springboot集成websocket持久连接（权限过滤+拦截）

痛定思痛。 2023-10-14 19:44 9阅读 0赞

#### 文章目录 ####

*  1、为什么要使用WebSocket？
 *  2、配置方式一：实现ServletContextInitializer+@ServerEndpoint注解
 *   *  2.1、WebSocket配置
     *  2.2、WebSocket连接，@ServerEndpoint
     *  2.3、WebSocket请求过滤
     *  2.4、postman建立客户端连接
 *  3、配置方式二：实现WebSocketConfigurer+继承TextWebSocketHandler
 *   *  3.1、配置：实现WebSocketConfigurer
     *  3.2、配置：WebSocket握手，实现对websocket请求的拦截
     *  3.3、实现WebSocket服务，监听socket客户端的连接
     *  3.4、postman测试，发起websocket请求
 *  参考链接

springboot关于websocket依赖，pom.xml：集成springboot最小依赖，不进行任何服务连接，单独启动项目

<parent>
          <groupId>org.springframework.boot</groupId>
          <artifactId>spring-boot-starter-parent</artifactId>
          <version>2.2.5.RELEASE</version>
      </parent>
    
    
    <dependencies>
      <dependency>
          <groupId>org.springframework.boot</groupId>
          <artifactId>spring-boot-starter</artifactId>
      </dependency>
      
      <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
        <exclusions>
            
            <exclusion>
                <artifactId>spring-boot-starter-tomcat</artifactId>
                <groupId>org.springframework.boot</groupId>
            </exclusion>
        </exclusions>
      </dependency>
      
      <dependency>
          <groupId>org.springframework.boot</groupId>
          <artifactId>spring-boot-starter-undertow</artifactId>
      </dependency>
      
      <dependency>
          <groupId>org.springframework.boot</groupId>
          <artifactId>spring-boot-starter-websocket</artifactId>
      </dependency>
    <dependencies>

## 1、为什么要使用WebSocket？ ##

因为一般的请求都是HTTP请求（单向通信），HTTP是一个短连接（非持久化），且通信只能由客户端发起，HTTP协议做不到服务器主动向客户端推送消息。举个例子：前后端交互就是前端发送请求，从后端拿到数据后展示到页面，如果前端没有主动请求接口，那后端就不能发送数据给前端。然而，WebSocket确能很好的解决这个问题，服务端可以主动向客户端推送消息，客户端也可以主动向服务端发送消息，实现了服务端和客户端真正的平等。  
![image.png][]

## 2、配置方式一：实现ServletContextInitializer+@ServerEndpoint注解 ##

### 2.1、WebSocket配置 ###

package com.chengfu.config;
    
    import org.springframework.boot.web.servlet.ServletContextInitializer;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.web.socket.server.standard.ServerEndpointExporter;
    
    import javax.servlet.ServletContext;
    import javax.servlet.ServletException;
    
    @Configuration
    public class WebSocketConfig implements ServletContextInitializer {
        
    
        //    原文链接：https://blog.csdn.net/weixin_44185837/article/details/124942482
        /**
         * 这个bean的注册,用于扫描带有@ServerEndpoint的注解成为websocket,如果你使用外置的tomcat就不需要该配置文件
         */
        @Bean
        public ServerEndpointExporter serverEndpointExporter() {
        
            return new ServerEndpointExporter();
        }
    
        @Override
        public void onStartup(ServletContext servletContext) throws ServletException {
        
    
        }
    }

### 2.2、WebSocket连接，@ServerEndpoint ###

package com.chengfu.socket;
    
    import lombok.extern.slf4j.Slf4j;
    import org.springframework.stereotype.Component;
    
    import javax.websocket.*;
    import javax.websocket.server.PathParam;
    import javax.websocket.server.ServerEndpoint;
    import java.io.IOException;
    import java.util.concurrent.ConcurrentHashMap;
    import java.util.concurrent.CopyOnWriteArraySet;
    
