1，首先先贴一下项目结构更容易梳理思路，文章较长请细心阅读。
2.创建User用户和UserPermissons用户权限实体类，在生成token时会需要用户的账号密码和权限。还需要几个工具类，现在一步步为大家展示。
yml配置文件
# 端口
server:
port: 8080
# 数据库连接配置
spring:
datasource:
driver-class-name: com.mysql.cj.jdbc.Driver
url: jdbc:mysql://localhost:3306/数据库?useUnicode=true&characterEncoding=utf-8&serverTimezone=Asia/Shanghai
username: root
password: root
# 自定义jwt key
jwt:
tokenHeader: Authorization #JWT存储的请求头
secret: java@java #JWT加解密使用的密钥
expiration: 600 #JWT的超期限时间60*10
tokenHead: Bearer #JWT负载中拿到开头
# 配置Swagger
swagger:
basePackage: com.mujiwulian.controller
title: Swagger-ui测试
description: SpringSecurity接口测试
version: 1.0创建JwtTokenUtil工具类，这个类用来生成包含权限账户密码的token。package com.mujiwulian.util;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
/**
* @author zhang
* @since 2020-06-19
* TODO JwtToken生成的工具类
*/
@Component
public class JwtTokenUtil {
private static final Logger LOGGER = LoggerFactory.getLogger(JwtTokenUtil.class);
private static final String CLAIM_KEY_USERNAME = "sub";
private static final String CLAIM_KEY_CREATED = "created";
@Value("${jwt.secret}")
private String secret;
@Value("${jwt.expiration}")
private Long expiration;
@Value("${jwt.tokenHead}")
private String tokenHead;
/**
* 从token中获取JWT中的负载
*/
private Claims getClaimsFromToken(String token) {
Claims claims = null;
try {
claims = Jwts.parser()
.setSigningKey(secret)
.parseClaimsJws(token)
.getBody();
} catch (Exception e) {
LOGGER.info("JWT格式验证失败:{}",token);
}
return claims;
}
/**
* 生成token的过期时间
*/
private Date generateExpirationDate() {
return new Date(System.currentTimeMillis() + expiration * 1000);
}
/**
* 从token中获取登录用户名
* 从token中获取登录用户的信息
*/
public String getUserNameFromToken(String token) {
String username;
try {
Claims claims = getClaimsFromToken(token);
username = claims.getSubject();
} catch (Exception e) {
username = null;
}
return username;
}
/**
* 验证token是否还有效
*
* @param token 客户端传入的token
* @param userDetails 从数据库中查询出来的用户信息
*/
public boolean validateToken(String token, UserDetails userDetails) {
String username = getUserNameFromToken(token);
return username.equals(userDetails.getUsername()) && !isTokenExpired(token);
}
/**
* 判断token是否已经失效
*/
private boolean isTokenExpired(String token) {
Date expiredDate = getExpiredDateFromToken(token);
return expiredDate.before(new Date());
}
/**
* 从token中获取过期时间
*/
private Date getExpiredDateFromToken(String token) {
Claims claims = getClaimsFromToken(token);
return claims.getExpiration();
}
/**
* 根据用户信息生成token
*/
public String generateToken(UserDetails userDetails) {
Map<String, Object> claims = new HashMap<>();
claims.put(CLAIM_KEY_USERNAME, userDetails.getUsername());
claims.put(CLAIM_KEY_CREATED, new Date());
return generateToken(claims);
}
/**
* 用于根据登录用户信息生成token
* 根据负责生成JWT的token
*/
private String generateToken(Map<String, Object> claims) {
return tokenHead+Jwts.builder()
.setClaims(claims)
.setExpiration(generateExpirationDate())
.signWith(SignatureAlgorithm.HS512, secret)
.compact();
}
/**
* 判断token是否可以被刷新
*/
public boolean canRefresh(String token) {
return !isTokenExpired(token);
}
/**
* 刷新token
*/
public String refreshToken(String token) {
Claims claims = getClaimsFromToken(token);
claims.put(CLAIM_KEY_CREATED, new Date());
return generateToken(claims);
}
}枚举定义下返回的code码，用来表示不同的权限。package com.mujiwulian.util;
/**
* @author zhang
* @since 2020-06-19
*/
public enum ResultCode {
SUCCESS(200, "操作成功"),
FAILED(500, "操作失败"),
VALIDATE_FAILED(404, "参数检验失败"),
UNAUTHORIZED(401, "暂未登录或token已经过期"),
FORBIDDEN(403, "没有相关权限");
private long code;
private String message;
private ResultCode(long code, String message) {
this.code = code;
this.message = message;
}
public long getCode() {
