• Springboot Security 前后端分离模式自由接口最小工作模型

    但凡讲解Springboot Security的教程，都是根据其本身的定义，前后端整合在一起，登录采用form或者basic。我们现在的很多项目，前后端分离，form登录已经不适用了。很多程序的架构要求所有的接口都采用application/json方式，因此basic登录模式也几乎不用。我们需要纯粹使用自己的自由接口来实现注册登录，以及其他业务接口访问的身份验证和授权。这里的设计是用户身份验证与授权的模块跟业务模块的身份权限验证是分开的。不过为了紧凑，我把两部分放在一起做了一个最小工作模型。

     这是最小模型的基本结构，核心的类就config中两个。其他的都是工作模型。

    一、创建Springboot web项目，添加pom

    1. <dependency>
    2.     <groupId>org.springframework.bootgroupId>
    3.     <artifactId>spring-boot-starter-webartifactId>
    4. dependency>
    5. <dependency>
    6.     <groupId>org.springframework.bootgroupId>
    7.     <artifactId>spring-boot-starter-securityartifactId>
    8. dependency>
    9. <dependency>
    10.     <groupId>io.jsonwebtokengroupId>
    11.     <artifactId>jjwtartifactId>
    12.     <version>0.9.1version>
    13. dependency>

    二、一个用户构建token签发数据的类

    1. package com.chris.demo.domain;
    2.  
    3. /**
    4.  * @author Chris Chan
    5.  * Create On 2022/11/24 10:19
    6.  * Use for:
    7.  * Explain:
    8.  */
    9. public class JwtResult {
    10.     /**
    11.      * 访问令牌
    12.      */
    13.     private String accessToken;
    14.     /**
    15.      * 访问令牌过期时间(毫秒)
    16.      */
    17.     private Long accessTokenExpire;
    18.     /**
    19.      * 刷新令牌
    20.      */
    21.     private String refreshToken;
    22.     /**
    23.      * 刷新令牌过期时间(毫秒)
    24.      */
    25.     private Long refreshExpire;
    26.  
    27.     public String getAccessToken() {
    28.         return accessToken;
    29.     }
    30.  
    31.     public void setAccessToken(String accessToken) {
    32.         this.accessToken = accessToken;
    33.     }
    34.  
    35.     public Long getAccessTokenExpire() {
    36.         return accessTokenExpire;
    37.     }
    38.  
    39.     public void setAccessTokenExpire(Long accessTokenExpire) {
    40.         this.accessTokenExpire = accessTokenExpire;
    41.     }
    42.  
    43.     public String getRefreshToken() {
    44.         return refreshToken;
    45.     }
    46.  
    47.     public void setRefreshToken(String refreshToken) {
    48.         this.refreshToken = refreshToken;
    49.     }
    50.  
    51.     public Long getRefreshExpire() {
    52.         return refreshExpire;
    53.     }
    54.  
    55.     public void setRefreshExpire(Long refreshExpire) {
    56.         this.refreshExpire = refreshExpire;
    57.     }
    58. }

    我们构架一个数据类在内存中存放用户数据，实际上存取数据库也应该有一个ORM类。

    1. package com.chris.demo.domain;
    2.  
    3. /**
    4.  * @author Chris Chan
    5.  * Create On 2022/11/23 16:03
    6.  * Use for:
    7.  * Explain:
    8.  */
    9. public class UserModel {
    10.     private String username;
    11.     private String password;
    12.     private String authorities;
    13.  
    14.     public String getUsername() {
    15.         return username;
    16.     }
    17.  
    18.     public void setUsername(String username) {
    19.         this.username = username;
    20.     }
    21.  
    22.     public String getPassword() {
    23.         return password;
    24.     }
    25.  
    26.     public void setPassword(String password) {
    27.         this.password = password;
    28.     }
    29.  
    30.     public String getAuthorities() {
    31.         return authorities;
    32.     }
    33.  
    34.     public void setAuthorities(String authorities) {
    35.         this.authorities = authorities;
    36.     }
    37. }