    /**
     * websocket服务端，接收websocket客户端长连接
     */
    @ServerEndpoint("/websocket/api1/{id}")
    @Component
    @Slf4j
    public class WebSocketServer {
        
    
        // 与某个客户端的连接会话，需要通过它来给客户端发送数据
        private Session session;
    
        // session集合,存放对应的session
        private static ConcurrentHashMap<Integer, Session> sessionPool = new ConcurrentHashMap<>();
    
        // concurrent包的线程安全Set,用来存放每个客户端对应的WebSocket对象。
        private static CopyOnWriteArraySet<WebSocketServer> webSocketSet = new CopyOnWriteArraySet<>();
    
        /**
         * 建立WebSocket连接
         *
         * @param session
         * @param userId  用户ID
         */
        @OnOpen
        public void onOpen(Session session, @PathParam(value = "id") Integer userId) {
        
            log.info("WebSocket建立连接中,连接用户ID：{}", userId);
            try {
        
                Session historySession = sessionPool.get(userId);
                // historySession不为空,说明已经有人登陆账号,应该删除登陆的WebSocket对象
                if (historySession != null) {
        
                    webSocketSet.remove(historySession);
                    historySession.close();
                }
            } catch (IOException e) {
        
                log.error("重复登录异常,错误信息：" + e.getMessage(), e);
            }
            // 建立连接
            this.session = session;
            webSocketSet.add(this);
            sessionPool.put(userId, session);
            log.info("建立连接完成,当前在线人数为：{}", webSocketSet.size());
        }
    
        /**
         * 发生错误
         *
         * @param throwable e
         */
        @OnError
        public void onError(Throwable throwable) {
        
            throwable.printStackTrace();
        }
    
        /**
         * 连接关闭
         */
        @OnClose
        public void onClose() {
        
            webSocketSet.remove(this);
            log.info("连接断开,当前在线人数为：{}", webSocketSet.size());
        }
    
        /**
         * 接收客户端消息
         *
         * @param message 接收的消息
         */
        @OnMessage
        public void onMessage(String message) {
        
            log.info("收到客户端发来的消息：{}", message);
        }
    
        /**
         * 推送消息到指定用户
         *
         * @param userId  用户ID
         * @param message 发送的消息
         */
        public static void sendMessageByUser(Integer userId, String message) {
        
            log.info("用户ID：" + userId + ",推送内容：" + message);
            Session session = sessionPool.get(userId);
            try {
        
                session.getBasicRemote().sendText(message);
            } catch (IOException e) {
        
                log.error("推送消息到指定用户发生错误：" + e.getMessage(), e);
            }
        }
    
        /**
         * 群发消息
         *
         * @param message 发送的消息
         */
        public static void sendAllMessage(String message) {
        
            log.info("发送消息：{}", message);
            for (WebSocketServer webSocket : webSocketSet) {
        
                try {
        
                    webSocket.session.getBasicRemote().sendText(message);
                } catch (IOException e) {
        
                    log.error("群发消息发生错误：" + e.getMessage(), e);
                }
            }
        }
    }

### 2.3、WebSocket请求过滤 ###

找了一些资料没发现springboot有处理@ServerEndpoint注解的websocket请求，但是可以使用servlet容器技术来实现ws请求的过滤。ws请求的拦截可以通过配置方式二来实现，详见下。

package com.chengfu.config;
    
    import org.apache.commons.lang3.StringUtils;
    import org.springframework.stereotype.Component;
    
    import javax.servlet.*;
    import javax.servlet.http.HttpServletRequest;
    import java.io.IOException;
    import java.util.Arrays;
    
    /**
     * servlet级别请求过滤
     */
    @Component
    public class WebSocketFilterConfig implements Filter {
        
    
        // websocket请求过滤清单
        private static final String[] FILTER_LIST = {
        "/websocket/api1/"};
    
        @Override
        public void init(FilterConfig filterConfig) throws ServletException {
        
            Filter.super.init(filterConfig);
        }
    
        @Override
        public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        
            HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest;
            String servletPath = httpServletRequest.getServletPath();
    
