网站首页编程语言正文

SpringSecurity+JWT实现认证及授权详细步骤

作者：小孙小孙梦想成真更新时间： 2022-08-13 编程语言

表单认证流程

想要实现SpringSecurity的认证授权，首先需要理解大致流程。
在这里插入图片描述

准备工作

导入maven依赖

	<dependency>
	    <groupId>org.springframework.boot</groupId>
	    <artifactId>spring-boot-starter-security</artifactId>
	</dependency>
	<!--jwt工具-->
	<dependency>
	    <groupId>io.jsonwebtoken</groupId>
	    <artifactId>jjwt</artifactId>
	    <version>0.9.0</version>
	</dependency>

创建数据库表

表数据如下：
创建生成jwtToken的工具类

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;

import java.util.Date;
import java.util.HashMap;
import java.util.Map;

/**
 * JwtToken生成的工具类
 */
@Component
public class JwtTokenUtil {
    private static final Logger LOGGER = LoggerFactory.getLogger(JwtTokenUtil.class);
    private static final String CLAIM_KEY_USERNAME = "sub";
    private static final String CLAIM_KEY_CREATED = "created";
    @Value("${jwt.secret}")
    private String secret;
    @Value("${jwt.expiration}")
    private Long expiration;

    /**
     * 根据负责生成JWT的token
     */
    private String generateToken(Map<String, Object> claims) {
        return Jwts.builder()
                .setClaims(claims)
                .setExpiration(generateExpirationDate())
                .signWith(SignatureAlgorithm.HS512, secret)
                .compact();
    }

    /**
     * 从token中获取JWT中的负载
     */
    private Claims getClaimsFromToken(String token) {
        Claims claims = null;
        try {
            claims = Jwts.parser()
                    .setSigningKey(secret)
                    .parseClaimsJws(token)
                    .getBody();
        } catch (Exception e) {
            LOGGER.info("JWT格式验证失败:{}",token);
        }
        return claims;
    }

    /**
     * 生成token的过期时间
     */
    private Date generateExpirationDate() {
        return new Date(System.currentTimeMillis() + expiration * 1000);
    }

    /**
     * 从token中获取登录用户名
     */
    public String getUserNameFromToken(String token) {
        String username;
        try {
            Claims claims = getClaimsFromToken(token);
            username =  claims.getSubject();
        } catch (Exception e) {
            username = null;
        }
        return username;
    }

    /**
     * 验证token是否还有效
     *
     * @param token       客户端传入的token
     * @param userDetails 从数据库中查询出来的用户信息
     */
    public boolean validateToken(String token, UserDetails userDetails) {
        String username = getUserNameFromToken(token);
        return username.equals(userDetails.getUsername()) && !isTokenExpired(token);
    }

    /**
     * 判断token是否已经失效
     */
    private boolean isTokenExpired(String token) {
        Date expiredDate = getExpiredDateFromToken(token);
        return expiredDate.before(new Date());
    }

    /**
     * 从token中获取过期时间
     */
    private Date getExpiredDateFromToken(String token) {
        Claims claims = getClaimsFromToken(token);
        return claims.getExpiration();
    }

    /**
     * 根据用户信息生成token
     */
    public String generateToken(UserDetails userDetails) {
        Map<String, Object> claims = new HashMap<>();
        claims.put(CLAIM_KEY_USERNAME, userDetails.getUsername());
        claims.put(CLAIM_KEY_CREATED, new Date());
        return generateToken(claims);
    }

    /**
     * 判断token是否可以被刷新
     */
    public boolean canRefresh(String token) {
        return !isTokenExpired(token);
    }

    /**
     * 刷新token
     */
    public String refreshToken(String token) {
        Claims claims = getClaimsFromToken(token);
        claims.put(CLAIM_KEY_CREATED, new Date());
        return generateToken(claims);
    }
}

实现

实现思路

实现UserDetailsService对象中的loadUserByUsername方法，根据用户名查询用户信息以及权限信息；
自定义controller登录接口；
自定义service层登录逻辑，调用loadUserByUsername获取用户信息并且校验密码，如果认证成功则生成一个jwt返回，将用户信息存入SecurityContextHolder上下文；
自定义JwtAuthenticationTokenFilter过滤器，获取请求头中的token，校验token的有效性并从中获取username，调用loadUserByUsername获取用户信息，存入SecurityContextHolder上下文。

