SpringCloud微服务安全（二）API安全 2-7 授权

向右看齐 2023-01-18 06:48 145阅读 0赞

### 1. 授权 ###

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjQwNTY3MA_size_16_color_FFFFFF_t_70][]

**访问控制：**

1. ACL ：Access Control Lists，直接给每个用户授权，他能访问什么。开发简单，但是用户多的话，给每个用户授权比较麻烦。

2. RBAC：Role Based Access Control。给角色授权，给用户赋予角色。授权简单，开发麻烦。

## 2.ACL来实现简单的权限控制 ##

**方式：**在用户表里加入permission字段标识权限。

### 2.1 创建 AclInterceptor 权限拦截 ###

package com.imooc.security.filter;
    
    import com.imooc.security.user.User;
    import org.springframework.http.HttpStatus;
    import org.springframework.stereotype.Component;
    import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
    
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    
    /**
     * @ClassName AclInterceptor
     * @Description TODO
     * @Author wushaopei
     * @Date 2021/5/2 13:12
     * @Version 1.0
     */
    @Component
    public class AclInterceptor extends HandlerInterceptorAdapter{
    
    
        @Override
        public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
    
            boolean result = true;
            User user = (User)request.getAttribute("user");
    
            if(user == null){
                response.setContentType("text/plain");
                response.getWriter().write("need authentication");
                response.setStatus(HttpStatus.UNAUTHORIZED.value());
                result = false;
            }else{
                String method = request.getMethod();
    
                if(!user.hasPermission(method)){
                    response.setContentType("text/plain");
                    response.getWriter().write("forbidden");
                    response.setStatus(HttpStatus.FORBIDDEN.value());
                    result = false;
                }
            }
            return result;
        }
    }

注册到容器：

registry.addInterceptor(aclInterceptor);

### 2.2 User新增permissions权限字段 ###

/**
         * @Description TODO 权限字段
         */
        @Column
        private String permissions;
    
    
       /**
         * @Description TODO 根据请求的method来判断是否有访问当前接口的权限
         * @param method
         * @return
         */
        public boolean hasPermission(String method) {
            boolean result = false;
            // 判断该权限是读还是写
            if(StringUtils.equalsIgnoreCase("get",method)){
                result = StringUtils.contains(permissions, "r");
            }else {
                result = StringUtils.contains(permissions,"w");
            }
            return result;
        }

### 2.3 测试授权 ###

**已授权的访问：**

**当前用户权限为可读可写**

![20210502134053494.png][]

访问结果：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjQwNTY3MA_size_16_color_FFFFFF_t_70 1][]

**未授权的访问：**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjQwNTY3MA_size_16_color_FFFFFF_t_70 2][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjQwNTY3MA_size_16_color_FFFFFF_t_70]: /images/20221021/a026a9553f5743ef99851b262e947db7.png
[20210502134053494.png]: /images/20221021/389410b4e86143958238bba1853988b2.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjQwNTY3MA_size_16_color_FFFFFF_t_70 1]: /images/20221021/fc72ca628e97408fbc86cfd2daec77b7.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjQwNTY3MA_size_16_color_FFFFFF_t_70 2]: /images/20221021/eb1e1baa02dc4163a142074f7f7cf12a.png