            // anyMatch： 有一个条件满足就返回true
            boolean match = Arrays.stream(FILTER_LIST).anyMatch(servletPath::startsWith);
            // boolean match = Arrays.stream(FILTER_LIST).anyMatch(filterUrl -> servletPath.startsWith(filterUrl));
    
            // 符合ws请求的url开始校验，其他请求一概放过
            if (match) {
        
                String token = httpServletRequest.getHeader("token");
                if (StringUtils.isNotBlank(token)) {
        
                    filterChain.doFilter(servletRequest, servletResponse);
                }
    //            else {
        
    //                JSONObject result = new JSONObject();
    //                HttpServletResponse httpServletResponse = (HttpServletResponse) servletResponse;
    //                httpServletResponse.setContentType("application/json;charset=utf-8");
    //                httpServletResponse.setCharacterEncoding("utf-8");
    //                PrintWriter writer = httpServletResponse.getWriter();
    //                writer.write(result.toJSONString());
    //                writer.flush();
    //                writer.close();
    //            }
            } else {
        
                // 不包含过滤清单，直接放过请求
                filterChain.doFilter(servletRequest, servletResponse);
            }
    
        }
    
        @Override
        public void destroy() {
        
            Filter.super.destroy();
        }
    }

### 2.4、postman建立客户端连接 ###

![image.png][image.png 1]  
![image.png][image.png 2]  
连接成功！  
![image.png][image.png 3]

## 3、配置方式二：实现WebSocketConfigurer+继承TextWebSocketHandler ##

### 3.1、配置：实现WebSocketConfigurer ###

package com.chengfu.config;
    
    import com.chengfu.interceptor.WebSocketAuthInterceptor;
    import com.chengfu.socket.WebSocketServer2;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.web.socket.config.annotation.EnableWebSocket;
    import org.springframework.web.socket.config.annotation.WebSocketConfigurer;
    import org.springframework.web.socket.config.annotation.WebSocketHandlerRegistry;
    
    // 启用配置
    @Configuration
    // 启用websocket服务端
    @EnableWebSocket
    public class WebSocketConfig2 implements WebSocketConfigurer {
        
    
        // 原文链接：https://blog.csdn.net/weixin_44185837/article/details/124942482
        // 实现自： WebSocketConfigurer
        // 注册websocket拦截器
        @Override
        public void registerWebSocketHandlers(WebSocketHandlerRegistry webSocketHandlerRegistry) {
        
            webSocketHandlerRegistry
                    // 只有符合"/websocket/api2/**", "/websocket/api3/**"的请求url，才能进入WebSocketServer2的服务端连接进行数据处理
                    .addHandler(new WebSocketServer2(), "/websocket/api2/**", "/websocket/api3/**")
                    // WebSocketServer2的握手拦截器处理：尽量避免被无用的请求攻击，在建立连接的时候通过检查授权成功之后才能进行访问
                    .addInterceptors(new WebSocketAuthInterceptor())
                    // 允许跨域访问
                    .setAllowedOrigins("*");
        }
    }

### 3.2、配置：WebSocket握手，实现对websocket请求的拦截 ###

package com.chengfu.interceptor;
    
    import lombok.extern.slf4j.Slf4j;
    import org.apache.commons.lang3.StringUtils;
    import org.springframework.http.HttpHeaders;
    import org.springframework.http.server.ServerHttpRequest;
    import org.springframework.http.server.ServerHttpResponse;
    import org.springframework.stereotype.Component;
    import org.springframework.web.socket.WebSocketHandler;
    import org.springframework.web.socket.server.HandshakeInterceptor;
    
    import java.util.List;
    import java.util.Map;
    
    /**
     * websocket握手拦截
     */
    @Component
    @Slf4j
    public class WebSocketAuthInterceptor implements HandshakeInterceptor {
        