return code;
}
public String getMessage() {
return message;
}
}设置了code码当然要有自己定义的Result返回类。package com.mujiwulian.util;
/**
* @author zhang
* @since 2020-06-19
*/
public class Result <T> {
private long code;
private String message;
private T data;
protected Result() {
}
protected Result(long code, String message, T data) {
this.code = code;
this.message = message;
this.data = data;
}
/**
* 成功返回结果
*
* @param data 获取的数据
*/
public static <T> Result<T> success(T data) {
return new Result<T>(ResultCode.SUCCESS.getCode(), ResultCode.SUCCESS.getMessage(), data);
}
/**
* 成功返回结果
*
* @param data 获取的数据
* @param message 提示信息
*/
public static <T> Result<T> success(T data, String message) {
return new Result<T>(ResultCode.SUCCESS.getCode(), message, data);
}
/**
* 失败返回结果
* @param errorCode 错误码
*/
public static <T> Result<T> failed(IErrorCode errorCode) {
return new Result<T>(errorCode.getCode(), errorCode.getMessage(), null);
}
/**
* 失败返回结果
* @param message 提示信息
*/
public static <T> Result<T> failed(String message) {
return new Result<T>(ResultCode.FAILED.getCode(), message, null);
}
/**
* 失败返回结果
* @param failed
*/
public static <T> Result<T> failed(ResultCode failed) {
return failed(ResultCode.FAILED);
}
/**
* 参数验证失败返回结果
*/
public static <T> Result<T> validateFailed() {
return failed(ResultCode.VALIDATE_FAILED);
}
/**
* 参数验证失败返回结果
* @param message 提示信息
*/
public static <T> Result<T> validateFailed(String message) {
return new Result<T>(ResultCode.VALIDATE_FAILED.getCode(), message, null);
}
/**
* 未登录返回结果
*/
public static <T> Result<T> unauthorized(T data) {
return new Result<T>(ResultCode.UNAUTHORIZED.getCode(), ResultCode.UNAUTHORIZED.getMessage(), data);
}
/**
* 未授权返回结果
*/
public static <T> Result<T> forbidden(T data) {
return new Result<T>(ResultCode.FORBIDDEN.getCode(), ResultCode.FORBIDDEN.getMessage(), data);
}
public long getCode() {
return code;
}
public void setCode(long code) {
this.code = code;
}
public String getMessage() {
return message;
}
public void setMessage(String message) {
this.message = message;
}
public T getData() {
return data;
}
public void setData(T data) {
this.data = data;
}
}package com.mujiwulian.util;
/**
* @author zhang
* @since 2020-06-19
* TODO 封装API的错误码
*/
public interface IErrorCode {
long getCode();
String getMessage();
}3.准备工作做好后，就可以进入今天的主角了。我们通过jwt的工具类已经生成了token，现在肯定要对token进行拦截解析数据。所以需要来写一个过滤器。
创建JwtAuthenticationTokenFilter拦截器继承springframework.web.filter的OncePerRequestFilter拦截器。通过request.getHeader()的方法获取带自定义头部（在ymi文件配置的tokenHead属性），在把含有自定义的头部信息去除。token通过jwt的工具类取出用户名，完成比对。
package com.mujiwulian.security;
import com.mujiwulian.util.JwtTokenUtil;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.web.filter.OncePerRequestFilter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* @author zhang
* @since 2020-06-19
* TODO JWT登录授权过滤器 ,
* 在用户名和密码校验前添加的过滤器，
* 如果请求中有jwt的token且有效，会取出token中的用户名，
* 然后调用SpringSecurity的API进行登录操作。
*/
public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
private static final Logger LOGGER = LoggerFactory.getLogger(JwtAuthenticationTokenFilter.class);
@Autowired
private UserDetailsService userDetailsService;
@Autowired
private JwtTokenUtil jwtTokenUtil;
@Value("${jwt.tokenHeader}")
private String tokenHeader;
@Value("${jwt.tokenHead}")
private String tokenHead;
@Override
protected void doFilterInternal(HttpServletRequest request,
HttpServletResponse response,
FilterChain chain) throws ServletException, IOException {
String authHeader = request.getHeader(this.tokenHeader);
if (authHeader != null && authHeader.startsWith(this.tokenHead)) {
String authToken = authHeader.substring(this.tokenHead.length());
// The part after "Bearer "