这里为什么要将用户信息及权限存入SecurityContextHolder上下文中？
SecurityContextHolder基于ThreadLocal，SpringSecurity的底层就是一个过滤器链，并且这些过滤器都是一条线执行的。
在这里插入图片描述
而权限的验证主要就是在FilterSecurityInterceptor过滤器中执行的，将用户权限信息存入SecurityContextHolder上下文中，就是为了使后面的过滤器在执行相关权限验证的功能时能够获取到用户的权限信息。

SpringSecurity配置类

/**
 * SpringSecurity配置类
 */
@Configuration
@EnableWebSecurity  // 开启Security
@EnableGlobalMethodSecurity(prePostEnabled=true)    // 开启权限功能
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private RestAuthenticationEntryPoint restAuthenticationEntryPoint;

    @Autowired
    private RestfulAccessDeniedHandler restfulAccessDeniedHandler;

    @Autowired
    private UserMapper userMapper;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf()// 由于使用的是JWT，我们这里不需要csrf
                .disable()
                .sessionManagement()// 基于token，所以不需要session
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .authorizeRequests()
                .antMatchers(HttpMethod.GET, // 允许对于网站静态资源的无授权访问
                        "/",
                        "/*.html",
                        "/favicon.ico",
                        "/**/*.html",
                        "/**/*.css",
                        "/**/*.js",
                        "/swagger-resources/**",
                        "/v2/api-docs/**"
                )
                .permitAll()
                .antMatchers("/user/login", "/user/register")// 对登录注册要允许匿名访问
                .permitAll()
                .antMatchers(HttpMethod.OPTIONS)//跨域请求会先进行一次options请求
                .permitAll()
                .anyRequest()// 除上面外的所有请求全部需要鉴权认证
                .authenticated();
        // 禁用缓存
        http.headers().cacheControl();
        // 添加JWT filter
        http.addFilterBefore(jwtAuthenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class);
        //添加自定义未授权和未登录结果返回
        http.exceptionHandling()
                .accessDeniedHandler(restfulAccessDeniedHandler)
                .authenticationEntryPoint(restAuthenticationEntryPoint);
    }

    @Bean
    public UserDetailsService userDetailsService() {
        // loadUserByUsername()
        return username -> {
            // 查询用户信息
            User user = userMapper.getUserByUsername(username);
            if (!Objects.isNull(user)) {
                // 查询该用户的权限信息
                List<Menu> menus = userMapper.getPermsByUserId(user.getId());
                return new UserAuthDetails(user, menus);
            }
            // 用户名不存在
            throw new UserNotExistException("该用户不存在");
        };
    }

    /**
     * 密码加密方式
     */
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter(){
        return new JwtAuthenticationTokenFilter();
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
}

UserDetailsService：注册该组件并实现核心逻辑方法，根据传来用户名查询该用户的信息。
PasswordEncoder：指定加密方式为BCryptPasswordEncoder，不指定则使用默认的明文存储密码的方式。
JwtAuthenticationTokenFilter：jwt登录授权过滤器，用于验证请求头携带token的是否有效。
方法详细见下文。

RestAuthenticationEntryPoint

当未登录或者token失效访问接口时，自定义的返回结果。

@Component
public class RestAuthenticationEntryPoint implements AuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException {
        response.setCharacterEncoding("UTF-8");
        response.setContentType("application/json");
        response.getWriter().println(R.error(10002, "无效的token"));
        response.getWriter().flush();
    }
}

RestfulAccessDeniedHandler

当访问接口没有权限时，自定义的返回结果。

@Component
public class RestfulAccessDeniedHandler implements AccessDeniedHandler{
    @Override
    public void handle(HttpServletRequest request,
                       HttpServletResponse response,
                       AccessDeniedException e) throws IOException, ServletException {
        response.setCharacterEncoding("UTF-8");
        response.setContentType("application/json");
        response.getWriter().println(R.error(10003, "无权限访问"));
        response.getWriter().flush();
    }
}

JwtAuthenticationTokenFilter

public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
    private static final Logger LOGGER = LoggerFactory.getLogger(JwtAuthenticationTokenFilter.class);
    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private JwtTokenUtil jwtTokenUtil;

    @Value("${jwt.tokenHeader}")
    private String tokenHeader; // 请求头名: token

    @Value("${jwt.tokenHead}")
    private String tokenHead;   // jwt中的header部分

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain chain) throws ServletException, IOException {
        // 获取请求头中的token
        String authToken = request.getHeader(this.tokenHeader);

        if (authToken != null && authToken.startsWith(this.tokenHead)) {
            // 从token中获取username
            String username = jwtTokenUtil.getUserNameFromToken(authToken);
            LOGGER.info("checking username:{}", username);
            if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
                UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
                // 验证该token是否有效
                if (jwtTokenUtil.validateToken(authToken, userDetails)) {
                    // 将 userDetails 封装为一个 authentication 对象
                    UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
                    authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                    LOGGER.info("authenticated user:{}", username);
                    // 存储 authentication对象 至SecurityContextHolder上下文中
                    SecurityContextHolder.getContext().setAuthentication(authentication);
                }
            }
        }
        chain.doFilter(request, response);
    }
}