    
        /**
         * 返回true允许直接通过，返回false拒绝连接
         *
         * @param serverHttpRequest
         * @param serverHttpResponse
         * @param webSocketHandler
         * @param map
         * @return
         * @throws Exception
         */
        @Override
        public boolean beforeHandshake(ServerHttpRequest serverHttpRequest, ServerHttpResponse serverHttpResponse, WebSocketHandler webSocketHandler, Map<String, Object> map) throws Exception {
        
            log.error("握手开始！");
            // 确保授权正确才能进行websocket连接
            HttpHeaders headers = serverHttpRequest.getHeaders();
            List<String> header = headers.get("token");
            if (header == null || header.size() == 0) {
        
                return false;
            }
    
            String token = header.get(0);
            if (StringUtils.isBlank(token)) {
        
                return false;
            }
            // TODO: token do something
            log.error("握手token:{}", token);
            return true;
        }
    
        @Override
        public void afterHandshake(ServerHttpRequest serverHttpRequest, ServerHttpResponse serverHttpResponse, WebSocketHandler webSocketHandler, Exception e) {
        
            log.error("握手结束");
        }
    }

### 3.3、实现WebSocket服务，监听socket客户端的连接 ###

package com.chengfu.socket;
    
    import lombok.extern.slf4j.Slf4j;
    import org.springframework.http.HttpHeaders;
    import org.springframework.stereotype.Component;
    import org.springframework.web.socket.CloseStatus;
    import org.springframework.web.socket.TextMessage;
    import org.springframework.web.socket.WebSocketSession;
    import org.springframework.web.socket.handler.TextWebSocketHandler;
    
    import java.io.IOException;
    import java.time.LocalDateTime;
    import java.util.concurrent.ConcurrentHashMap;
    
    // 配合webSocketConfig2使用
    @Component
    @Slf4j
    public class WebSocketServer2 extends TextWebSocketHandler {
        
    
        /**
         * socket 建立成功事件 @OnOpen
         *
         * @param session
         * @throws Exception
         */
        @Override
        public void afterConnectionEstablished(WebSocketSession session) throws Exception {
        
            // websocket入参
            // ===============从url上面获取参数
            String rawPath = session.getUri().getRawPath(); //
            String rawQuery = session.getUri().getRawQuery();//  从url上面获取参数
            String query = session.getUri().getQuery(); //  从url上面获取参数
            // =================
    
            // ================从header上面获取参数
            HttpHeaders headers = session.getHandshakeHeaders(); // 从header上获取参数
            // ================
    
            String token = headers.get("token").get(0);
            if (token != null) {
        
                WebSocketSession s = WebSessionManager.get(token);
                if (s != null) {
        
                    // 当前用户之前已经建立连接，关闭
                    WebSessionManager.remove(token);
                }
                // 重新建立session
                WebSessionManager.add(token, session);
                log.error("建立websocket连接：{}", token);
            }
    
        }
    
        /**
         * 接收消息事件 @OnMessage
         *
         * @param session
         * @param message
         * @throws Exception
         */
        @Override
        protected void handleTextMessage(WebSocketSession session, TextMessage message) throws Exception {
        
            // 获得客户端传来的消息
            String payload = message.getPayload();
            System.out.println("server 接收到发送的消息 " + payload);
            // 服务端发送回去
            session.sendMessage(new TextMessage("server 发送消息 " + payload + " " + LocalDateTime.now()));
        }
    
        /**
         * socket 断开连接时 @OnClose
         *
         * @param session
         * @param status
         * @throws Exception
         */
        @Override
        public void afterConnectionClosed(WebSocketSession session, CloseStatus status) throws Exception {
        
            Object token = session.getAttributes().get("token");
            if (token != null) {
        
                // 用户退出，移除缓存
                WebSessionManager.remove(token.toString());
            }
        }
    }
    
    // 来源：https://www.cnblogs.com/meow-world/articles/16283492.html
    // websocket的session管理器
    class WebSessionManager {
        
        /**
         * 保存连接 session 的地方
         */
        private static final ConcurrentHashMap<String, WebSocketSession> SESSION_POOL = new ConcurrentHashMap<>();
    
        /**
         * 添加 session
         *
         * @param key
         */
        public static void add(String key, WebSocketSession session) {
        