String username = jwtTokenUtil.getUserNameFromToken(authToken);
LOGGER.info("checking username:{}", username);
if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
if (jwtTokenUtil.validateToken(authToken, userDetails)) {
UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
LOGGER.info("authenticated user:{}", username);
SecurityContextHolder.getContext().setAuthentication(authentication);
}
}
}
chain.doFilter(request, response);
}
}比对会产生不同的结果，就需要我们去自定义去实现各种不同的返回结果。
先定义当未登录或者token失效访问接口时，自定义的返回结果package com.mujiwulian.security;
import cn.hutool.json.JSONUtil;
import com.mujiwulian.util.*;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.stereotype.Component;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* @author zhang
* @since 2020-06-19
* TODO 当未登录或者token失效访问接口时，自定义的返回结果
*/
@Component
public class RestAuthenticationEntryPoint implements AuthenticationEntryPoint {
@Override
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException e) throws IOException, ServletException {
response.setCharacterEncoding("UTF-8");
response.setContentType("application/json");
response.getWriter().println(JSONUtil.parse(Result.unauthorized(e.getMessage())));
response.getWriter().flush();
}
}在定义当访问接口没有权限时自定义的返回结果package com.mujiwulian.security;
import cn.hutool.json.JSONUtil;
import com.mujiwulian.util.*;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.web.access.AccessDeniedHandler;
import org.springframework.stereotype.Component;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* @author zhang
* @since 2020-06-19
* TODO 当访问接口没有权限时，自定义的返回结果
*/
@Component
public class RestfulAccessDeniedHandler implements AccessDeniedHandler {
@Override
public void handle(HttpServletRequest request,
HttpServletResponse response,
AccessDeniedException e) throws IOException, ServletException {
response.setCharacterEncoding("UTF-8");
response.setContentType("application/json");
response.getWriter().println(JSONUtil.parse(Result.forbidden(e.getMessage())));
response.getWriter().flush();
}
}到这里你肯定会有疑问，在做拦截器比对的时候UserDetailsService的数据从哪来的，这就需要我们将自己定义的AdminUserDetails来实现security自带的UserDetails接口了。
package com.mujiwulian.security;
import com.mujiwulian.entity.*;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import java.util.Collection;
import java.util.List;
import java.util.stream.Collectors;
/**
* TODO: 实现UserDetails接口并实现方法
*
* @author ZHANG
* @email zhang@email.com
* @date 2020/6/19 14:58
*/
public class AdminUserDetails implements UserDetails {
private User user;
private List<UserPermissions> permissionList;
public AdminUserDetails(User user, List<UserPermissions> permissionList) {
this.user = user;
this.permissionList = permissionList;
}
/**
* 得到授权，返回权限
* @return
*/
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return permissionList.stream()
.filter(umsPermission -> umsPermission.getValue()!=null)
.map(umsPermission -> new SimpleGrantedAuthority(umsPermission.getValue()))
.collect(Collectors.toList());
}
@Override
public String getPassword() {
return user.getPassword();
}
@Override
public String getUsername() {
return user.getUsername();
}
/**
* 账号未过期
* @return
*/
@Override
public boolean isAccountNonExpired() {
return true;
}
/**
* 账号未锁定
* @return
*/
@Override
public boolean isAccountNonLocked() {
return true;
}
/**
* 账号凭证是否过期
* @return
*/
@Override
public boolean isCredentialsNonExpired() {
return true;
}
/**
* 账号是否启用
* @return
*/
@Override
public boolean isEnabled() {
return user.getStatus().equals(1);
}
}4.拦截各种工作都做好了，还需要配置security才能生效。
创建一个SecurityConfig配置类，里面的配置在下面也有详细的说明。
package com.mujiwulian.config;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.mujiwulian.entity.*;