    三、设计JavaWebToken的工具

    1. package com.chris.demo.utils;
    2.  
    3. import com.chris.demo.domain.JwtResult;
    4. import io.jsonwebtoken.Claims;
    5. import io.jsonwebtoken.Jwts;
    6. import io.jsonwebtoken.SignatureAlgorithm;
    7.  
    8. import java.util.Date;
    9. import java.util.HashMap;
    10. import java.util.Map;
    11.  
    12. /**
    13.  * @author Chris Chan
    14.  * Create On 2022/11/24 10:18
    15.  * Use for: JWT工具
    16.  * Explain:
    17.  */
    18. public class JwtUtil {
    19.     /**
    20.      * 访问令牌过期时间（天）
    21.      */
    22.     private static int ACCESS_TOKEN_XPIRE_DAYS = 7;
    23.     /**
    24.      * 刷新令牌过期时间（天）
    25.      */
    26.     private static int REFRESH_TOKEN_EXPIRE_DAYS = 30;
    27.     /**
    28.      * 签名指纹 加密解密要一致
    29.      */
    30.     private static String SIGN_KEY = "NDHHKHJKFWHEUIFKK8384SDNJAFYQJ723HF7823F3BJ";
    31.  
    32.     /**
    33.      * 通过用户名构建jwt
    34.      *
    35.      * @param username
    36.      * @param authorties
    37.      * @param expire
    38.      * @return
    39.      */
    40.     public static String buildJwtByUsername(String username, String authorties, long expire) {
    41.         //有效载荷
    42.         Map claims = new HashMap<>();
    43.         claims.put("username", username);
    44.         claims.put("authorities", authorties);
    45.  
    46.         //过期时间
    47.         Date now = new Date();
    48.         Date expireTime = new Date(expire);
    49.  
    50.         return Jwts.builder()
    51.                 .setId("yyds")
    52.                 .setSubject("chris_jwt")
    53.                 .setClaims(claims)
    54.                 .setIssuedAt(now)
    55.                 .setExpiration(expireTime)
    56.                 .signWith(SignatureAlgorithm.HS512, SIGN_KEY)
    57.                 .compact();
    58.     }
    59.  
    60.     /**
    61.      * 从jwt中解析出用户名
    62.      *
    63.      * @param token
    64.      * @return
    65.      */
    66.     public static String getUsernameFromJwt(String token) {
    67.         Object obj = parseClaimsBody(token)
    68.                 .get("username");
    69.         return String.valueOf(obj);
    70.     }
    71.  
    72.     /**
    73.      * 从jwt中解析出权限
    74.      *
    75.      * @param token
    76.      * @return
    77.      */
    78.     public static String getAuthoritiesFromJwt(String token) {
    79.         Object obj = parseClaimsBody(token)
    80.                 .get("authorities");
    81.         return String.valueOf(obj);
    82.     }
    83.  
    84.     private static Claims parseClaimsBody(String token) {
    85.         return Jwts.parser()
    86.                 .setSigningKey(SIGN_KEY)
    87.                 .parseClaimsJws(token)
    88.                 .getBody();
    89.     }
    90.  
    91.     /**
    92.      * 构建登录结果JwtResult
    93.      *
    94.      * @param username
    95.      * @param authorities
    96.      * @return
    97.      */
    98.     public static JwtResult buildJwtResultByUsername(String username, String authorities) {
    99.         Date now = new Date();
    100.  
    101.         JwtResult jwtResult = new JwtResult();
    102.  
    103.         long accessTokenExpire = now.getTime() + 3600000 * 24 * ACCESS_TOKEN_XPIRE_DAYS;
    104.         long refreshTokenExpire = now.getTime() + 3600000 * 24 * REFRESH_TOKEN_EXPIRE_DAYS;
    105.  
    106.         jwtResult.setAccessToken(buildJwtByUsername(username, authorities, accessTokenExpire));
    107.         jwtResult.setAccessTokenExpire(accessTokenExpire);
    108.         jwtResult.setRefreshToken(buildJwtByUsername(username, authorities, refreshTokenExpire));
    109.         jwtResult.setRefreshExpire(refreshTokenExpire);
    110.  
    111.         return jwtResult;
    112.     }
    113. }