            // 添加 session
            SESSION_POOL.put(key, session);
        }
    
        /**
         * 删除 session,会返回删除的 session
         *
         * @param key
         * @return
         */
        public static WebSocketSession remove(String key) {
        
            // 删除 session
            return SESSION_POOL.remove(key);
        }
    
        /**
         * 删除并同步关闭连接
         *
         * @param key
         */
        public static void removeAndClose(String key) {
        
            WebSocketSession session = remove(key);
            if (session != null) {
        
                try {
        
                    // 关闭连接
                    session.close();
                } catch (IOException e) {
        
                    // todo: 关闭出现异常处理
                    e.printStackTrace();
                }
            }
        }
    
        /**
         * 获得 session
         *
         * @param key
         * @return
         */
        public static WebSocketSession get(String key) {
        
            // 获得 session
            return SESSION_POOL.get(key);
        }
    }

### 3.4、postman测试，发起websocket请求 ###

注！

1. postman版本要升级到10以上，我这里测试版本为v10.17.1；  
2. Ctrl+N，打开创建请求的小窗，选择WebSocket；

![image.png][image.png 4]  
**postman请求地址：**  
![image.png][image.png 5]  
建立websocket连接之前，先进行**握手**处理，检查headers参数之后，如果符合要求，开始建立连接。  
![image.png][image.png 6]  
拦截发现headers没有token标识，拒绝客户端连接请求，请求头添加token后，重新请求：  
![image.png][image.png 7]  
![image.png][image.png 8]  
检测到token之后，成功建立连接：  
![image.png][image.png 9]

## 参考链接 ##

1.  [SpringBoot使用WebSocket\_springboot websocket\_仰望银河系的博客-CSDN博客][SpringBoot_WebSocket_springboot websocket_-CSDN]
2.  [Springboot——拦截器\_springboot 拦截器\_我爱布朗熊的博客-CSDN博客][Springboot_springboot _-CSDN]
3.  [实现Websocket集群及通信的第二种方式（含拦截器）\_websockethandler\_Second小二的博客-CSDN博客][Websocket_websockethandler_Second_-CSDN]
4.  [springboot整合websocket握手拦截器 - meow\_world - 博客园][springboot_websocket_ - meow_world -]
5.  [Postman 使用 WebSocket 请求\_w3cschool][Postman _ WebSocket _w3cschool]

