spring-boot+Spring-security+jwt控制权限

我不是女神ヾ 2022-01-14 12:13 162阅读 0赞

本权限基于spring boot + spring security + jwt 进行权限控制，用户登录和实际权限部分，本例固定在初始化中。username + 123456 进行。

以下是相关全部源代码。如果用户需要在数据库中存取用户和权限，仅需要更新部分验证用户部分即可。

POM.xml

<?xml version="1.0" encoding="UTF-8"?>
    <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
        <modelVersion>4.0.0</modelVersion>
        <parent>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-parent</artifactId>
            <version>2.1.5.RELEASE</version>
            <relativePath/> 
        </parent>
        <groupId>com.soft</groupId>
        <artifactId>files_server</artifactId>
        <version>0.0.1-SNAPSHOT</version>
        <name>files_server</name>
        <description>Demo project for Spring Boot</description>
    
        <properties>
            <springframework.cloud.version>2.0.1.RELEASE</springframework.cloud.version>
            <java.version>1.8</java.version>
            <mongodb.version>3.8.2</mongodb.version>
            <imgscalr.version>4.2</imgscalr.version>
            <fastjson.version>1.2.54</fastjson.version>
            <pagehelper.version>5.1.1</pagehelper.version>
            <lombok.version>1.18.2</lombok.version>
            <slf4j.version>1.7.25</slf4j.version>
            <logback.version>1.2.3</logback.version>
            <jjwt.version>0.9.0</jjwt.version>
        </properties>
    
        <dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-web</artifactId>
            </dependency>
    
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-test</artifactId>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-data-mongodb</artifactId>
            </dependency>
            <dependency>
                <groupId>org.mongodb</groupId>
                <artifactId>mongo-java-driver</artifactId>
                <version>${mongodb.version}</version>
            </dependency>
    
            <dependency>
                <groupId>org.imgscalr</groupId>
                <artifactId>imgscalr-lib</artifactId>
                <version>${imgscalr.version}</version>
            </dependency>
            <dependency>
                <groupId>com.alibaba</groupId>
                <artifactId>fastjson</artifactId>
                <version>${fastjson.version}</version>
            </dependency>
            <dependency>
                <groupId>com.github.pagehelper</groupId>
                <artifactId>pagehelper</artifactId>
                <version>${pagehelper.version}</version>
            </dependency>
            <dependency>
                <groupId>org.projectlombok</groupId>
                <artifactId>lombok</artifactId>
                <version>${lombok.version}</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-api</artifactId>
                <version>${slf4j.version}</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-context</artifactId>
                <version>${springframework.cloud.version}</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-security</artifactId>
            </dependency>
    
            <dependency>
                <groupId>io.jsonwebtoken</groupId>
                <artifactId>jjwt</artifactId>
                <version>${jjwt.version}</version>
            </dependency>
        </dependencies>
    
        <build>
            <plugins>
                <plugin>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-maven-plugin</artifactId>
                </plugin>
            </plugins>
        </build>
    
    </project>

MyPasswordEncoder.java

package com.soft.security;
    
    import org.springframework.security.crypto.password.PasswordEncoder;
    
    public class MyPasswordEncoder implements PasswordEncoder {
        @Override
        public String encode(CharSequence charSequence) {
            return charSequence.toString();
        }
    
        @Override
        public boolean matches(CharSequence charSequence, String s) {
            return s.equals(charSequence.toString());
        }
    }

MyAuthenticationProvider.java

package com.soft.security;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.authentication.AuthenticationProvider;
    import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.stereotype.Component;
    
    @Component
    public class MyAuthenticationProvider implements AuthenticationProvider {
    
        @Autowired
        private UserDetailsService userDetailsService;
    
        /**
         * 自定义验证方式
         */
        @Override
        public Authentication authenticate(Authentication authentication) throws AuthenticationException {
            String username = authentication.getName();
            String password = (String) authentication.getCredentials();
            UserDetails  user = userDetailsService.loadUserByUsername(username);
            if(user.getPassword().equals(password)) {
                return new UsernamePasswordAuthenticationToken(username, null, user.getAuthorities());
            }
            return null;
        }
    
        @Override
        public boolean supports(Class<?> arg0) {
            return true;
        }
    
    }

WebSecurityConfig.java

package com.soft.global;
    
    import java.util.ArrayList;
    import java.util.Collection;
    import com.soft.filter.JWTAuthenticationFilter;
    import com.soft.filter.JWTLoginFilter;
    import com.soft.security.MyAuthenticationProvider;
    import com.soft.security.MyPasswordEncoder;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.authority.SimpleGrantedAuthority;
    import org.springframework.security.core.userdetails.User;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.crypto.password.PasswordEncoder;
    import org.springframework.security.provisioning.InMemoryUserDetailsManager;
    
    @Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    
        @Autowired
        private MyAuthenticationProvider provider;// 自定义的AuthenticationProvider
    
        @Bean
        public PasswordEncoder myPasswordEncoder() {
            return new MyPasswordEncoder();//自定义的加密工具
        }
    
