spring security 开发基于表单的认证

一时失言乱红尘 2022-02-23 04:38 249阅读 0赞

终于进入 spring security 的章节了

### 文章目录 ###

*  http basic 安全验证
 *  实现用户名+密码认证
 *   *  创建 BrowserSecurityConfig 类 配置安全验证
     *  运行并测试
 *  基本原理
 *  自定义用户认证逻辑
 *   *  处理用户信息获取逻辑
     *  处理用户校验逻辑
     *  处理密码加密解密逻辑
     *  一些问题restful返回及登录路径可配置
     *   *  处理不同类型的请求
         *  SimpleResponse返回类型
         *  可配置的登录页面
         *  SecurityProperties
         *  BrowserProperties 浏览器配置属性
         *  最后要使配置生效SecurityCoreConfig
         *  demo中自定义登录页面
         *  BrowserSecurityConfig 使用配置类
         *  测试
 *  个性化用户认证流程
 *   *  自定义登录页面
     *  自定义登录处理
     *   *  禁用跨站攻击
     *  自定义登录成功处理
     *   *  创建一个类实现 \*\*AuthenticationSuccessHandler\*\* 接口
         *  配置successHandle查看authentication信息
     *  自定义失败处理
     *  成功与失败处理器重构为可配置
     *   *  定于返回类型枚举
         *  成功和失败处理改造
         *  测试

![在这里插入图片描述][20190406171109556.png]

# http basic 安全验证 #

在第一章构建项目中说到  
当项目依赖中 含有 spring security 的jar 包时  
它会有一个默认的安全配置http basic  
所有一开始我们用下面的注解移除掉了它的默认安全配置

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70]  
spring security 默认的安全验证我们一般是不用的

# 实现用户名+密码认证 #

开始开发基于表单的安全验证

## 创建 BrowserSecurityConfig 类 配置安全验证 ##

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 1]

@Configuration
    public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter {
    
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.formLogin()   //指定身份认证的方式为表单登录
                    .and()
                    .authorizeRequests() //对请求授权
                    .anyRequest()        //任何请求
                    .authenticated();    //安全认证
            //任何请求都必须经过表单验证才能进行访问
    
        }
    }

## 运行并测试 ##

直接运行我们这个项目 demoApplication ，发现报错

No qualifying bean of type 'org.springframework.security.config.annotation.ObjectPostProcessor<?>' available
    2019-04-06 19:31:05.208  INFO 18932 --- [           main] o.apache.catalina.core.StandardService   : Stopping service [Tomcat]

[https://stackoverflow.com/questions/32081578/spring-security-nosuchbeandefinitionexception-no-qualifying-bean-of-type-org][https_stackoverflow.com_questions_32081578_spring-security-nosuchbeandefinitionexception-no-qualifying-bean-of-type-org]  
原因是我们关闭了spring security的安全验证配置  
把红框里的注解去掉  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 2]

再次运行 成功  
访问 [http://localhost:8080/hello][http_localhost_8080_hello] 后会跳到登录界面

用户名为 user  
密码 在 控制台打印出了，这个密码每次启动都会变  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 3]  
当登录成功后，它又会跳到我们之前访问的url

如果还想用http basic 验证 ，只需更改一行代码  
![在这里插入图片描述][20190406194542276.png]  
这样就可以了

# 基本原理 #

主要是由一层层过滤器构成····  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 4]

# 自定义用户认证逻辑 #

## 处理用户信息获取逻辑 ##

用户信息的获取 在 spring security 中是被 封装在 userDetailService 接口中  
![在这里插入图片描述][20190406200445980.png]  
自定义自己的`userDetailService` 实现类  
![在这里插入图片描述][20190406202256313.png]

@Component
    public class MyUserDetailsService implements UserDetailsService {
        // 这里注入dao 层 用于查询数据库
    