[image.png]: https://img-blog.csdnimg.cn/img_convert/a4d2503ac9ca797d4595578d91749b38.png#averageHue=#48abc3&clientId=u9df02626-6c07-4&from=paste&height=460&id=uafd3a003&originHeight=685&originWidth=854&originalType=url&ratio=1.3499999046325684&rotation=0&showTitle=false&size=199933&status=done&style=none&taskId=ue46b9dd4-378b-4df7-9a4a-44f649decf7&title=&width=573.9931030273438
[image.png 1]: https://img-blog.csdnimg.cn/img_convert/96863dce961577583c3821b54e1d47f9.png#averageHue=#fbf9f9&clientId=u9df02626-6c07-4&from=paste&height=234&id=uae5ba583&originHeight=497&originWidth=1297&originalType=binary&ratio=1.3499999046325684&rotation=0&showTitle=false&size=54879&status=done&style=none&taskId=ueee53210-93da-4507-ba78-ba6820e155d&title=&width=609.3634643554688
[image.png 2]: https://img-blog.csdnimg.cn/img_convert/a07002804c270f5a71e673eb892e916c.png#averageHue=#2f2c2b&clientId=u9df02626-6c07-4&from=paste&height=195&id=ue3a63ea8&originHeight=432&originWidth=1359&originalType=binary&ratio=1.3499999046325684&rotation=0&showTitle=false&size=100680&status=done&style=none&taskId=u3df4e872-6859-4295-92cc-64907a1b6e3&title=&width=614.3565063476562
[image.png 3]: https://img-blog.csdnimg.cn/img_convert/4015a10f0d5b0a3b5a0cee2729eb5f30.png#averageHue=#fafafa&clientId=u9df02626-6c07-4&from=paste&height=112&id=u3c016774&originHeight=238&originWidth=1309&originalType=binary&ratio=1.3499999046325684&rotation=0&showTitle=false&size=31940&status=done&style=none&taskId=u726d5943-10bd-4c88-95b9-721c117da80&title=&width=613.3611450195312
[image.png 4]: https://img-blog.csdnimg.cn/img_convert/56bab98ff2681c21fdab8d42f2fb18db.png#averageHue=#f6f5f5&clientId=u9df02626-6c07-4&from=paste&height=185&id=u461d3b36&originHeight=321&originWidth=712&originalType=binary&ratio=1.3499999046325684&rotation=0&showTitle=false&size=19711&status=done&style=none&taskId=u7c1eb9a9-34c8-458d-a67c-a11725abe92&title=&width=410.4028015136719
[image.png 5]: https://img-blog.csdnimg.cn/img_convert/2d7c649f48ce7b1e87e29182e15f9b39.png#averageHue=#fcfcfb&clientId=u9df02626-6c07-4&from=paste&height=115&id=uef85ad52&originHeight=155&originWidth=1270&originalType=binary&ratio=1.3499999046325684&rotation=0&showTitle=false&size=18495&status=done&style=none&taskId=u65042aac-866d-4fb1-8d6b-da485b19b15&title=&width=940.7408071970627
[image.png 6]: https://img-blog.csdnimg.cn/img_convert/914ee96e6fb050d54356c59a04737c0e.png#averageHue=#2e2c2b&clientId=u9df02626-6c07-4&from=paste&height=204&id=u283adb6e&originHeight=498&originWidth=1001&originalType=binary&ratio=1.3499999046325684&rotation=0&showTitle=false&size=65046&status=done&style=none&taskId=u065e6d43-20d1-4dd9-abaa-f7a67b94e31&title=&width=409.47686767578125
[image.png 7]: https://img-blog.csdnimg.cn/img_convert/1b79fc06133ca6c2924c88115be3a690.png#averageHue=#fcfafa&clientId=u9df02626-6c07-4&from=paste&height=170&id=ucc5a4476&originHeight=363&originWidth=1279&originalType=binary&ratio=1.3499999046325684&rotation=0&showTitle=false&size=42969&status=done&style=none&taskId=u1377d117-70fc-45af-b3a3-663ca3edc35&title=&width=597.3588256835938
[image.png 8]: https://img-blog.csdnimg.cn/img_convert/918d471ed499399d7f2a41ed032d175f.png#averageHue=#2e2c2b&clientId=u9df02626-6c07-4&from=paste&height=281&id=uf02beeef&originHeight=507&originWidth=1072&originalType=binary&ratio=1.3499999046325684&rotation=0&showTitle=false&size=73140&status=done&style=none&taskId=u8b514990-f14c-4d1a-990d-c0de8209311&title=&width=594.0694580078125
[image.png 9]: https://img-blog.csdnimg.cn/img_convert/ffd75139a944a9fe87f1813c3feb8ff2.png#averageHue=#fbfbfb&clientId=u9df02626-6c07-4&from=paste&height=117&id=u32bc42a5&originHeight=266&originWidth=1346&originalType=binary&ratio=1.3499999046325684&rotation=0&showTitle=false&size=32217&status=done&style=none&taskId=u812bb1b4-a213-4c02-8aaa-dd72349b124&title=&width=591.3634643554688
[SpringBoot_WebSocket_springboot websocket_-CSDN]: https://blog.csdn.net/weixin_44185837/article/details/124942482
[Springboot_springboot _-CSDN]: https://blog.csdn.net/weixin_51351637/article/details/128058053
[Websocket_websockethandler_Second_-CSDN]: https://blog.csdn.net/qq_45144949/article/details/121348532
[springboot_websocket_ - meow_world -]: https://www.cnblogs.com/meow-world/articles/16283492.html
[Postman _ WebSocket _w3cschool]: https://www.w3cschool.cn/postman/postman-using-websocket-requests.html