SpringBoot整合Spring Security

向右看齐 2024-04-18 08:34 146阅读 0赞

最近研究了一下Spring Security记录一下。

Spring Security简介

Spring 是一个非常流行和成功的 Java 应用开发框架。Spring Security 基于 Spring 框架，提供了一套 Web 应用安全性的完整解决方案。一般来说，Web 应用的安全性包括用户认证（Authentication）和用户授权（Authorization）两个部分。用户认证指的是验证某个用户是否为系统中的合法主体，也就是说用户能否访问该系统。用户认证一般要求用户提供用户名和密码。系统通过校验用户名和密码来完成认证过程。用户授权指的是验证某个用户是否有权限执行某个操作。在一个系统中，不同用户所具有的权限是不同的。比如对一个文件来说，有的用户只能进行读取，而有的用户可以进行修改。一般来说，系统会为不同的用户分配不同的角色，而每个角色则对应一系列的权限。
对于上面提到的两种应用情景，Spring Security 框架都有很好的支持。在用户认证方面，Spring Security 框架支持主流的认证方式，包括 HTTP 基本认证、HTTP 表单验证、HTTP 摘要认证、OpenID 和 LDAP 等。在用户授权方面，Spring Security 提供了基于角色的访问控制和访问控制列表（Access Control List，ACL），可以对应用中的领域对象进行细粒度的控制。

创建demo项目

项目已传GitHub，有需要的小伙伴可以下载传送门

新建一个springboot项目
pom文件内容

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  3.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  4.     <modelVersion>4.0.0</modelVersion>
  5.     <parent>
  6.         <groupId>org.springframework.boot</groupId>
  7.         <artifactId>spring-boot-starter-parent</artifactId>
  8.         <version>2.1.7.RELEASE</version>
  9.         <relativePath/> <!-- lookup parent from repository -->
  10.     </parent>
  11.     <groupId>cn.duyunzhi</groupId>
  12.     <artifactId>security</artifactId>
  13.     <version>1.0.0</version>
  14.     <name>security</name>
  15.     <description>security project for Spring Boot</description>
  17.     <properties>
  18.         <java.version>1.8</java.version>
  19.     </properties>
  21.     <dependencies>
  22.         <!--security-->
  23.         <dependency>
  24.             <groupId>org.springframework.boot</groupId>
  25.             <artifactId>spring-boot-starter-security</artifactId>
  26.         </dependency>
  27.         <dependency>
  28.             <groupId>org.springframework.boot</groupId>
  29.             <artifactId>spring-boot-starter-web</artifactId>
  30.         </dependency>
  31.         <!--thymeleaf模板-->
  32.         <dependency>
  33.             <groupId>org.springframework.boot</groupId>
  34.             <artifactId>spring-boot-starter-thymeleaf</artifactId>
  35.         </dependency>
  36.         <!--test-->
  37.         <dependency>
  38.             <groupId>org.springframework.boot</groupId>
  39.             <artifactId>spring-boot-starter-test</artifactId>
  40.             <scope>test</scope>
  41.         </dependency>
  42.         <dependency>
  43.             <groupId>org.springframework.security</groupId>
  44.             <artifactId>spring-security-test</artifactId>
  45.             <scope>test</scope>
  46.         </dependency>
  47.         <!--mysql驱动-->
  48.         <dependency>
  49.             <groupId>mysql</groupId>
  50.             <artifactId>mysql-connector-java</artifactId>
  51.             <scope>runtime</scope>
  52.         </dependency>
  53.         <!--lombok-->
  54.         <dependency>
  55.             <groupId>org.projectlombok</groupId>
  56.             <artifactId>lombok</artifactId>
  57.         </dependency>
  58.         <!--mybatis-plus-->
  59.         <dependency>
  60.             <groupId>com.baomidou</groupId>
  61.             <artifactId>mybatis-plus-boot-starter</artifactId>
  62.             <version>3.1.0</version>
  63.         </dependency>
  64.         <!--Druid连接池包 -->
  65.         <dependency>
  66.             <groupId>com.alibaba</groupId>
  67.             <artifactId>druid</artifactId>
  68.             <version>1.0.12</version>
  69.         </dependency>
  70.         <!--日志依赖-->
  71.         <dependency>
  72.             <groupId>org.slf4j</groupId>
  73.             <artifactId>log4j-over-slf4j</artifactId>
  74.         </dependency>
  75.     </dependencies>
  77.     <build>
  78.         <plugins>
  79.             <plugin>
  80.                 <groupId>org.springframework.boot</groupId>
  81.                 <artifactId>spring-boot-maven-plugin</artifactId>
  82.             </plugin>
  83.         </plugins>
  84.     </build>
  86. </project>