        Logger logger = LoggerFactory.getLogger(getClass());
    
        public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {
            //根据用户名从数据库查找用户信息
    
            logger.info("登录用户名"+ userName);
            //我们要验证用户名 密码 并 查取权限
            //这个user是spring中的类，它实现了UserDetails 接口
            User admin = new User(userName, "123456",
                    AuthorityUtils.commaSeparatedStringToAuthorityList("admin"));//第三个参数是做授权的
            return admin;
        }
    }

启动应用 访问 [http://localhost:8080/hello][http_localhost_8080_hello] 输入用户密码后台报错  
![在这里插入图片描述][2019040620252826.png]  
原因：版本升级 因为Spring security 5.0中新增了多种加密方式，也改变了密码的格式。  
[https://spring.io/blog/2017/11/01/spring-security-5-0-0-rc1-released][https_spring.io_blog_2017_11_01_spring-security-5-0-0-rc1-released]  
[https://docs.spring.io/spring-security/site/docs/5.0.0.RELEASE/reference/htmlsingle/\#ns-password-encoder][https_docs.spring.io_spring-security_site_docs_5.0.0.RELEASE_reference_htmlsingle_ns-password-encoder]  
[https://www.cnblogs.com/majianming/p/7923604.html][https_www.cnblogs.com_majianming_p_7923604.html]  
[https://blog.csdn.net/Canon\_in\_D\_Major/article/details/79675033][https_blog.csdn.net_Canon_in_D_Major_article_details_79675033]  
解决：待会解决 需要配置 PasswordEncoder

## 处理用户校验逻辑 ##

用户是否冻结，密码是否过期等验证信息  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 5]

## 处理密码加密解密逻辑 ##

配置 PasswordEncoder

![在这里插入图片描述][2019040621020613.png]  
修改 MyUserDetailsService 的 loadUserByUsername 的方法  
![在这里插入图片描述][20190406210239995.png]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 6]

测试成功 ，也解决了之前的问题  
![在这里插入图片描述][20190406210446245.png]

注意 密码都是123456 ，但每次打印出来得密码都不一样 不像md5

因为他会随机生成一个盐，将随机生成的盐混在密码串里面，当他判断的时候 再用随机生成的盐来反推当时的密码串

## 一些问题restful返回及登录路径可配置 ##

![在这里插入图片描述][20190516142113194.png]  
1、我们前面说过restful返回的应该是状态码和json信息，但现在认证成功后返回的是一个html页面  
解决思路：如果是html请求就跳转到登录页面上，如果不是就返回json  
2、代码重构，使其可以自定义配置登录页面  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 7]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 8]

### 处理不同类型的请求 ###

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 9]

@RestController
    public class BrowserSecurityController {
    
        private Logger logger = LoggerFactory.getLogger(getClass());
    
        private RequestCache requestCache = new HttpSessionRequestCache();//缓存到session中的请求
    
        private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();//请求跳转工具
    
        @Autowired
        private SecurityProperties securityProperties;
    
        /**
         * 当需要身份认证时，跳转到这里
         *
         * @param request
         * @param response
         * @return
         * @throws IOException
         */
        @RequestMapping("/anthentication/require")
        @ResponseStatus(code = HttpStatus.UNAUTHORIZED)//401未授权状态码
        public SimpleResponse requireAuthentication(HttpServletRequest request, HttpServletResponse response)
                throws IOException {
    
            //拿到引发跳转的这个请求
            SavedRequest savedRequest = requestCache.getRequest(request, response);
    
            if (savedRequest != null) {
                String targetUrl = savedRequest.getRedirectUrl();
                logger.info("引发跳转的请求是:" + targetUrl);
                if (StringUtils.endsWithIgnoreCase(targetUrl, ".html")) {
                    redirectStrategy.sendRedirect(request, response, securityProperties.getBrowser().getLoginPage());// securityProperties.getBrowser().getLoginPage()配置登录页面
                }
            }
    
            return new SimpleResponse("访问的服务需要身份认证，请引导用户到登录页");
        }
    
    
    }

### SimpleResponse返回类型 ###

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 10]

public class SimpleResponse {
    	
    	public SimpleResponse(Object content){
    		this.content = content;
    	}
    	
    	private Object content;//Object可以返回任何对象
    
    	public Object getContent() {
    		return content;
    	}
    
    	public void setContent(Object content) {
    		this.content = content;
    	}
    	
    }

### 可配置的登录页面 ###

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 11]