import com.mujiwulian.security.AdminUserDetails;
import com.mujiwulian.security.JwtAuthenticationTokenFilter;
import com.mujiwulian.security.RestAuthenticationEntryPoint;
import com.mujiwulian.security.RestfulAccessDeniedHandler;
import com.mujiwulian.service.UserPermissionsService;
import com.mujiwulian.service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.util.StringUtils;
import java.util.List;
/**
* TODO: 类描述
*
* @author ZHANG
* @email zhang@email.com
* @date 2020/6/19 11:20
*/
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled=true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private UserService userService;
@Autowired
private UserPermissionsService userPermissionsService;
@Autowired
private RestfulAccessDeniedHandler restfulAccessDeniedHandler;
@Autowired
private RestAuthenticationEntryPoint restAuthenticationEntryPoint;
@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
httpSecurity.csrf()// 由于使用的是JWT，我们这里不需要csrf
.disable()
.sessionManagement()// 基于token，所以不需要session
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()
// 允许对于网站静态资源的无授权访问
.antMatchers(HttpMethod.GET,
"/",
"/*.html",
"/favicon.ico",
"/**/*.html",
"/**/*.css",
"/**/*.js",
"/swagger-resources/**",
"/v2/api-docs/**",
"/swagger-ui.html/*"
)
.permitAll()
// 对登录注册要允许匿名访问
.antMatchers("/admin/login", "/admin/register")
.permitAll()
//跨域请求会先进行一次options请求
.antMatchers(HttpMethod.OPTIONS)
.permitAll()
//测试时全部运行访问
.antMatchers("/**")
.permitAll()
.anyRequest()// 除上面外的所有请求全部需要鉴权认证
.authenticated();
// 禁用缓存
httpSecurity.headers().cacheControl();
// 添加JWT filter
httpSecurity.addFilterBefore(jwtAuthenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class);
//添加自定义未授权和未登录结果返回
httpSecurity.exceptionHandling()
.accessDeniedHandler(restfulAccessDeniedHandler)
.authenticationEntryPoint(restAuthenticationEntryPoint);
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService())
.passwordEncoder(passwordEncoder());
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Override
@Bean
public UserDetailsService userDetailsService() {
//获取登录用户信息
return username -> {
QueryWrapper<User> qw=new QueryWrapper<>();
qw.lambda().eq(!StringUtils.isEmpty(username),User::getUsername,username);
User user = userService.getOne(qw);
if (user != null) {
QueryWrapper<UserPermissions> qwp=new QueryWrapper<>();
qwp.lambda().eq(!StringUtils.isEmpty(user.getAuthorities()),UserPermissions::getId,user.getAuthorities());
List<UserPermissions> permissionList =userPermissionsService.list();
return new AdminUserDetails(user,permissionList);
}
throw new UsernameNotFoundException("用户名或密码错误");
};
}
@Bean
public JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter(){
return new JwtAuthenticationTokenFilter();
}
@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
/**
* configure(HttpSecurity httpSecurity)：用于配置需要拦截的url路径、jwt过滤器及出异常后的处理器；
* configure(AuthenticationManagerBuilder auth)：用于配置UserDetailsService及PasswordEncoder；
* RestfulAccessDeniedHandler：当用户没有访问权限时的处理器，用于返回JSON格式的处理结果；
* RestAuthenticationEntryPoint：当未登录或token失效时，返回JSON格式的结果；
* UserDetailsService:SpringSecurity定义的核心接口，用于根据用户名获取用户信息，需要自行实现；
* UserDetails：SpringSecurity定义用于封装用户信息的类（主要是用户信息和权限），需要自行实现；
* PasswordEncoder：SpringSecurity定义的用于对密码进行编码及比对的接口，目前使用的是BCryptPasswordEncoder；
* JwtAuthenticationTokenFilter：在用户名和密码校验前添加的过滤器，如果有jwt的token，会自行根据token信息进行登录。
*/
}5.配置完成后我们来测试一下。
写一个登录的controller
package com.mujiwulian.controller;
import com.mujiwulian.entity.User;
import com.mujiwulian.entity.UserPermissions;
import com.mujiwulian.service.UserService;