    工具中三个主要方法，构建jwt，解析用户名、权限列表和构建登录结果。其中解析方法适用于一般业务模块验证token使用的。可以分离出去，但是key一定要保持一致。

    四、正菜之一：访问过滤器。调用一般业务接口时需要检查是否携带令牌，格式是否正确，验证之后进行授权。

    1. package com.chris.demo.config;
    2.  
    3. import com.chris.demo.utils.JwtUtil;
    4. import org.springframework.security.authentication.AuthenticationManager;
    5. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    6. import org.springframework.security.core.GrantedAuthority;
    7. import org.springframework.security.core.authority.AuthorityUtils;
    8. import org.springframework.security.core.context.SecurityContextHolder;
    9. import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
    10.  
    11. import javax.servlet.FilterChain;
    12. import javax.servlet.ServletException;
    13. import javax.servlet.http.HttpServletRequest;
    14. import javax.servlet.http.HttpServletResponse;
    15. import java.io.IOException;
    16. import java.util.Arrays;
    17. import java.util.List;
    18. import java.util.stream.Collectors;
    19.  
    20. /**
    21.  * @author Chris Chan
    22.  * Create On 2022/11/23 17:07
    23.  * Use for:
    24.  * Explain:
    25.  */
    26. public class AccessFilter extends BasicAuthenticationFilter {
    27.     private static List passList;
    28.  
    29.     public static void setPassList(List passList) {
    30.         AccessFilter.passList = passList;
    31.     }
    32.  
    33.     public AccessFilter(AuthenticationManager authenticationManager, List passList) {
    34.         super(authenticationManager);
    35.         AccessFilter.passList = passList;
    36.     }
    37.  
    38.     /**
    39.      * 传入白名单和用户服务
    40.      *
    41.      * @param authenticationManager
    42.      * @param passes
    43.      */
    44.     public AccessFilter(AuthenticationManager authenticationManager, String... passes) {
    45.         super(authenticationManager);
    46.         AccessFilter.passList = Arrays.stream(passes).collect(Collectors.toList());
    47.     }
    48.  
    49.     @Override
    50.     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
    51.             throws IOException, ServletException {
    52.         //白名单放行
    53.         String requestURI = request.getRequestURI();
    54.  
    55.         if (passList.contains(requestURI)) {
    56.             chain.doFilter(request, response);
    57.             return;
    58.         }
    59.         //读取Authorization
    60.         String authorization = request.getHeader("Authorization");
    61.         if (null == authorization) {
    62.             throw new RuntimeException("没有发现令牌");
    63.         }
    64.         //格式校验
    65.         if (!authorization.startsWith("Bearer ")) {
    66.             throw new RuntimeException("令牌格式错误");
    67.         }
    68.  
    69.         //取得token
    70.         String jwt = authorization.replace("Bearer ", "");
    71.         //todo 尝试解析jwt，获取用户名，有异常抛出,
    72.         String username = JwtUtil.getUsernameFromJwt(jwt);
    73.         String authorities = JwtUtil.getAuthoritiesFromJwt(jwt);
    74.  
    75.         //构建权限token，放入上下文
    76.         List authorityList = AuthorityUtils.commaSeparatedStringToAuthorityList(authorities);
    77.         UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, null, authorityList);
    78.         SecurityContextHolder.getContext().setAuthentication(token);
    79.  
    80.         chain.doFilter(request, response);
    81.     }
    82. }

    五、正菜之二：Security配置文件

    1. package com.chris.demo.config;
    2.  
    3. import org.springframework.context.annotation.Bean;
    4. import org.springframework.context.annotation.Configuration;
    5. import org.springframework.security.authentication.AuthenticationManager;
    6. import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
    7. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    8. import org.springframework.security.config.annotation.web.builders.WebSecurity;
    9. import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    10. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    11. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    12. import org.springframework.security.crypto.password.PasswordEncoder;
    13.  
    14. /**
    15.  * @author Chris Chan
    16.  * Create On 2022/11/23 16:04
    17.  * Use for:
    18.  * Explain:
    19.  * @link . https://blog.csdn.net/weixin_46684099/article/details/117434577
    20.  * @link . https://blog.csdn.net/chihaihai/article/details/104678864
    21.  */
    22. @EnableWebSecurity
    23. @EnableGlobalMethodSecurity(jsr250Enabled = true)
    24. @Configuration
    25. public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    26.  
    27.     @Override
    28.     public void configure(WebSecurity web) throws Exception {
    29.         web
    30.                 .ignoring()
    31.                 .mvcMatchers("/");
    32.     }
    33.  
    34.     @Override
    35.     protected void configure(HttpSecurity http) throws Exception {
    36.         //通关白名单
    37.         String[] passes = {
    38.                 "/api/user/reg",
    39.                 "/api/user/login"
    40.         };
    41.         http
    42.                 .authorizeRequests()
    43.                 .antMatchers(passes).permitAll()
    44.                 .anyRequest().authenticated()
    45.                 .and()
    46.                 .cors()
    47.                 .and()
    48.                 .csrf().disable()
    49.                 .addFilter(new AccessFilter(authenticationManager(), passes));
    50.     }
    51.  
    52.     @Bean
    53.     @Override
    54.     protected AuthenticationManager authenticationManager() throws Exception {
    55.         return super.authenticationManager();
    56.     }
    57.  
    58.     @Bean
    59.     public PasswordEncoder passwordEncoder() {
    60.         return new BCryptPasswordEncoder();
    61.     }
    62. }