### SecurityProperties ###

@ConfigurationProperties(prefix = "whale.security") //这个类会读取以whale.security开头的配置项
    public class SecurityProperties {
    	//浏览器配置
    	private BrowserProperties browser = new BrowserProperties();
    
    	public BrowserProperties getBrowser() {
    		return browser;
    	}
    
    	public void setBrowser(BrowserProperties browser) {
    		this.browser = browser;
    	}
    }

### BrowserProperties 浏览器配置属性 ###

public class  BrowserProperties {
    
    	private String loginPage = "/signIn.html";
    
    	public String getLoginPage() {
    		return loginPage;
    	}
    
    	public void setLoginPage(String loginPage) {
    		this.loginPage = loginPage;
    	}
    }

get set 属性方法要一致否则报错，无法启动

ConfigServletWebServerApplicationContext : Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'browserSecurityConfig': Unsatisfied dependency expressed through field 'securityProperties'; nested exception is org.springframework.boot.context.properties.ConfigurationPropertiesBindException: Error creating bean with name 'whale.security-com.whale.security.core.properties.SecurityProperties': Could not bind properties to 'SecurityProperties' : prefix=whale.security, ignoreInvalidFields=false, ignoreUnknownFields=true; nested exception is org.springframework.boot.context.properties.bind.BindException: Failed to bind properties under 'whale.security.browser' to com.whale.security.core.properties.BrowserProperties

### 最后要使配置生效SecurityCoreConfig ###

@Configuration
    @EnableConfigurationProperties(SecurityProperties.class)//使SecurityProperties中的配置生效
    public class SecurityCoreConfig {
    
    }

### demo中自定义登录页面 ###

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 12]

#配置登录页面
    whale.security.browser.loginPage = /demo-signIn.html

### BrowserSecurityConfig 使用配置类 ###

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 13]

@Configuration
    public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter {
    
        @Autowired
        private AuthenticationSuccessHandler whaleAuthenticationSuccessHandler;
        @Autowired
        private AuthenticationFailureHandler whaleAuthenctiationFailureHandler;
    
        @Autowired
        private SecurityProperties securityProperties;
    
        @Bean
        public PasswordEncoder passwordEncoder(){
            return new BCryptPasswordEncoder();//也可以自定义 只要实现PasswordEncoder接口
        }
    
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            //http.formLogin()   //指定身份认证的方式为表单登录
            //http.httpBasic()
    
            ValidateCodeFilter validateCodeFilter = new ValidateCodeFilter();
            validateCodeFilter.setAuthenticationFailureHandler(whaleAuthenctiationFailureHandler);//设置错误过滤器
    
            http.addFilterBefore(validateCodeFilter,UsernamePasswordAuthenticationFilter.class)
                    .formLogin()
    //                .loginPage("/signIn.html") //指定登录页面的url
    //                .loginPage("/anthentication/require") //指定登录页面的url
                    .loginPage(securityProperties.getBrowser().getLoginPage()) //指定登录页面的url
                    .loginProcessingUrl("/authentication/form")
                    .successHandler(whaleAuthenticationSuccessHandler)
                    .failureHandler(whaleAuthenctiationFailureHandler)
                    .permitAll()
                    .and()
                    .authorizeRequests() //对请求授权
    //                .antMatchers("/signIn.html","/code/image").permitAll() //加一个匹配器 对匹配的路径不进行身份认证
                    .antMatchers(securityProperties.getBrowser().getLoginPage(),"/code/image").permitAll() //加一个匹配器 对匹配的路径不进行身份认证
                    .anyRequest()        //任何请求
                    .authenticated()    //安全认证
                    .and()
                    .cors().disable().csrf().disable();// 禁用跨站攻击
                    // 默认都会产生一个hiden标签 里面有安全相关的验证 防止请求伪造 这边我们暂时不需要 可禁用掉
                    //任何请求都必须经过表单验证才能进行访问
    