Security配置

  1. import cn.duyunzhi.security.service.CustomUserDetailsService;
  2. import cn.duyunzhi.security.common.Md5PasswordEncoder;
  3. import org.springframework.beans.factory.annotation.Autowired;
  4. import org.springframework.context.annotation.Bean;
  5. import org.springframework.context.annotation.Configuration;
  6. import org.springframework.security.authentication.AuthenticationManager;
  7. import org.springframework.security.config.BeanIds;
  8. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  9. import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
  10. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  11. import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  12. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  13. import org.springframework.web.cors.CorsConfiguration;
  14. import org.springframework.web.cors.CorsConfigurationSource;
  15. import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
  17. import java.util.Arrays;
  19. /**
  20.  * @Author: Ezreal-d
  21.  * @Description:
  22.  * @Date: 2019/9/2 11:28
  23.  */
  25. @Configuration
  26. @EnableWebSecurity
  27. @EnableGlobalMethodSecurity(prePostEnabled = true)
  28. public class SecurityConfig extends WebSecurityConfigurerAdapter {
  30.     @Autowired
  31.     private CustomUserDetailsService customUserDetailsService;
  33.     @Override
  34.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  35.         auth.userDetailsService(customUserDetailsService())
  36.                 .passwordEncoder(passwordEncoder());
  37.     }
  39.     @Override
  40.     protected void configure(HttpSecurity http) throws Exception {
  41.         http.authorizeRequests()
  42.                 // 所有用户均可访问的资源 只支持GET请求,其它请求需做处理
  43.                 .antMatchers("/favicon.ico", "/css/**", "/js/**", "/img/**", "/login/toLogin", "/login/getVerify", "/login/userLogin").permitAll()
  44.                 // 任何尚未匹配的URL只需要验证用户即可访问
  45.                 .anyRequest().authenticated()
  46.                 .and()
  47.                 .formLogin().loginPage("/login/toLogin").successForwardUrl("/index")
  48.                 .and()
  49.                 //权限拒绝的页面
  50.                 .exceptionHandling().accessDeniedPage("/error-403");
  52.         http.logout().logoutSuccessUrl("/login/toLogin");
  53.     }
  56.     /**
  57.      * 设置用户密码的加密方式
  58.      *
  59.      * @return
  60.      */
  61.     @Bean
  62.     public Md5PasswordEncoder passwordEncoder() {
  63.         return new Md5PasswordEncoder();
  65.     }
  67.     /**
  68.      * 自定义UserDetailsService，授权
  69.      *
  70.      * @return
  71.      */
  72.     private CustomUserDetailsService customUserDetailsService() {
  73.         return customUserDetailsService;
  74.     }
  76.     /**
  77.      * AuthenticationManager
  78.      *
  79.      * @return
  80.      * @throws Exception
  81.      */
  82.     @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
  83.     @Override
  84.     public AuthenticationManager authenticationManagerBean() throws Exception {
  85.         return super.authenticationManagerBean();
  86.     }
  89. }

