            if (entry.getKey().equals(TOKEN_HEADER)) {
                if (entry.getValue().startsWith(TOKEN_PREFIX)) {
                    return entry.getValue().replaceFirst(TOKEN_PREFIX, "");
                }
            }
        }
        return null;
    }

    public static String tokenFromHeader(String header) {
        if (header == null) {
            return null;
        }
        if (header.startsWith(TOKEN_PREFIX)) {
            return header.replaceFirst(TOKEN_PREFIX, "");
        }
        return null;
    }

    
    public static Map.Entry tokenToEntry(String token) {
        assert token != null;
        return new AbstractMap.SimpleEntry(TOKEN_HEADER, TOKEN_PREFIX + token);
    }

    
    public static String createToken(Integer userId) {
        Map map = new HashMap<>();
        map.put(USER_ID, userId);
        return Jwts.builder().signWith(SignatureAlgorithm.HS256, SECRET)
                .setSubject("info")
                .setIssuer("weiteli")
                .setAudience("together-ball")
                .setClaims(map).setIssuedAt(new Date())
                // token 7天内有效
                .setExpiration(new Date(System.currentTimeMillis() + EXPIRATION * 1000))
                .compact();
    }

    
    public static String refreshToken(String token) {
        Claims claim = getTokenClaims(token);
        return Jwts.builder().signWith(SignatureAlgorithm.HS256, SECRET)
                .setClaims(claim).setIssuedAt(new Date())
                .setExpiration(new Date(System.currentTimeMillis() + EXPIRATION * 1000))
                .compact();
    }

    
    public static String getUsername(String token) {
        try {
            return getTokenClaims(token).getSubject();
        } catch (Exception e) {
            return null;
        }
    }

    
    private static Claims getTokenClaims(String token) {
        Claims claims = null;
        try {
            claims = Jwts.parser().setSigningKey(SECRET).parseClaimsJws(token).getBody();
        } catch (ExpiredJwtException | UnsupportedJwtException | MalformedJwtException | SignatureException | IllegalArgumentException e) {
            e.printStackTrace();
        }
        return claims;
    }

    
    public static String getUserRole(String token) {
        return (String) getTokenClaims(token).get(ROLE);
    }

    
    public static int getUserId(String token) {
        return getTokenClaims(token).get(USER_ID, Integer.class);
    }

    
    public static Boolean isExpiration(String token) {
        return getTokenClaims(token).getExpiration().before(new Date());
    }

    
    public static Date getIssuedAt(String token) {
        return getTokenClaims(token).getIssuedAt();
    }
}

接着是配置失败的统一处理,这个也很简单,默认是失败返回403,这里根据需求对其定制

ResultEntity以及StatusCode均是自定的类，输出string也是一样的

public class LoginFailureHandler implements AuthenticationFailureHandler {
    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException {
        Gson gson = new Gson();
        response.setCharacterEncoding("UTF-8");
        response.getWriter().print(gson.toJson(ResultEntity.error(StatusCode.USER_CREDENTIALS_ERROR)));
        response.setStatus(HttpStatus.OK.value());
    }
}

UsernamePasswordAuthenticationFilter会调用UserDetailService的loadUsername方法，一般需要在系统中重写service

首先定义鉴权的类,这个系统中通过userId唯一区分用户,因此需要重写

如果通过用户名唯一区分,直接使用org.springframework.security.core.userdetails.User可以不用重写

public class BallUser extends org.springframework.security.core.userdetails.User {
    private final int userId;

    public BallUser(int userId, String username, String password, Collection authorities) {
        super(username, password, authorities);
        this.userId = userId;
    }

    public BallUser(int userId, String username, String password, boolean enabled, boolean accountNonExpired, boolean credentialsNonExpired, boolean accountNonLocked, Collection authorities) {
        super(username, password, enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, authorities);
        this.userId = userId;
    }

    public int getUserId() {
        return userId;
    }
}

接着重写service

@Service
public class UserService implements UserDetailsService {
    @Autowired
    UserDao userDao;
    @Autowired
    RoleDao roleDao;
    @Autowired
    PasswordEncoder passwordEncoder;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userDao.selectUserByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException("用户名不存在");
        }
        List roles = roleDao.selectRolesByUserId(user.getUserId());
        roles.add(RoleEnum.COMMON.getRoleName());
        for (int i = 0; i < roles.size(); i++) {
            roles.set(i, "ROLE_" + roles.get(i));
        }
        String roleString = StringUtils.arrayToCommaDelimitedString(roles.toArray());
        return new BallUser(
                user.getUserId(),
                user.getUsername(),
                user.getPassword(),
                AuthorityUtils.commaSeparatedStringToAuthorityList(roleString));
    }

    public Boolean register(String username, String password) {
        if (userDao.selectUserByUsername(username) == null) {
            return userDao.insertUser(username, passwordEncoder.encode(password));
        }
        return false;
    }

    public List loadRolesByUserId(int userId){
        List roles = roleDao.selectRolesByUserId(userId);
        roles.add(RoleEnum.COMMON.getRoleName());
        for (int i = 0; i < roles.size(); i++) {
            roles.set(i, "ROLE_" + roles.get(i));
        }
        return roles;
    }
}