           /* http.csrf().disable().cors().disable().headers().disable()
                    .authorizeRequests()
                    .antMatchers("/signIn.html").permitAll() // 配置不需要身份认证的请求地址
                    .anyRequest().authenticated() // 其他所有访问路径需要身份认证
                    .and()
                    .formLogin()
                    .loginPage("/signIn.html") // 指定登录请求地址
                    .loginProcessingUrl("/authentication/form")
                    .permitAll();
            */
    
    
        }
    }

### 测试 ###

![在这里插入图片描述][20190516153727578.png]

# 个性化用户认证流程 #

## 自定义登录页面 ##

定义登录页面 ，并配置 以及 可能出现的错误原因  
![在这里插入图片描述][20190406211921167.png]

<html>
    <head>
        <meta charset="UTF-8">
        <title>登录</title>
    </head>
    <body>
    <h2>标准登录页面</h2>
    <h3>表单登录</h3>
    <form action="/authentication/form" method="post">
        <table>
            <tr>
                <td>用户名:</td>
                <td><input type="text" name="username"></td>
            </tr>
            <tr>
                <td>密码:</td>
                <td><input type="password" name="password"></td>
            </tr>
            <tr>
                <td colspan="2"><button type="submit">登录</button></td>
            </tr>
        </table>
    </form>
    </body>
    </html>

配置登录页面 即 会有的错误  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 14]  
解决  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 15]  
启动测试 成功  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 16]

## 自定义登录处理 ##

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 17]  
![在这里插入图片描述][20190406213154252.png]  
具体要求和解释如下  
[https://docs.spring.io/spring-security/site/docs/5.2.0.BUILD-SNAPSHOT/api/org/springframework/security/config/annotation/web/configurers/FormLoginConfigurer.html][https_docs.spring.io_spring-security_site_docs_5.2.0.BUILD-SNAPSHOT_api_org_springframework_security_config_annotation_web_configurers_FormLoginConfigurer.html]

[https://docs.spring.io/spring-security/site/docs/5.2.0.BUILD-SNAPSHOT/reference/htmlsingle/\#jc-form][https_docs.spring.io_spring-security_site_docs_5.2.0.BUILD-SNAPSHOT_reference_htmlsingle_jc-form]

### 禁用跨站攻击 ###

但我不知道什么原因我的 `loginProcessingUrl` 设置一直失效，查了好久也没解决，后面有时间再看

**原因：spring security 提供了csrf跨站保护，需要把他关掉  
我看了别人的文章，只写`csrf().disable();` 是关不掉的，必须这样写 `.cors().disable().csrf().disable();// 禁用跨站攻击`  
完整代码如下：**

protected void configure(HttpSecurity http) throws Exception {
            //http.formLogin()   //指定身份认证的方式为表单登录
            //http.httpBasic()
            http.formLogin()
                    .loginPage("/signIn.html") //指定登录页面的url
                    .loginProcessingUrl("/authentication/form")
                    .permitAll()
                    .and()
                    .authorizeRequests() //对请求授权
                    .antMatchers("/signIn.html").permitAll() //加一个匹配器 对匹配的路径不进行身份认证
                    .anyRequest()        //任何请求
                    .authenticated()    //安全认证
                    .and()
                    .cors().disable().csrf().disable();// 禁用跨站攻击
                   // .headers().disable();
                    // 默认都会产生一个hiden标签 里面有安全相关的验证 防止请求伪造 这边我们暂时不需要 可禁用掉
                    //任何请求都必须经过表单验证才能进行访问
    
