通过Security实现前后端分离的登录与权限控制
一、引入Security配置文件
org.springframework.boot
spring-boot-starter-security
二、新建SecurityConfiguration配置类
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.access.AccessDeniedHandler;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
import javax.annotation.Resource;
@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Resource(name = "UserDetailsServiceImpl")
private UserDetailsService userDetailsService;
@Resource
private PasswordEncoder passwordEncoder;
@Autowired
private AuthenticationSuccessHandler loginSuccessHandler;
@Autowired
private AuthenticationFailureHandler loginFailureHandler;
@Autowired
private AuthenticationEntryPoint authenticationEntryPoint;
@Autowired
private AccessDeniedHandler accessDeniedHandler;
@Autowired
private LogoutSuccessHandler logoutSuccessHandler;
@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
httpSecurity
.authorizeRequests()
//认证规则
.anyRequest().access("@rbacService.hasPermission(request,authentication)")
.and()
//开启表单登录
.formLogin().loginPage("/login").permitAll()
//登录失败处理
.failureHandler(loginFailureHandler)
//登录成功处理
.successHandler(loginSuccessHandler)
.and()
//没有权限处理
.exceptionHandling().accessDeniedHandler(accessDeniedHandler)
.and()
//未登录处理
.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint)
.and()
//退出成功处理
.logout().logoutSuccessHandler(logoutSuccessHandler).permitAll();
//开启跨域访问
httpSecurity.cors().disable();
//开启模拟请求，比如API POST测试工具的测试，不开启时，API POST为报403错误
httpSecurity.csrf().disable();
}
@Override
public void configure(WebSecurity web) {
//对于在header里面增加token等类似情况，放行所有OPTIONS请求。
web.ignoring().antMatchers(HttpMethod.OPTIONS, "/**");
// web.ignoring().antMatchers("/index.html", "/static/**", "/login_p", "/favicon.ico")
// // 给 swagger 放行；不需要权限能访问的资源
// .antMatchers("/swagger-ui.html", "/swagger-resources/**", "/images/**", "/webjars/**", "/v2/api-docs", "/configuration/ui", "/configuration/security");
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService)
.passwordEncoder(passwordEncoder);
}
三、实现未登录、登录成功、登录失败、没有权限、退出登录成功时的接口
1、未登录
@Component
public class AuthenticationEntryPointImpl implements AuthenticationEntryPoint {
@Autowired
private ObjectMapper objectMapper;
@Override
public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {
httpServletResponse.setContentType("application/json;charset=utf-8");
PrintWriter out = httpServletResponse.getWriter();
//ResponserJSON为自定义的用于返回JSON的类
out.write(objectMapper.writeValueAsString(new ResponseJSON().setUnLoginError()));
out.flush();
out.close();
}
}
2、登录成功
@Component
public class LoginSuccessHandlerImpl implements AuthenticationSuccessHandler {
@Autowired
private ObjectMapper objectMapper;
@Override
public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {
httpServletResponse.setContentType("application/json;charset=utf-8");
PrintWriter out = httpServletResponse.getWriter();
//ResponserJSON为自定义的用于返回JSON的类
out.write(objectMapper.writeValueAsString(new ResponseJSON().setSuccess("登录成功")));
out.flush();
out.close();
}
}
3、登录失败
@Component
public class LogoutSuccessHandlerImpl implements LogoutSuccessHandler {
@Autowired
private ObjectMapper objectMapper;
@Override
public void onLogoutSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {
httpServletResponse.setContentType("application/json;charset=utf-8");
PrintWriter out = httpServletResponse.getWriter();
//ResponserJSON为自定义的用于返回JSON的类
out.write(objectMapper.writeValueAsString(new ResponseJSON().setSuccess("注销成功")));
out.flush();
out.close();
}
}
4、没有权限
@Component
public class AccessDeniedHandlerImpl implements AccessDeniedHandler {
@Autowired
private ObjectMapper objectMapper;
@Override
public void handle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AccessDeniedException e) throws IOException, ServletException {
httpServletResponse.setContentType("application/json;charset=utf-8");
PrintWriter out = httpServletResponse.getWriter();
//ResponserJSON为自定义的用于返回JSON的类
out.write(objectMapper.writeValueAsString(new ResponseJSON().setError("没有权限")));