Md5PasswordEncoder.java

  1. import cn.duyunzhi.security.utils.CipherUtil;
  2. import org.springframework.security.crypto.password.PasswordEncoder;
  4. /**
  5. * @Author: Ezreal-d
  6. * @Description: 采用MD5加密密码
  7. * @Date: 2019/9/2 15:38
  8. */
  10. public class Md5PasswordEncoder implements PasswordEncoder {
  12.     @Override
  13.     public String encode(CharSequence rawPassword) {
  14.         return CipherUtil.generatePassword(rawPassword.toString());
  15.     }
  18.     @Override
  19.     public boolean matches(CharSequence rawPassword, String encodedPassword) {
  20.         return CipherUtil.generatePassword(rawPassword.toString()).equals(encodedPassword);
  21.     }
  22. }

所有用户均可访问的资源配置项里面路径如果不是GET请求需要做另外处理。原因是：

Spring Security 4.0之后，引入了CSRF，默认是开启。不得不说，CSRF和RESTful技术有冲突。CSRF默认支持的方法： GET|HEAD|TRACE|OPTIONS，不支持POST。

所以问题来了，我这边用户登录用的就是POST请求，结果发现403错误。疯狂采坑！
解决方案

  • 禁用csrf
    在SecurityConfig 中添加

    http.csrf().disable();

  • 携带Token
    在发送ajax请求的时候带上一个 X-CSRF-TOKEN的请求头。我用的是thymeleaf模板，如下：
    在head标签中添加

然后加了一个common.js

  1. $(function () {
  2.     var token = $("meta[name='_csrf']").attr("content");
  3.     var header = $("meta[name='_csrf_header']").attr("content");
  4.     $(document).ajaxSend(function(e, xhr, options) {
  5.         xhr.setRequestHeader(header, token);
  6.     });
  7. });

再次发送POST请求的时候就OK了！

认证和授权

  1. import cn.duyunzhi.security.entity.Role;
  2. import cn.duyunzhi.security.entity.User;
  3. import org.springframework.beans.factory.annotation.Autowired;
  4. import org.springframework.security.core.GrantedAuthority;
  5. import org.springframework.security.core.authority.SimpleGrantedAuthority;
  6. import org.springframework.security.core.userdetails.UserDetails;
  7. import org.springframework.security.core.userdetails.UserDetailsService;
  8. import org.springframework.security.core.userdetails.UsernameNotFoundException;
  9. import org.springframework.security.web.authentication.switchuser.SwitchUserGrantedAuthority;
  10. import org.springframework.stereotype.Service;
  12. import java.util.ArrayList;
  13. import java.util.List;
  15. /**
  16.  * @Author: Ezreal-d
  17.  * @Description: 认证和授权
  18.  * @Date: 2019/9/2 11:32
  19.  */
  20. @Service
  21. public class CustomUserDetailsService implements UserDetailsService {
  23.     @Autowired
  24.     private UserService userService;
  26.     @Autowired
  27.     private RoleService roleService;
  29.     @Override
  30.     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
  32.         //认证账号
  33.         User user = userService.loadUserByUsername(username);
  34.         if (user == null) {
  35.             throw new UsernameNotFoundException("The account does not exist");
  36.         }
  39.         //开始授权
  40.         Role role = roleService.getRoleByRoleId(user.getRole());
  41.         List<GrantedAuthority> grantedAuthorities = new ArrayList<>();
  42.         GrantedAuthority grantedAuthority = new SimpleGrantedAuthority(role.getRoleName());
  43.         //此处将权限信息添加到 GrantedAuthority 对象中，在后面进行全权限验证时会使
  44.         //GrantedAuthority 对象。
  45.         grantedAuthorities.add(grantedAuthority);
  46.         user.setAuthorities(grantedAuthorities);
  47.         return user;
  48.     }
  51. }