UserAuthDetails（UserDetails ）对象

用户信息以及对应的权限信息都封装在该对象中，loadUserByUsername方法的返回值。

public class UserAuthDetails implements UserDetails {

    private User user;
    private List<Menu> menus;   // 封装了user的权限列表信息

    public UserAuthDetails(User user, List<Menu> perms) {
        this.user = user;
        this.menus = perms;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        // 封装权限信息
        return menus.stream().filter(menu -> menu.getPerm() != null).map(menu -> {
            // 获取该user对应的权限 封装到GrantedAuthority对象中
            return new SimpleGrantedAuthority(menu.getPerm());
        }).collect(Collectors.toList());
    }

    @Override
    public String getPassword() {
        return user.getPassword();
    }

    @Override
    public String getUsername() {
        return user.getUsername();
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }
}

Controller

登录接口以及两个需要权限访问的业务功能，以便后续测试。

@Slf4j
@RestController
@RequestMapping("/user")
public class UserController {
    @Autowired
    private UserService userService;

    @PostMapping("/login")
    public R login(@RequestBody User user) {
        String token = null;
        try {
            token = userService.login(user);
        } catch (Exception e) {
            return R.error(10001, e.getMessage());
        }
        log.info("the token is created: {}", token);
        return R.ok().setData(token);
    }
    
    @GetMapping("/list")
    @PreAuthorize("hasAuthority('list')")
    public R list() {
        return R.ok();
    }

    @DeleteMapping("/delete")
    @PreAuthorize("hasAuthority('delete')")
    public R delete() {
        return R.ok();
    }
}

UserService接口及实现类

public interface UserService {

    List<Menu> getPermsByUserId(Integer userId);

    /**
     * 登录
     * @param user username & password
     * @return token
     */
    String login(User user);
}

@Service
public class UserServiceImpl implements UserService {

    @Autowired
    private UserMapper userMapper;

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Autowired
    private JwtTokenUtil jwtTokenUtil;
    
    @Override
    public List<Menu> getPermsByUserId(Integer userId) {
        return userMapper.getPermsByUserId(userId);
    }

    @Override
    public String login(User user) {
        String token = null;
        String username = user.getUsername();
        String password = user.getPassword();
        UserDetails userDetails = userDetailsService.loadUserByUsername(username);
        if (!Objects.isNull(userDetails)) {
            // 校验密码
            boolean matches = passwordEncoder.matches(password, userDetails.getPassword());
            if (!matches) {
                throw new PasswordNotMatchException("用户名或密码错误");
            }
            // 将UserDetails对象封装到authentication对象中 并保存至SecurityContextHolder上下文
            UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
            SecurityContextHolder.getContext().setAuthentication(authentication);
            // 生成token返回
            token = jwtTokenUtil.generateToken(userDetails);
        }
        return token;
    }
}

重点查看login方法，上述代码手动调用了loadUserByUsername方法与matches方法校验密码，其实还有一种简单的方式，从开头的流程图中可以发现，在调用ProviderManager对象的authenticate方法时，他在内部已经帮我们调用了loadUserByUsername方法和matches方法进行用户的认证，并且在认证成功之后会返回一个Authentication，该对象封装了UserDetails 对象，所以我们也可以直接调用authenticate方法进行认证。

    @Autowired
    private AuthenticationManager authenticationManager;
    @Override
    public String login(User user) {
        String token = null;
        String username = user.getUsername();
        String password = user.getPassword();

        // 将用户名和密码封装为一个Authentication对象
        UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(username, password);
        // 调用认证方法
        Authentication authenticate = authenticationManager.authenticate(authenticationToken);
        if (Objects.isNull(authenticate)) {
            throw new PasswordNotMatchException("用户名或密码错误");
        }
        UserAuthDetails userDetails = (UserAuthDetails) authenticate.getPrincipal();
        UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null,  userDetails.getAuthorities());
        SecurityContextHolder.getContext().setAuthentication(authentication);
        // 生成token返回
        token = jwtTokenUtil.generateToken(userDetails);

        return token;
    }