import com.mujiwulian.util.Result;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiOperation;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.*;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
/**
* <p>
* 前端控制器
* </p>
*
* @author zhang
* @since 2020-06-19
*/
@Api(tags = "UserController" ,description = "后台用户管理")
@RestController
@RequestMapping("/user")
public class UserController {
@Autowired
private UserService userService;
@Value("${jwt.tokenHeader}")
private String tokenHeader;
@Value("${jwt.tokenHead}")
private String tokenHead;
@ApiOperation(value = "用户注册")
@PostMapping(value = "/register")
public Result<User> register(@RequestBody User user) {
User umsAdmin = userService.register(user);
if (umsAdmin == null) {
Result.failed("注册失败，该用户已被注册！");
}
return Result.success(umsAdmin);
}
@ApiOperation(value = "登录以后返回token")
@PostMapping(value = "/login")
public Result login(@RequestBody User user) {
String token = userService.login(user.getUsername(), user.getPassword());
if (token == null) {
return Result.validateFailed("用户名或密码错误");
}
Map<String, String> tokenMap = new HashMap<>();
tokenMap.put("token", token);
tokenMap.put("tokenHead", tokenHead);
System.out.println("token:"+token);
return Result.success(tokenMap);
}
@ApiOperation("获取用户所有权限（包括+-权限）")
@GetMapping(value = "/permission/{userId}")
public Result<List<UserPermissions>> getPermissionList(@PathVariable Long userId) {
List<UserPermissions> permissionList = userService.getPermissionList(userId);
return Result.success(permissionList);
}
@ApiOperation("根据条件获取所有的用户")
@PostMapping(value = "/list")
@PreAuthorize("hasAuthority('pms:brand:order')")
public Result<List<User>> getuserList(@RequestBody User user) {
List<User> list=userService.getlist(user);
return Result.success(list);
}
}这里在显示下我的service实体接口就不显示了。我这里用的是mybatis-plus。这些都不是重点。。。。。。package com.mujiwulian.service.impl;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.mujiwulian.entity.User;
import com.mujiwulian.entity.UserPermissions;
import com.mujiwulian.mapper.UserMapper;
import com.mujiwulian.service.UserPermissionsService;
import com.mujiwulian.service.UserService;
import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
import com.mujiwulian.util.JwtTokenUtil;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;
import org.springframework.util.StringUtils;
import javax.annotation.Resource;
import java.util.List;
/**
* <p>
* 服务实现类
* </p>
*
* @author zhang
* @since 2020-06-19
*/
@Service
public class UserServiceImpl extends ServiceImpl<UserMapper, User> implements UserService {
private static final Logger LOGGER = LoggerFactory.getLogger(UserServiceImpl.class);
@Resource
private UserMapper userMapper;
@Resource
private PasswordEncoder passwordEncoder;
@Resource
private UserDetailsService userDetailsService;
@Resource
private JwtTokenUtil jwtTokenUtil;
@Resource
private UserPermissionsService userPermissionsService;
@Override
public User register(User user) {
QueryWrapper<User> qw=new QueryWrapper<>();
qw.lambda().eq(!StringUtils.isEmpty(user.getUsername()),User::getUsername,user.getUsername());
if( this.list(qw).size()>0){
return null;
}
//密码加密
user.setPassword(passwordEncoder.encode(user.getPassword()));
userMapper.insert(user);
return user;
}
@Override
public String login(String username, String password) {
String token="";
try {
UserDetails userDetails = userDetailsService.loadUserByUsername(username);
if (!passwordEncoder.matches(password, userDetails.getPassword())) {
throw new BadCredentialsException("密码不正确");
}
UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
SecurityContextHolder.getContext().setAuthentication(authentication);
token = jwtTokenUtil.generateToken(userDetails);
} catch (AuthenticationException e) {
