java利用白名单检查路径参数是否合规 spring security 白名单规则

转载

mob64ca13fb6939 2023-11-28 23:21:25

文章标签 java利用白名单检查路径参数是否合规 spring java 安全 ide 文章分类 Java 后端开发

一. 什么是spring security

二. Spring security 的使用

1.创建springboot项目

2.主启动类

2.配置controller层

3.配置config类

4.配置多用户登录以及注入权限及登录config注入

5.配置config层

6.登录成功处理类及无权限处理类

7.配置工具类

8.启动测试

三. 总结

一. 什么是spring security

Spring Security是一个能够为基于Spring的企业应用系统提供声明式的安全访问控制解决方案的安全框架。它提供了一组可以在Sprirg应用上下文中配置的Bean，充分利用了Spring IoC，DI(控制反转Inversion of Control ,DI:Dependency Injection依赖主入）和AOP(面向切面编程）功能，为应用系统提供声明式的安全访问控制功能，减少了为企业系统安全控制编写大量重复代码的工作。以上解释来源于百度白科。可以一句话来概括，SpringSecurity 是一个安全框架。可以帮我们完成认证，授权，密码加密，rememberme的功能。

二. Spring security 的使用

1.创建springboot项目

java利用白名单检查路径参数是否合规 spring security 白名单规则_安全

2.主启动类

package com.exy;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@SpringBootApplication
public class SecurityApplication {

    public static void main(String[] args) {
        SpringApplication.run(SecurityApplication.class, args);
    }

    @Bean
    public PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }
}

2.配置controller层

package com.exy.controller;

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

/**
 * @program: springsecurity-qy145-01
 * @description:
 * @author: 
 * @create: 2022-03-10 11:07
 * 只要账号登录 后 都可以访问所有的资源。
 *    1.ykq 进入可以访问 list  inser  delete update
 *    2.mcl 进入只能访问 list  export
 **/
@RestController
public class Test {

    @GetMapping("/list")
    public String list(){

        return "user:list";
    }

    @GetMapping("/insert")
    public String insert(){

        return "user:insert";
    }

    @GetMapping("/delete")
    public String delete(){

        return "user:delete";
    }

    @GetMapping("/update")
    public String update(){

        return "user:update";
    }

    @GetMapping("/export")
    public String export(){

        return "user:export";
    }
}

3.配置config类

package com.exy.config;

import com.exy.handle.MyAccessDeniedHandler;
import com.exy.handle.SuccessHandler;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.parameters.P;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

/**
 * @program: security01
 * @description:
 * @author: jdy
 * @create: 2022-03-10 10:05
 **/
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private PasswordEncoder passwordEncoder;
    @Autowired
    private SuccessHandler successHandler;
    @Autowired
    private MyAccessDeniedHandler myAccessDeniedHandler;
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("jdy")
                .password(passwordEncoder.encode("123132"))
                .roles("admin")
                .authorities("user:list","user:delete");

    }


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.formLogin().successHandler(successHandler).permitAll();
        http.exceptionHandling().accessDeniedHandler(myAccessDeniedHandler);

        http.authorizeRequests()
                .antMatchers("/list").hasAnyAuthority("user:list")
                .antMatchers("/insert").hasAnyAuthority("user:insert")
                .antMatchers("/update").hasAnyAuthority("user:update")
                .antMatchers("/delete").hasAnyAuthority("user:delete")
                .antMatchers("/export").hasAnyAuthority("user:export");
    }
}

4.配置多用户登录以及注入权限及登录config注入

package com.exy.config;

import com.exy.handle.MyAccessDeniedHandler;
import com.exy.handle.SuccessHandler;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.parameters.P;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

/**
 * @program: security01
 * @description:
 * @author: jdy
 * @create: 2022-03-10 10:05
 **/
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private PasswordEncoder passwordEncoder;
    @Autowired
    private SuccessHandler successHandler;
    @Autowired
    private MyAccessDeniedHandler myAccessDeniedHandler;
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("jdy")
                .password(passwordEncoder.encode("123132"))
                .roles("admin")
                .authorities("user:list","user:delete");

    }


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.formLogin().successHandler(successHandler).permitAll();
        http.exceptionHandling().accessDeniedHandler(myAccessDeniedHandler);

        http.authorizeRequests()
                .antMatchers("/list").hasAnyAuthority("user:list")
                .antMatchers("/insert").hasAnyAuthority("user:insert")
                .antMatchers("/update").hasAnyAuthority("user:update")
                .antMatchers("/delete").hasAnyAuthority("user:delete")
                .antMatchers("/export").hasAnyAuthority("user:export");
    }
}