out.flush();
out.close();
}
}
5、退出登录成功
@Component
public class LogoutSuccessHandlerImpl implements LogoutSuccessHandler {
@Autowired
private ObjectMapper objectMapper;
@Override
public void onLogoutSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {
httpServletResponse.setContentType("application/json;charset=utf-8");
PrintWriter out = httpServletResponse.getWriter();
//ResponserJSON为自定义的用于返回JSON的类
out.write(objectMapper.writeValueAsString(new ResponseJSON().setSuccess("注销成功")));
out.flush();
out.close();
}
}
四、实现UserDetail接口
import lombok.Data;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;
import java.util.Collection;
@Component
@Data
//@Data为lombok的注解
public class User implements UserDetails {
//用户名
private String username;
//密码
private String password;
//非必须，根据需求可以定义更多的字段
private String phone;
private Collection extends GrantedAuthority> authorities;
public void setUsername(String username) {
this.username = username;
}
public void setPassword(String password) {
this.password = password;
}
public void setAuthorities(Collection extends GrantedAuthority> authorities) {
this.authorities = authorities;
}
@Override
public Collection extends GrantedAuthority> getAuthorities() {
return this.authorities;
}
@Override
public String getPassword() {
return this.password;
}
@Override
public String getUsername() {
return this.username;
}
@Override
public boolean isAccountNonExpired() {
return true;
}
@Override
public boolean isAccountNonLocked() {
return true;
}
@Override
public boolean isCredentialsNonExpired() {
return true;
}
@Override
public boolean isEnabled() {
return true;
}
}
五、实现UserDetailService接口
@Component("UserDetailsServiceImpl")
public class UserDetailsServiceImpl implements UserDetailsService {
//获取数据库中的user相关数据，自行设计
@Resource
private UserMapper userMapper;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
String password = userMapper.getPassword(username);
if (StringUtils.isBlank(password)){
throw new UsernameNotFoundException("账号不存在！");
}
User myUserDetail = new User();
myUserDetail.setUsername(username);
myUserDetail.setPassword(password);
return myUserDetail;
}
}
此类的作用是获取传入的username对应的密码，可以根据实际情况进行修改，账号不存在时可抛出UsernameNotFoundException异常
实现PasswordEncode接口
@Component
public class PasswordEncoderImpl implements PasswordEncoder {
@Override
public String encode(CharSequence charSequence) {
return charSequence.toString();
}
@Override
public boolean matches(CharSequence charSequence, String s) {
return encode(charSequence).equals(s);
}
}
此类主要用于对密码的加密以及与数据库中的密码进行比对，如果想要偷懒，也可以使用官方的NoOpPasswordEncoder(不推荐)类或BCryptPasswordEncoder类 ，使用方法为将SecurityConfiguration中的authenticationProvider方法的
authenticationProvider.setPasswordEncoder(passwordEncoder);
改为
authenticationProvider.setPasswordEncoder(NoOpPasswordEncoder.getInstance());
Spring5后强制要求密码不能明文传输，NoOpPasswordEncoder(不推荐)类为不加密的实现类，不安全，不推荐使用，可以使用Spring Security 中提供了BCryptPasswordEncoder密码编码工具
六、权限控制
通过编写自定义的service对权限进行控制
public interface RbacService {
boolean hasPermission(HttpServletRequest request, Authentication authentication);
}
@Component("rbacService")
public class RbacServiceImpl implements RbacService {
private AntPathMatcher antPathMatcher = new AntPathMatcher();
@Resource
private UserMapper userMapper;
@Override
public boolean hasPermission(HttpServletRequest request, Authentication authentication) {
Object principal = authentication.getPrincipal();
boolean hasPermission = false;
if (principal instanceof UserDetails) { //首先判断先当前用户是否是我们UserDetails对象。
String userName = ((UserDetails) principal).getUsername();
//连接数据库获取用户有权限的url,根据业务自行修改
List urls = userMapper.getMenuByUserName(userName);
// 注意这里不能用equal来判断，因为有些URL是有参数的，所以要用AntPathMatcher来比较
for (String url : urls) {
if (antPathMatcher.match(url, request.getRequestURI())) {
hasPermission = true;
break;
}
}
}
return hasPermission;
}
}
编写完后通过在SecurityConfiguation中添加如下代码实现权限控制
.anyRequest().access("@rbacService.hasPermission(request,authentication)")