    核心在第二个configre方法，没有配置form和basic登录，只是对某些接口放行。包含一个访问过滤器设置。过滤器设置的白名单跟此处配置的完全授权的白名单没有必然的关系。不过一般是一致的。他们作用于两个过滤器，要都能通过才行。

    六、模型文件：模拟数据管理类，业务处理类，接口类等

    1. package com.chris.demo.dao;
    2.  
    3. import com.chris.demo.domain.UserModel;
    4. import org.springframework.stereotype.Repository;
    5.  
    6. import java.util.concurrent.ConcurrentHashMap;
    7.  
    8. /**
    9.  * @author Chris Chan
    10.  * Create On 2022/11/24 9:57
    11.  * Use for: 模拟数据库管理用户
    12.  * Explain:
    13.  */
    14. @Repository
    15. public class UserReporitory {
    16.     private static ConcurrentHashMap userMap = new ConcurrentHashMap<>();
    17.  
    18.     /**
    19.      * 保存用户
    20.      * @param userModel
    21.      */
    22.     public void save(UserModel userModel) {
    23.         userMap.put(userModel.getUsername(), userModel);
    24.     }
    25.  
    26.     /**
    27.      * 获取用户信息
    28.      *
    29.      * @param username
    30.      * @return
    31.      */
    32.     public UserModel findByUsername(String username) {
    33.         return userMap.get(username);
    34.     }
    35. }
    1. package com.chris.demo.service;
    2.  
    3. import com.chris.demo.dao.UserReporitory;
    4. import com.chris.demo.domain.JwtResult;
    5. import com.chris.demo.domain.UserModel;
    6. import com.chris.demo.utils.JwtUtil;
    7. import org.springframework.beans.factory.annotation.Autowired;
    8. import org.springframework.security.core.userdetails.UsernameNotFoundException;
    9. import org.springframework.security.crypto.password.PasswordEncoder;
    10. import org.springframework.stereotype.Service;
    11.  
    12. import javax.security.auth.login.CredentialException;
    13.  
    14. /**
    15.  * @author Chris Chan
    16.  * Create On 2022/11/23 16:25
    17.  * Use for:
    18.  * Explain:
    19.  */
    20. @Service
    21. public class UserService {
    22.  
    23.     @Autowired
    24.     PasswordEncoder passwordEncoder;
    25.     @Autowired
    26.     UserReporitory userReporitory;
    27.  
    28.     /**
    29.      * 注册
    30.      *
    31.      * @param username
    32.      * @param password
    33.      */
    34.     public void reg(String username, String password) {
    35.         reg(username, password, "USER");
    36.     }
    37.  
    38.     /**
    39.      * 注册
    40.      *
    41.      * @param username
    42.      * @param password
    43.      */
    44.     public void reg(String username, String password, String roles) {
    45.         UserModel userModel = new UserModel();
    46.         userModel.setUsername(username);
    47.         userModel.setPassword(passwordEncoder.encode(password));
    48.         userModel.setAuthorities(roles);
    49.  
    50.         userReporitory.save(userModel);
    51.     }
    52.  
    53.     /**
    54.      * 登录
    55.      *
    56.      * @param username
    57.      * @param password
    58.      * @return
    59.      */
    60.     public JwtResult login(String username, String password) {
    61.         //检查用户是否存在
    62.         UserModel userModel = userReporitory.findByUsername(username);
    63.         if (null == userModel) {
    64.             throw new UsernameNotFoundException("用户不存在");
    65.         }
    66.         //匹配密码
    67.         String passwordEnc = userModel.getPassword();
    68.         if (!passwordEncoder.matches(password, passwordEnc)) {
    69.             try {
    70.                 throw new CredentialException("密码错误");
    71.             } catch (CredentialException e) {
    72.                 e.printStackTrace();
    73.             }
    74.             return null;
    75.         }
    76.         return JwtUtil.buildJwtResultByUsername(username, userModel.getAuthorities());
    77.     }
    78.  
    79. }