LOGGER.warn("登录异常:{}", e.getMessage());
}
return token;
}
@Override
public List<UserPermissions> getPermissionList(Long userId) {
QueryWrapper<UserPermissions> qwp=new QueryWrapper<>();
qwp.lambda().eq(!StringUtils.isEmpty(userId),UserPermissions::getId,userId);
List<UserPermissions> permissionList =userPermissionsService.list();
return permissionList;
}
@Override
public List<User> getlist(User user) {
QueryWrapper<User> qw=new QueryWrapper<>();
qw.lambda()
.like(!StringUtils.isEmpty(user.getUsername()),User::getUsername,user.getUsername())
.eq(!StringUtils.isEmpty(user.getPassword()),User::getPassword,user.getPassword())
.like(!StringUtils.isEmpty(user.getNickName()),User::getNickName,user.getNickName())
.eq(!StringUtils.isEmpty(user.getStatus()),User::getStatus,user.getStatus());
return this.list(qw);
}
}我这里是导入了swagger的包，就用swqgger测试下。老规矩先展示swagger的配置类。package com.mujiwulian.config;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import springfox.documentation.builders.ApiInfoBuilder;
import springfox.documentation.builders.PathSelectors;
import springfox.documentation.builders.RequestHandlerSelectors;
import springfox.documentation.service.ApiInfo;
import springfox.documentation.service.ApiKey;
import springfox.documentation.service.AuthorizationScope;
import springfox.documentation.service.SecurityReference;
import springfox.documentation.spi.DocumentationType;
import springfox.documentation.spi.service.contexts.SecurityContext;
import springfox.documentation.spring.web.plugins.Docket;
import springfox.documentation.swagger2.annotations.EnableSwagger2;
import java.util.ArrayList;
import java.util.List;
/**
* TODO: 类描述
*
* @author ZHANG
* @email zhang@email.com
* @date 2020/6/19 10:21
*/
@Configuration
@EnableSwagger2
public class Swagger2Config {
/**
* controller接口所在的包
*/
@Value("${swagger.basePackage}")
private String basePackage;
/**
* 当前文档的标题
*/
@Value("${swagger.title}")
private String title;
/**
* 当前文档的详细描述
*/
@Value("${swagger.description}")
private String description;
/**
* 当前文档的版本
*/
@Value("${swagger.version}")
private String version;
@Bean
public Docket createRestApi() {
return new Docket(DocumentationType.SWAGGER_2)
.apiInfo(apiInfo())
.select()
//为当前包下controller生成API文档
.apis(RequestHandlerSelectors.basePackage(basePackage))
.paths(PathSelectors.any())
.build()
//添加登录认证
.securitySchemes(securitySchemes())
.securityContexts(securityContexts());
}
private ApiInfo apiInfo() {
return new ApiInfoBuilder()
.description(description)
.version(version)
.title(title)
.build();
}
private List<ApiKey> securitySchemes(){
//设置请求头信息
List<ApiKey> result = new ArrayList<>();
ApiKey apiKey = new ApiKey("Authorization", "Authorization", "header");
result.add(apiKey);
return result;
}
private List<SecurityContext> securityContexts() {
//设置需要登录认证的路径
List<SecurityContext> result = new ArrayList<>();
result.add(SecurityContext.builder()
.securityReferences(defaultAuth())
.forPaths(PathSelectors.regex("^(?!auth).*$"))
.build());
return result;
}
private List<SecurityReference> defaultAuth() {
List<SecurityReference> result = new ArrayList<>();
AuthorizationScope authorizationScope = new AuthorizationScope("global", "accessEverything");
AuthorizationScope[] authorizationScopes = new AuthorizationScope[1];
authorizationScopes[0] = authorizationScope;
result.add(new SecurityReference("Authorization", authorizationScopes));
return result;
}
}6.输入localhost：8080/swagger-ui.html，找到登陆的接口进行测试
这就是登录后产生的token，前面的Bearer是我们自定义的开头，后面的是jwt的token。将token复制后放到Authorize。这个表示为全局token
如果接口无@PreAuthorize()不会进行权限拦截，加入后如果无对应的权限则会提示无权限。
7.本次分享到此结束。发现问题及时联系，大家一起共同成长。
本文章为转载内容，我们尊重原作者对文章享有的著作权。如有内容错误或侵权问题，欢迎原作者联系我们进行内容更正或删除文章。