           /* http.csrf().disable().cors().disable().headers().disable()
                    .authorizeRequests()
                    .antMatchers("/signIn.html").permitAll() // 配置不需要身份认证的请求地址
                    .anyRequest().authenticated() // 其他所有访问路径需要身份认证
                    .and()
                    .formLogin()
                    .loginPage("/signIn.html") // 指定登录请求地址
                    .loginProcessingUrl("/authentication/form")
                    .permitAll();
         
            */
    
    
        }

## 自定义登录成功处理 ##

### 创建一个类实现 **AuthenticationSuccessHandler** 接口 ###

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 18]

@Component("whaleAuthenticationSuccessHandler")
    public class WhaleAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {
    
    	private Logger logger = LoggerFactory.getLogger(getClass());
    
    	// ObjectMapper spring mvc 提供的
    	@Autowired
    	private ObjectMapper objectMapper;
    
    
    	/*
    	 * (non-Javadoc)
    	 * 
    	 * @see org.springframework.security.web.authentication.
    	 * AuthenticationSuccessHandler#onAuthenticationSuccess(javax.servlet.http.
    	 * HttpServletRequest, javax.servlet.http.HttpServletResponse,
    	 * org.springframework.security.core.Authentication)
    	 */
    	@Override
    	public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
    										Authentication authentication) throws IOException, ServletException {
    
    		logger.info("登录成功");
    		response.setContentType("application/json;charset=UTF-8");
    		response.getWriter().write(objectMapper.writeValueAsString(authentication));
    
    	}
    }

### 配置successHandle查看authentication信息 ###

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 19]  
然后启动访问 [http://localhost:8080/hello][http_localhost_8080_hello]  
登录跳转到 [http://localhost:8080/authentication/form][http_localhost_8080_authentication_form]  
页面如下

{
    	"authorities": [{
    		"authority": "admin"
    	}],
    	"details": {
    		"remoteAddress": "0:0:0:0:0:0:0:1",
    		"sessionId": "49325D5A6ADCA79A3D53D3B823A32B41"
    	},
    	"authenticated": true,
    	"principal": {
    		"password": null,
    		"username": "admin",
    		"authorities": [{
    			"authority": "admin"
    		}],
    		"accountNonExpired": true,
    		"accountNonLocked": true,
    		"credentialsNonExpired": true,
    		"enabled": true
    	},
    	"credentials": null,
    	"name": "admin"
    }

## 自定义失败处理 ##

同自定义成功处理一样  
它要实现 AuthenticationFailureHandler接口  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 20]

@Component("whaleAuthenctiationFailureHandler")
    public class WhaleAuthenctiationFailureHandler implements AuthenticationFailureHandler {
    
    	private Logger logger = LoggerFactory.getLogger(getClass());
    	
    	@Autowired
    	private ObjectMapper objectMapper;
    
    	public void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException authenticationException ) throws IOException, ServletException {
    		logger.info("登录失败");
    		httpServletResponse.setStatus(HttpStatus.INTERNAL_SERVER_ERROR.value());
    		httpServletResponse.setContentType("application/json;charset=UTF-8");
    		httpServletResponse.getWriter().write(objectMapper.writeValueAsString(authenticationException));
    	}
    
    }

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 21]  
登录失败后  
跳转到 [http://localhost:8080/authentication/form][http_localhost_8080_authentication_form]

![在这里插入图片描述][20190424234345323.png]  
它也可以直接继承SimpleUrlAuthenticationFailureHandler 它是接口的默认实现

## 成功与失败处理器重构为可配置 ##

### 定于返回类型枚举 ###

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 22]

public enum LoginType {
        /**
         * 跳转
         */
        REDIRECT,
    
        /**
         * 返回json
         */
        JSON
    }

public class  BrowserProperties {
    
    	private String loginPage = "/signIn.html";
    
    	private LoginType loginType = LoginType.JSON;
    	·············

### 成功和失败处理改造 ###

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 23]

