（三）Spring Security增加验证码验证

￡神魔★判官ぃ 2021-12-12 00:15 400阅读 0赞

### 目录 ###

*  一：首先声明一个验证码异常
 *  二：创建一个验证码过滤器
 *  三：在WebSecurityConfig中添加过滤器
 *  四：controller输出验证码到页面
 *  五：前端接收
 *  六：项目地址

我们接着上一章 [(二）Spring Security自定义登录成功或失败处理器][Spring Security]，进行开发

# 一：首先声明一个验证码异常 #

/** * 声明一个验证码异常，用于抛出特定的验证码异常 */
    public class VerifyCodeException extends AuthenticationException { 
        public VerifyCodeException(String msg) { 
            super(msg);
        }
    }

# 二：创建一个验证码过滤器 #

@Component
    public class VerifyCodeFilter extends OncePerRequestFilter { 
        private static final Logger log = LoggerFactory.getLogger(VerifyCodeFilter.class);
        @Autowired
        private LoginFailureHandler loginFailureHandler;
        @Override
        protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { 
            if(request.getRequestURI().equals("/login")&&request.getMethod().equalsIgnoreCase("post")){ 
                try { 
                    validate(request);
                } catch (VerifyCodeException e) { 
                    loginFailureHandler.onAuthenticationFailure(request,response,e);
                    return;
                }
            }
            // 3. 校验通过，就放行
            filterChain.doFilter(request, response);
        }
        /* 验证保存在session的验证码和表单提交的验证码是否一致 */
        private void validate(HttpServletRequest request) throws ServletRequestBindingException { 
            String captcha = ServletRequestUtils.getStringParameter(request, "captcha");
            String code = (String) request.getSession().getAttribute(request.getParameter("uuid"));
            log.info("获取提交的code",captcha);
            log.info("获取保存的code",code);
            if(!code.equalsIgnoreCase(captcha)){ 
                throw new VerifyCodeException("验证码不正确！");
            }
            request.getSession().removeAttribute(request.getParameter("uuid"));
        }
    }

# 三：在WebSecurityConfig中添加过滤器 #

@Override
    protected void configure(HttpSecurity http) throws Exception { 
        http
                .authorizeRequests() /* 需要授权的请求 */
                .antMatchers("/login","/home").permitAll() /* 过滤不需要认证的路径 */
                .anyRequest().authenticated() /* 对任何一个请求，都需要认证 */
                .and() /* 完成上一个配置，进行下一步配置 */
                //.httpBasic();
                .formLogin() /* 配置表单登录 */
                .loginPage("/login") /* 设置登录页面 */
                .successHandler(successHandler)  /* 设置成功处理器 */
                .failureHandler(failureHandler)  /* 设置失败处理器*/
                .and()
                .logout() /* 登出 */
                .logoutSuccessUrl("/home"); /* 设置退出页面 */
        /* 添加验证码过滤器 */        
        http.addFilterBefore(verifyCodeFilter, UsernamePasswordAuthenticationFilter.class);
        }

# 四：controller输出验证码到页面 #

@RestController
    public class MainController { 
        @GetMapping(value = "/123")
        public Object login(){ 
            return "hello world";
        }
        @GetMapping("/getCode")
        public Object getCode(HttpServletRequest request) { 
            /* 生成验证码字符串 */
            String verifyCode = VerifyCodeUtil.generateVerifyCode(4);
            String uuid = UUIDUtil.GeneratorUUIDOfSimple();
            HttpSession session = request.getSession();
            session.setAttribute(uuid,verifyCode);
            int w = 111,h = 36;
            try (ByteArrayOutputStream stream = new ByteArrayOutputStream()) { 
                VerifyCodeUtil.outputImage(w, h, stream, verifyCode);
                return new BaseResult(ReturnCode.SUCCESS.getCode(), ReturnCode.SUCCESS.getMessage(),new ImgVO("data:image/gif;base64,"+ Base64Utils.encodeToString(stream.toByteArray()),uuid));
            } catch (IOException e) { 
                e.printStackTrace();
            }
            return null;
        }
    }

# 五：前端接收 #

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L1lDSl94aXlhbmc_size_16_color_FFFFFF_t_70]  
示例：  
![在这里插入图片描述][2019071010350424.gif]

# 六：项目地址 #

[Spring Security增加验证码验证][Spring Security 1]

[Spring Security]: https://blog.csdn.net/YCJ_xiyang/article/details/95231324
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L1lDSl94aXlhbmc_size_16_color_FFFFFF_t_70]: /images/20211211/2b277685565247ceacb25753a1d4c1dd.png
[2019071010350424.gif]: /images/20211211/59c444bebe374fa88441cd1f754a250a.png
[Spring Security 1]: https://gitee.com/xiyang_ycj/spring-security/tree/master/spring-security-third