我这边数据库用户和角色是一对第一的，一个用户只有一个角色。多个角色这边也可以授权多个。

用户登录

  1. import cn.duyunzhi.security.bean.JsonAsynResult;
  2. import cn.duyunzhi.security.entity.User;
  3. import cn.duyunzhi.security.service.UserService;
  4. import cn.duyunzhi.security.utils.DateUtil;
  5. import cn.duyunzhi.security.utils.RandomValidateCodeUtil;
  6. import cn.duyunzhi.security.utils.SecurityUtil;
  7. import org.slf4j.Logger;
  8. import org.slf4j.LoggerFactory;
  9. import org.springframework.beans.factory.annotation.Autowired;
  10. import org.springframework.security.authentication.AuthenticationManager;
  11. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  12. import org.springframework.security.core.Authentication;
  13. import org.springframework.security.core.context.SecurityContextHolder;
  14. import org.springframework.stereotype.Controller;
  15. import org.springframework.util.StringUtils;
  16. import org.springframework.web.bind.annotation.*;
  18. import javax.servlet.http.HttpServletRequest;
  19. import javax.servlet.http.HttpServletResponse;
  20. import javax.servlet.http.HttpSession;
  21. import java.time.LocalDateTime;
  23. /**
  24.  * @Author: Ezreal-d
  25.  * @Description: 登录Controller
  26.  * @Date: 2019/9/2 15:39
  27.  */
  29. @Controller
  30. @RequestMapping("/login")
  31. public class LoginController extends BaseController {
  33.     private static final Logger logger = LoggerFactory.getLogger(LoginController.class);
  35.     @Autowired
  36.     private AuthenticationManager myAuthenticationManager;
  38.     @Autowired
  39.     private UserService userService;
  41.     @RequestMapping("/toLogin")
  42.     public String login() {
  43.         return "login";
  44.     }
  46.     @PostMapping("/userLogin")
  47.     @ResponseBody
  48.     public JsonAsynResult userLogin(User user, String inputStr, HttpSession session) {
  49.         if (StringUtils.isEmpty(inputStr) || !((String) session.getAttribute(RandomValidateCodeUtil.RANDOMCODEKEY)).toLowerCase().equals(inputStr.toLowerCase())) {
  50.             return JsonAsynResult.createErrorResult("验证码错误");
  51.         }
  53.         UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(user.getUsername(), user.getPassword());
  54.         //使用SpringSecurity拦截登陆请求 进行认证和授权
  55.         Authentication authenticate = myAuthenticationManager.authenticate(authenticationToken);
  56.         SecurityContextHolder.getContext().setAuthentication(authenticate);
  57.         // 这个非常重要，否则验证后将无法登陆
  58.         session.setAttribute("SPRING_SECURITY_CONTEXT", SecurityContextHolder.getContext());
  59.         //更新用户登录信息
  60.         User updateUser = SecurityUtil.getUser();
  61.         updateUser.setLastLoginTime(DateUtil.getNowDateTime());
  62.         updateUser.setLastLoginIp(getUserIp());
  63.         userService.updateUser(updateUser);
  64.         return JsonAsynResult.createSucResult();
  65.     }
  67.     /**
  68.      * 生成验证码
  69.      */
  70.     @GetMapping(value = "/getVerify")
  71.     public void getVerify(HttpServletRequest request, HttpServletResponse response) {
  72.         try {
  73.             //设置相应类型,告诉浏览器输出的内容为图片
  74.             response.setContentType("image/jpeg");
  75.             //设置响应头信息，告诉浏览器不要缓存此内容
  76.             response.setHeader("Pragma", "No-cache");
  77.             response.setHeader("Cache-Control", "no-cache");
  78.             response.setDateHeader("Expire", 0);
  79.             RandomValidateCodeUtil randomValidateCode = new RandomValidateCodeUtil();
  80.             //输出验证码图片方法
  81.             randomValidateCode.getRandcode(request, response);
  82.         } catch (Exception e) {
  83.             logger.error("Failed to get verification code >>>>   ", e);
  84.         }
  85.     }
  87.     @RequestMapping("/logout")
  88.     public String logout() {
  89.         SecurityUtil.logout();
  90.         return "redirect:login/toLogin";
  91.     }
  92. }