//implements AuthenticationFailureHandler
    @Component("whaleAuthenctiationFailureHandler")
    public class WhaleAuthenctiationFailureHandler extends SimpleUrlAuthenticationFailureHandler {
    
    	private Logger logger = LoggerFactory.getLogger(getClass());
    	
    	@Autowired
    	private ObjectMapper objectMapper;
    
    	@Autowired
    	private SecurityProperties securityProperties;
    
    	@Override
    	public void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException authenticationException ) throws IOException, ServletException {
    		logger.info("登录失败");
    		if(LoginType.JSON.equals(securityProperties.getBrowser().getLoginType())) {
    			httpServletResponse.setStatus(HttpStatus.INTERNAL_SERVER_ERROR.value());
    			httpServletResponse.setContentType("application/json;charset=UTF-8");
    			httpServletResponse.getWriter().write(objectMapper.writeValueAsString(authenticationException));
    		}else {
    			super.onAuthenticationFailure(httpServletRequest,httpServletResponse,authenticationException);
    		}
    
    	}
    
    }

//implements AuthenticationSuccessHandler
    @Component("whaleAuthenticationSuccessHandler")
    public class WhaleAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {
    
    	private Logger logger = LoggerFactory.getLogger(getClass());
    
    	// ObjectMapper spring mvc 提供的
    	@Autowired
    	private ObjectMapper objectMapper;
    
    	@Autowired
    	private SecurityProperties securityProperties;
    
    
    	/*
    	 * (non-Javadoc)
    	 * 
    	 * @see org.springframework.security.web.authentication.
    	 * AuthenticationSuccessHandler#onAuthenticationSuccess(javax.servlet.http.
    	 * HttpServletRequest, javax.servlet.http.HttpServletResponse,
    	 * org.springframework.security.core.Authentication)
    	 */
    	@Override
    	public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
    										Authentication authentication) throws IOException, ServletException {
    
    		logger.info("登录成功");
    		if(LoginType.JSON.equals(securityProperties.getBrowser().getLoginType())){
    			response.setContentType("application/json;charset=UTF-8");
    			response.getWriter().write(objectMapper.writeValueAsString(authentication));
    		}else {
    			//如果配置的返回类型不是json，则调用父类方法，进行跳转
    			super.onAuthenticationSuccess(request,response,authentication);
    		}
    
    
    	}
    }

### 测试 ###

demo中配置登录类型

whale.security.browser.loginType = REDIRECT

![在这里插入图片描述][20190516165918522.png]