首先还是配置config

@Configuration
public class JwtLoginConfig, B extends HttpSecurityBuilder>
        extends AbstractHttpConfigurer {
    @Override
    public void configure(B builder) throws Exception {
        builder.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
    }

    @Bean
    JwtAuthenticationFilter jwtAuthenticationFilter() {
        // 使用自定义的filter
        JwtAuthenticationFilter filter = new JwtAuthenticationFilter();
        // 新建providerManager并为filter配置provider
        ProviderManager providerManager = new ProviderManager(new JwtAuthenticationProvider());
        filter.setAuthenticationManager(providerManager);
        // 不使用session
        filter.setSessionAuthenticationStrategy(new NullAuthenticatedSessionStrategy());
        // 通过bean注入handler
        filter.setAuthenticationSuccessHandler(jwtLoginSuccessHandler());
        filter.setAuthenticationFailureHandler(new LoginFailureHandler());
        return filter;
    }

    @Bean
    JwtLoginSuccessHandler jwtLoginSuccessHandler(){
        return new JwtLoginSuccessHandler();
    }
}

public class JwtAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

    public JwtAuthenticationFilter() {
        // 拦截请求头中带有Authentication的
        super(new RequestHeaderRequestMatcher(JwtUtils.TOKEN_HEADER));
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException {
        response.setCharacterEncoding("UTF-8");
        response.setHeader("Content-Type", "text/html;charset=UTF-8");
        String token = getJwtToken(request);
        JwtAuthenticationToken authRequest = new JwtAuthenticationToken(null, token, null);
        return getAuthenticationManager().authenticate(authRequest);
    }

    // 这里一定要注意,必须重写,否则controller收不到请求
    @Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
        chain.doFilter(request, response);
    }

    private String getJwtToken(HttpServletRequest request) {
        String header = request.getHeader(JwtUtils.TOKEN_HEADER);
        return JwtUtils.tokenFromHeader(header);
    }
}

public class JwtAuthenticationToken extends AbstractAuthenticationToken {
    // 保持与UsernameAuthentication的一致性
    private final BallUser principal;
    private final Object credentials;

    public JwtAuthenticationToken(BallUser user, String token, Collection authorities) {
        super(authorities);
        this.principal = user;
        this.credentials = token;
    }

    @Override
    public BallUser getPrincipal() {
        return principal;
    }

    @Override
    public Object getCredentials() {
        return credentials;
    }
}

// @Component 这个component也是不需要的
public class JwtAuthenticationProvider implements AuthenticationProvider {
    // 这里注意,由于前面的实例都是new出来的,没有走spring的bean管理,这儿是没办法直接注入的
    // 需要获取bean
    // @Autowired
    // RoleDao roleDao;

      @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        JwtAuthenticationToken jwtToken = (JwtAuthenticationToken) authentication;
        String token = (String) jwtToken.getCredentials();
        try {
            int userId = JwtUtils.getUserId(token);
            // 获取service bean
            UserService userService = GetBeanUtils.getBean(UserService.class);
            List roles = userService.loadRolesByUserId(userId);
            BallUser user = new BallUser(
                    userId, "[NotNeed]", "[Protected]",
                    AuthorityUtils.commaSeparatedStringToAuthorityList(StringUtils.arrayToCommaDelimitedString(roles.toArray())));
            return new JwtAuthenticationToken(user, token, user.getAuthorities());
        } catch (JwtException e) {
            e.printStackTrace();
            throw new AuthenticationServiceException("Token invalidate");
        }
    }

    @Override
    public boolean supports(Class authentication) {
        return authentication.isAssignableFrom(JwtAuthenticationToken.class);
    }
}

// [这篇博客](https://blog.csdn.net/qq_28080659/article/details/99687074)
@Component
public class GetBeanUtils implements ApplicationContextAware {
    private static ApplicationContext applicationContext = null;

    @Override
    public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
        if (GetBeanUtils.applicationContext == null) {
            GetBeanUtils.applicationContext = applicationContext;
        }
    }

    
    public static ApplicationContext getApplicationContext() {
        return applicationContext;
    }

    
    public static Object getBean(String beanName) {
        return applicationContext.getBean(beanName);
    }

    
    public static  T getBean(Class c) {
        return applicationContext.getBean(c);
    }

    
    public static  T getBean(String name, Class c) {
        return getApplicationContext().getBean(name, c);
    }
}

@RestController
@RequestMapping("/")
public class UserController {
    @Autowired
    UserService userService;

    @RequestMapping("register")
    ResultEntity register(@RequestParam String username, @RequestParam String password) {
        if (userService.register(username, password)) {
            return ResultEntity.success();
        } else {
            return ResultEntity.error(StatusCode.USER_ALREADY_EXISTING);
        }
    }

    @RequestMapping("logout")
    @PreAuthorize("hasRole('COMMON')")
    // @PreAuthorize("hasRole('ROLE_COMMON')") 这么写与上一行等价,ROLE_可省
    ResultEntity logout() {
        return ResultEntity.success();
    }
}