贴一下工具类

  1. import org.slf4j.Logger;
  2. import org.slf4j.LoggerFactory;
  4. import javax.imageio.ImageIO;
  5. import javax.servlet.http.HttpServletRequest;
  6. import javax.servlet.http.HttpServletResponse;
  7. import javax.servlet.http.HttpSession;
  8. import java.awt.*;
  9. import java.awt.image.BufferedImage;
  10. import java.util.Random;
  13. /**
  14.  * @Author: Ezreal-d
  15.  * @Description: 验证码工具类
  16.  * @Date: 2019/9/2 16:44
  17.  */
  19. public class RandomValidateCodeUtil {
  21.     /**
  22.      * 放到session中的key
  23.      */
  24.     public static final String RANDOMCODEKEY = "RANDOMVALIDATECODEKEY";
  25.     /**
  26.      * 随机产生数字与字母组合的字符串
  27.      */
  28.     private String randString = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ";
  29.     /**
  30.      * 图片宽
  31.      */
  32.     private final int width = 93;
  33.     /**
  34.      * 图片高
  35.      */
  36.     private final int height = 41;
  37.     /**
  38.      * 干扰线数量
  39.      */
  40.     private final int lineSize = 40;
  41.     /**
  42.      * 随机产生字符数量
  43.      */
  44.     private final int stringNum = 4;
  46.     private static final Logger logger = LoggerFactory.getLogger(RandomValidateCodeUtil.class);
  48.     private Random random = new Random();
  50.     /**
  51.      * 获得字体
  52.      */
  53.     private Font getFont() {
  54.         return new Font("Fixedsys", Font.BOLD, 18);
  55.     }
  57.     /**
  58.      * 获得颜色
  59.      */
  60.     private Color getRandColor(int fc, int bc) {
  61.         if (fc > 255) {
  62.             fc = 255;
  63.         }
  64.         if (bc > 255) {
  65.             bc = 255;
  66.         }
  67.         int r = fc + random.nextInt(bc - fc - 16);
  68.         int g = fc + random.nextInt(bc - fc - 14);
  69.         int b = fc + random.nextInt(bc - fc - 18);
  70.         return new Color(r, g, b);
  71.     }
  73.     /**
  74.      * 生成随机图片
  75.      */
  76.     public void getRandcode(HttpServletRequest request, HttpServletResponse response) {
  77.         HttpSession session = request.getSession();
  78.         // BufferedImage类是具有缓冲区的Image类,Image类是用于描述图像信息的类
  79.         BufferedImage image = new BufferedImage(width, height, BufferedImage.TYPE_INT_BGR);
  80.         // 产生Image对象的Graphics对象,改对象可以在图像上进行各种绘制操作
  81.         Graphics g = image.getGraphics();
  82.         //图片大小
  83.         g.fillRect(0, 0, width, height);
  84.         //字体大小
  85.         g.setFont(new Font("Times New Roman", Font.PLAIN, 18));
  86.         //字体颜色
  87.         g.setColor(getRandColor(110, 133));
  88.         // 绘制干扰线
  89.         for (int i = 0; i <= lineSize; i++) {
  90.             drowLine(g);
  91.         }
  92.         // 绘制随机字符
  93.         String randomString = "";
  94.         for (int i = 1; i <= stringNum; i++) {
  95.             randomString = drowString(g, randomString, i);
  96.         }
  97.         logger.info(randomString);
  98.         //将生成的随机字符串保存到session中
  99.         session.removeAttribute(RANDOMCODEKEY);
  100.         session.setAttribute(RANDOMCODEKEY, randomString);
  101.         g.dispose();
  102.         try {
  103.             // 将内存中的图片通过流动形式输出到客户端
  104.             ImageIO.write(image, "JPEG", response.getOutputStream());
  105.         } catch (Exception e) {
  106.             logger.error("将内存中的图片通过流动形式输出到客户端失败>>>>   ", e);