[20190406171109556.png]: /images/20220223/6b0e6a703721402d8c2600b3437b9614.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70]: /images/20220223/2dbb577189664605bf78c125b92ccb17.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 1]: /images/20220223/fa015d0f72274520bcd045946056b809.png
[https_stackoverflow.com_questions_32081578_spring-security-nosuchbeandefinitionexception-no-qualifying-bean-of-type-org]: https://stackoverflow.com/questions/32081578/spring-security-nosuchbeandefinitionexception-no-qualifying-bean-of-type-org
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 2]: /images/20220223/242b5a2298684d45bdc23c46e31e07b1.png
[http_localhost_8080_hello]: http://localhost:8080/hello
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 3]: /images/20220223/6eaf5ca1d34a4c98b210cc8159687b5e.png
[20190406194542276.png]: /images/20220223/f9342670bec54924aa85367ebffcd20f.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 4]: /images/20220223/0edc0bc5c32549faaa718f1dc1fd0a31.png
[20190406200445980.png]: /images/20220223/4b3cdbca3b19482f84b3454fbe2adbb7.png
[20190406202256313.png]: /images/20220223/1b3753e73db54b71936a3d4b68b38c15.png
[2019040620252826.png]: /images/20220223/f660d0d0dfc04351a593825fe2c0a179.png
[https_spring.io_blog_2017_11_01_spring-security-5-0-0-rc1-released]: https://spring.io/blog/2017/11/01/spring-security-5-0-0-rc1-released
[https_docs.spring.io_spring-security_site_docs_5.0.0.RELEASE_reference_htmlsingle_ns-password-encoder]: https://docs.spring.io/spring-security/site/docs/5.0.0.RELEASE/reference/htmlsingle/#ns-password-encoder
[https_www.cnblogs.com_majianming_p_7923604.html]: https://www.cnblogs.com/majianming/p/7923604.html
[https_blog.csdn.net_Canon_in_D_Major_article_details_79675033]: https://blog.csdn.net/Canon_in_D_Major/article/details/79675033
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 5]: /images/20220223/7f3045fbb3e04ed480df855ac34e70dd.png
[2019040621020613.png]: /images/20220223/afa1e24173b14a638c444d0549fc5072.png
[20190406210239995.png]: /images/20220223/aa7f61e2ecfe434b88ec9a2ba317e5d0.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 6]: /images/20220223/59f9e87b457d41dc9aacf1ec3e2489fb.png
[20190406210446245.png]: /images/20220223/34edab9d35fa4d638b4167dfb47c8305.png
[20190516142113194.png]: /images/20220223/fe59453b5f4f485584c5704e5d4ddf5a.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 7]: /images/20220223/cc98d00070344d14bc9b0450f74f56c4.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 8]: /images/20220223/4800ec75dc4e470b8b745c81fc55e701.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 9]: /images/20220223/b688e0d701b8496e8dd93e949311c9c0.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 10]: /images/20220223/5d666863fa334111aa248ee46abf0f8c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 11]: /images/20220223/e3446d0686be46ffa50941577ee1dd21.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 12]: /images/20220223/7dbdcd96c56b436faad6f2037deee97e.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 13]: /images/20220223/1e450b51b60c4402b421af8dc4f91b4a.png
[20190516153727578.png]: /images/20220223/adec4efacbee4e4ea2c08aa138a0fe69.png
[20190406211921167.png]: /images/20220223/b853b91302d241e4b727da9a0dc69f01.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 14]: /images/20220223/6b59f32279f14b4ba5b79d3f1b2e3257.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 15]: /images/20220223/b8a16666e78943fd9cc13b80bca1f186.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 16]: /images/20220223/97d4272008fc420c84ceb7236731431f.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 17]: /images/20220223/5be75aed349745ae9a794021e4965687.png
[20190406213154252.png]: /images/20220223/6c0cc89f5049432eb18323170c54eab6.png
[https_docs.spring.io_spring-security_site_docs_5.2.0.BUILD-SNAPSHOT_api_org_springframework_security_config_annotation_web_configurers_FormLoginConfigurer.html]: https://docs.spring.io/spring-security/site/docs/5.2.0.BUILD-SNAPSHOT/api/org/springframework/security/config/annotation/web/configurers/FormLoginConfigurer.html
[https_docs.spring.io_spring-security_site_docs_5.2.0.BUILD-SNAPSHOT_reference_htmlsingle_jc-form]: https://docs.spring.io/spring-security/site/docs/5.2.0.BUILD-SNAPSHOT/reference/htmlsingle/#jc-form
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 18]: /images/20220223/aee4b1346ac943a6a7dceead0e943c06.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 19]: /images/20220223/79e3773a5dd0445088740340049db0ef.png
[http_localhost_8080_authentication_form]: http://localhost:8080/authentication/form
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 20]: /images/20220223/122238fc185d442bafb75c943cbab8c1.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 21]: /images/20220223/1f2cd3db795c49749d00af91958545fc.png
[20190424234345323.png]: /images/20220223/34af696bd554467e9b14d2e672804ab8.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 22]: /images/20220223/c6135175b299456691fabef651a0c405.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 23]: /images/20220223/eac1cd4d1f2e42058d36b2c79e2a24cf.png
[20190516165918522.png]: /images/20220223/4a5945945115402e853c3ca1f7b832a6.png