    这个UserService并没有去实现Securty的UserDetailService接口，因为逻辑完全是由我们自己处理的。

    1. package com.chris.demo.web;
    2.  
    3. import com.chris.demo.domain.JwtResult;
    4. import com.chris.demo.service.UserService;
    5. import org.springframework.beans.factory.annotation.Autowired;
    6. import org.springframework.web.bind.annotation.GetMapping;
    7. import org.springframework.web.bind.annotation.RequestMapping;
    8. import org.springframework.web.bind.annotation.RestController;
    9.  
    10. /**
    11.  * @author Chris Chan
    12.  * Create On 2022/11/23 16:09
    13.  * Use for: 用户接口
    14.  * Explain:
    15.  */
    16. @RestController
    17. @RequestMapping("api/user")
    18. public class UserController {
    19.     @Autowired
    20.     UserService accountService;
    21.  
    22.     /**
    23.      * 模拟注册
    24.      *
    25.      * @param username
    26.      * @param password
    27.      * @return
    28.      */
    29.     @GetMapping("reg")
    30.     public String reg(String username, String password, String roles) {
    31.         accountService.reg(username, password, roles);
    32.         return "reg success";
    33.     }
    34.  
    35.     /**
    36.      * 模拟登录
    37.      *
    38.      * @param username
    39.      * @param password
    40.      * @return
    41.      */
    42.     @GetMapping("login")
    43.     public JwtResult login(String username, String password) {
    44.         return accountService.login(username, password);
    45.     }
    46.  
    47.  
    48. }
    1. package com.chris.demo.web;
    2.  
    3. import org.springframework.security.access.annotation.Secured;
    4. import org.springframework.web.bind.annotation.GetMapping;
    5. import org.springframework.web.bind.annotation.RequestMapping;
    6. import org.springframework.web.bind.annotation.RestController;
    7.  
    8. import javax.annotation.security.RolesAllowed;
    9.  
    10. /**
    11.  * @author Chris Chan
    12.  * Create On 2022/11/23 16:41
    13.  * Use for: 业务接口
    14.  * Explain:
    15.  */
    16. @RestController
    17. @RequestMapping("api/biz")
    18. public class BizController {
    19.     /**
    20.      * 模拟业务调用
    21.      *
    22.      * @return
    23.      */
    24.     @GetMapping("test")
    25.     public String test() {
    26.         return "test success.";
    27.     }
    28.  
    29.     /**
    30.      * 权限验证
    31.      * @return
    32.      */
    33.     @RolesAllowed({"ADMIN"})
    34.     @GetMapping("test2")
    35.     public String test2() {
    36.         return "test2 success.";
    37.     }
    38. }

    两个接口文件，一个设计为UAA模块，一个设计为业务模块。业务接口有一个是测试权限的。

    测试结果：

    1.先注册一个用户:

     给定的权限是ROLE_USER，前面的ROLE_前缀是必须要加的，这是jsr250的权限校验规范要求的。

    2.登录，获得jwt

    3.将accessToken填入Authorization的Bearer Token模式，调用没有权限限制的接口

     

    4. 调用有权限限制的接口，报403

     

     5.另外注册一个用户权限设置为ROLE_ADMIN，登录获取accessToken，重新调用限权接口

    6.前端调用接口的时候实在header中增加一个key为Authorization的数据，其值为accessToken加上bearer+一个空格的前缀，就像这样

     

    完美！！ 

  • 相关阅读:
    第 4 章 串（串的堆分配存储实现）
    java毕业设计校园管理系统mybatis+源码+调试部署+系统+数据库+lw
    引入echarts.js操作步骤
    AI带你省钱旅游！精准预测民宿房源价格！ ⛵
    【Node.js】深度解析常用核心模块-path模块
    【MySQL】表的基本操作
    域名解析异常如何解决？快解析轻松实现动态域名解析
    vue项目身份认证，vuex，token
    Elasticsearch 开放 inference API 增加了对 Azure OpenAI 嵌入的支持
    input上传图片，并预览
  • 原文地址：https://blog.csdn.net/xxkalychen/article/details/128015285