  107.         }
  109.     }
  111.     /**
  112.      * 绘制字符串
  113.      */
  114.     private String drowString(Graphics g, String randomString, int i) {
  115.         g.setFont(getFont());
  116.         g.setColor(new Color(random.nextInt(101), random.nextInt(111), random
  117.                 .nextInt(121)));
  118.         String rand = String.valueOf(getRandomString(random.nextInt(randString
  119.                 .length())));
  120.         randomString += rand;
  121.         g.translate(random.nextInt(3), random.nextInt(3));
  122.         g.drawString(rand, 13 * i, 16);
  123.         return randomString;
  124.     }
  126.     /**
  127.      * 绘制干扰线
  128.      */
  129.     private void drowLine(Graphics g) {
  130.         int x = random.nextInt(width);
  131.         int y = random.nextInt(height);
  132.         int xl = random.nextInt(13);
  133.         int yl = random.nextInt(15);
  134.         g.drawLine(x, y, x + xl, y + yl);
  135.     }
  137.     /**
  138.      * 获取随机的字符
  139.      */
  140.     public String getRandomString(int num) {
  141.         return String.valueOf(randString.charAt(num));
  142.     }
  143. }
  145. import cn.duyunzhi.security.entity.User;
  146. import org.springframework.security.core.Authentication;
  147. import org.springframework.security.core.GrantedAuthority;
  148. import org.springframework.security.core.context.SecurityContextHolder;
  149. import org.springframework.util.StringUtils;
  151. import java.util.Collection;
  152. /**
  153. * @Author: Ezreal-d
  154. * @Description: Security工具类
  155. * @Date: 2019/9/3 13:11
  156. */
  158. public class SecurityUtil {
  160.     /**
  161.      * 获取认证信息
  162.      * @return
  163.      */
  164.     public static Authentication getAuthentication() {
  165.         return SecurityContextHolder.getContext().getAuthentication();
  166.     }
  168.     /**
  169.      * 获取所有权限
  170.      * @return
  171.      */
  172.     public static Collection<? extends GrantedAuthority> getAllPermission(){
  173.         return getAuthentication().getAuthorities();
  174.     }
  176.     /**
  177.      * 是否有权限
  178.      * @param permission
  179.      * @return
  180.      */
  181.     public static boolean hasPermission(String permission){
  182.         if(StringUtils.isEmpty(permission)){
  183.             return false;
  184.         }
  185.         Collection<? extends GrantedAuthority> authorities = getAllPermission();
  186.         boolean hasPermission = false;
  187.         for(GrantedAuthority grantedAuthority : authorities){
  188.             String authority = grantedAuthority.getAuthority();
  189.             if(authority.equals(permission)){
  190.                 hasPermission =true;
  191.             }
  192.         }
  193.         return hasPermission;
  194.     }
  197.     /**
  198.      * 获取登录用户
  199.      * @return
  200.      */
  201.     public static User getUser() {
  202.         return (User) getAuthentication().getPrincipal();
  203.     }
  205.     /**
  206.      * 注销
  207.      */
  208.     public static void logout(){
  209.         SecurityContextHolder.clearContext();
  210.     }
  211. }

发表评论

表情：
评论列表 （有 0 条评论，146人围观）

还没有评论，来说两句吧...

相关阅读

    相关 springboot整合spring-security

    在web开发中，安全性问题比较重要，一般会使用过滤器或者拦截器的方式对权限等进行验证过滤。此博客根据b站up主，使用demo示例进行展示spring-security的一些功能

    桃扇骨桃扇骨/ 0 赞/ 152 阅读