5.配置config层

package com.exy.config;

import com.exy.handle.MyAccessDeniedHandler;
import com.exy.handle.SuccessHandler;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.parameters.P;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

/**
 * @program: security01
 * @description:
 * @author: jdy
 * @create: 2022-03-10 10:05
 **/
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private PasswordEncoder passwordEncoder;
    @Autowired
    private SuccessHandler successHandler;
    @Autowired
    private MyAccessDeniedHandler myAccessDeniedHandler;
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("jdy")
                .password(passwordEncoder.encode("123132"))
                .roles("admin")
                .authorities("user:list","user:delete");

    }


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.formLogin().successHandler(successHandler).permitAll();
        http.exceptionHandling().accessDeniedHandler(myAccessDeniedHandler);

        http.authorizeRequests()
                .antMatchers("/list").hasAnyAuthority("user:list")
                .antMatchers("/insert").hasAnyAuthority("user:insert")
                .antMatchers("/update").hasAnyAuthority("user:update")
                .antMatchers("/delete").hasAnyAuthority("user:delete")
                .antMatchers("/export").hasAnyAuthority("user:export");
    }
}

6.登录成功处理类及无权限处理类

package com.exy.handle;

import com.exy.util.CommonResult;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.stereotype.Component;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;

/**
 * @program: security01
 * @description:
 * @author: jdy
 * @create: 2022-03-10 16:02
 **/

@Component
public class SuccessHandler implements AuthenticationSuccessHandler {
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        response.setContentType("application/json;charset=utf-8");
        CommonResult commonResult = new CommonResult(2000, "登录成功", authentication);
        PrintWriter writer = response.getWriter();
        writer.print(new ObjectMapper().writeValueAsString(commonResult));
        writer.flush();
        writer.close();
    }
}

package com.exy.handle;

import com.exy.util.CommonResult;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.web.access.AccessDeniedHandler;
import org.springframework.stereotype.Component;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;

/**
 * @program: security01
 * @description:
 * @author: jdy
 * @create: 2022-03-10 17:15
 **/
@Component
public class MyAccessDeniedHandler implements AccessDeniedHandler {
    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
        response.setContentType("application/json;charset=utf-8");
        CommonResult commonResult = new CommonResult(2000, "权限不足", accessDeniedException);
        PrintWriter writer = response.getWriter();
        writer.print(new ObjectMapper().writeValueAsString(commonResult));
        writer.flush();
        writer.close();
    }
}

7.配置工具类

@Data
@AllArgsConstructor
@NoArgsConstructor

public class CommonResult {
    private int code;
    private String msg;
    private Object data;
}

8.启动测试

java利用白名单检查路径参数是否合规 spring security 白名单规则_ide_02

java利用白名单检查路径参数是否合规 spring security 白名单规则_安全_03

java利用白名单检查路径参数是否合规 spring security 白名单规则_spring_04

三. 总结

进入移动互联网时代，大家每天都在刷手机，常用的软件有微信、支付宝、头条，抖音等，下边拿微信来举例子说明认证相关的基本概念，在初次使用微信前需要注册成为微信用户，然后输入账号和密码即可登录微信，输入账号和密码登录微信的过程就是认证。系统为什么要认证? 认证是为了保护系统的隐私数据与资源，用户的身份合法,方可访问该系统的资源。认证︰用户认证就是判断一个用户的身份是否合法的过程，用户去访问系统资源时系统要求验证用户的身份信息，身份合法方可继续访问，不合法则拒绝访问。常见的用户身份认证方式有:用户名密码登录，二维码登录，手机短信登录，指纹认证等方式。

本文章为转载内容，我们尊重原作者对文章享有的著作权。如有内容错误或侵权问题，欢迎原作者联系我们进行内容更正或删除文章。

上一篇：laravel 安装mongodb laravel安装配置

下一篇：java中什么是耦合度编程中耦合是什么意思

提问和评论都可以，用心的回复会被更多人看到评论

发布评论

相关文章

官方博客	全部文章	热门标签	班级博客
了解我们	网站地图	意见反馈

鸿蒙开发者社区	51CTO学堂
51CTO	软考资讯