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.authorizeRequests()
                    // 设置放行的接口，开放权限的接口，在开放的接口配置上有设置权限的接口以接口权限为限制。
                    .antMatchers("/{api}/{version}/doc/**").permitAll()
                    .antMatchers("/{api}/{version}/file/**").permitAll()
                    .anyRequest().authenticated()
                    .and()
                    .formLogin().loginProcessingUrl("/login")
                    .and()
                    .csrf().disable()
                    .addFilter(new JWTLoginFilter(authenticationManager()))
                    .addFilter(new JWTAuthenticationFilter(authenticationManager()));
        }
    
        @Override
        public void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.authenticationProvider(provider);
            auth.userDetailsService(userDetailsService());
        }
    
        @Bean
        public UserDetailsService userDetailsService() {
            InMemoryUserDetailsManager iud = new InMemoryUserDetailsManager();
            Collection<GrantedAuthority> adminAuth = new ArrayList<>();
            adminAuth.add(new SimpleGrantedAuthority("ROLE_USER"));
            iud.createUser(new User("username", "123456", adminAuth));
            return iud;
        }
    
    }

JWTLoginFilter.java

package com.soft.filter;
    
    import java.io.IOException;
    import java.io.PrintWriter;
    import java.util.ArrayList;
    import java.util.Date;
    import java.util.stream.Collectors;
    import javax.servlet.FilterChain;
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
    import io.jsonwebtoken.Claims;
    import io.jsonwebtoken.Jwts;
    import io.jsonwebtoken.SignatureAlgorithm;
    
    /**
     * 验证用户名密码正确后，生成一个token，并将token返回给客户端
     * 该类继承自UsernamePasswordAuthenticationFilter，重写了其中的2个方法 ,
     * attemptAuthentication：接收并解析用户凭证。
     * successfulAuthentication：用户成功登录后，这个方法会被调用，我们在这个方法里生成token并返回。
     *
     */
    public class JWTLoginFilter extends UsernamePasswordAuthenticationFilter {
    
        private AuthenticationManager authenticationManager;
    
        public JWTLoginFilter(AuthenticationManager authenticationManager) {
            this.authenticationManager = authenticationManager;
        }
    
        @Override
        public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
                throws AuthenticationException {
            String username = request.getParameter("username");
            String password = request.getParameter("password");
            return authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password, new ArrayList<>()));
        }
    
        @Override
        protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,
                                                Authentication auth) throws IOException, ServletException {
            Claims claims = Jwts.claims();
            claims.put("role", auth.getAuthorities().stream().map(s -> s.getAuthority()).collect(Collectors.toList()));
            String token = Jwts.builder()
                    .setClaims(claims)
                    .setSubject(auth.getName())
                    .setExpiration(new Date(System.currentTimeMillis() + 60 * 60 * 24 * 1000))
                    .signWith(SignatureAlgorithm.HS512, "MyJwtSecret11").compact();
            response.setCharacterEncoding("UTF-8");
            response.setContentType("application/json; charset=utf-8");
            String str = "{\"token\":\"" + token + "\"}";
            PrintWriter out;
            try {
                out = response.getWriter();
                out.print(str);
                out.flush();
                out.close();
            } catch (IOException e) {
                e.printStackTrace();
            }
        }
    }

JWTAuthenticationFilter.java

package com.soft.filter;
    
    import java.io.IOException;
    import java.util.List;
    import java.util.stream.Collectors;
    import javax.servlet.FilterChain;
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    import org.springframework.security.core.authority.SimpleGrantedAuthority;
    import org.springframework.security.core.context.SecurityContextHolder;
    import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
    import io.jsonwebtoken.Claims;
    import io.jsonwebtoken.Jwts;
    
    public class JWTAuthenticationFilter extends BasicAuthenticationFilter {
        public JWTAuthenticationFilter(AuthenticationManager authenticationManager) {
            super(authenticationManager);
        }
    
        /**
         * 在拦截器中获取token并解析，
         * 拿到用户信息，放置到SecurityContextHolder，
         * 这样便完成了spring security和jwt的整合。
         */
        @Override
        protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
                throws IOException, ServletException {
            String header = request.getHeader("Authorization");
            if (header == null || !header.startsWith("Bearer")) {
                chain.doFilter(request, response);
                return;
            }
            UsernamePasswordAuthenticationToken authentication = getAuthentication(request);
            SecurityContextHolder.getContext().setAuthentication(authentication);
            chain.doFilter(request, response);
        }
    
        private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request) {
            String token = request.getHeader("Authorization");
            if (token != null) {
    
                Claims claims = Jwts.parser().setSigningKey("MyJwtSecret11").parseClaimsJws(token.replace("Bearer ", ""))
                        .getBody();
                String user  = claims.getSubject();
                @SuppressWarnings("unchecked")
                List<String> roles = claims.get("role", List.class);
                List<SimpleGrantedAuthority> auth = roles.stream().map(s -> new SimpleGrantedAuthority(s)).collect(Collectors.toList());
    
                if (user != null) {
                    return new UsernamePasswordAuthenticationToken(user, null, auth);
                }
                return null;
            }
            return null;
        }
    
    }