spring项目实现前端请求断开后端请求自动中断 spring前后端分离

转载

mob64ca140fd7c1 2024-04-15 12:07:16

文章标签 Spring Security ide 自定义 spring 文章分类 架构后端开发

之前项目中都是使用shiro作为安全框架，但是很多资料推荐spring security作为spring项目的安全框架。既然用着spring,那spring security自然还是要了解下的。

但是在实际接触中发现，比shori的学习成本高点。还有就是大部分都停留在将前端代码放在后端路径下，页面的跳转，重定向都由后端代码实现。这在当下的前后端分离开发中还是不合适的，所以经过我这几天的各种捣鼓，终于实现了speing security的前后端分离开发，后端主要处理接口数据，页面全部由前端处理，传输使用JSON格式。

一、代码结构

spring项目实现前端请求断开后端请求自动中断 spring前后端分离_自定义

二、实现过程

spring security底层实现就是一串过滤器，因此我们需要重写里面的一些方法，返回JSON格式。前端根据JSON数据进而实现用户的登录与身份验证等操作。具体代码如下

一、创建实体，实现 UserDetails接口，记得实现方法将boolean返回值改为true

@Setter
@Getter
public class BlogUser extends BaseEntity implements UserDetails {

    public BlogUser() {
    }

    public BlogUser(String userName, String userPassword) {
        this.userName = userName;
        this.userPassword = userPassword;
    }

    private static final Short ENABLE_FALSE = 0;

    /**
     * 用户名
     */
    private String userName;

    /**
     * 密码
     */
    private String userPassword;

    /**
     * 用户的角色
     * @return 角色组
     */
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return null;
    }

    @Override
    public String getPassword() {
        return this.userPassword;
    }

    @Override
    public String getUsername() {
        return this.userName;
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return !this.enable.equals(ENABLE_FALSE);
    }

二、编写DAO层代码，实现UserDetailsService，重写loadUserByUsername方法

@Component
public class SelfUserDetailsServiceImpl implements UserDetailsService {

    @Autowired
    private BlogUserMapper mapper;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        BlogUser blogUser = mapper.loadUserByUsername(username);
        if(ObjectUtils.isEmpty(blogUser)){
            throw new UsernameNotFoundException("根据用户名未找到用户信息");
        }
        return blogUser;
    }
}

到此为止，security框架需要你做的事情已经完了。它会有一个默认登录页面（很丑，一看就是后端写的）。封装的还是很强大的。同时还支持前后端分离配置，不得不佩服spring的强大，下面看具体实现。

三、首先先看下security的配置类

@EnableWebSecurity
@Configuration
public class WebSecurityConfigure extends WebSecurityConfigurerAdapter {

    /**
     * 自定义登录认证
     */
    @Autowired
    private SelfAuthenticationProvider authenticationProvider;

    /**
     * 自定义登录成功处理器
     */
    @Autowired
    private UrlAuthenticationSuccessHandler authenticationSuccessHandler;

    /**
     * 自定义登录失败处理器
     */
    @Autowired
    private UrlAuthenticationFailureHandler authenticationFailureHandler;

    /**
     * 自定义注销处理器
     */
    @Autowired
    private UrlLogoutSuccessHandler logoutSuccessHandler;


    /**
     * 登录认证
     * @param auth 登陆管理器
     */
    @Override
    protected void configure(AuthenticationManagerBuilder auth) {
        //添加自定义登陆认证
        auth.authenticationProvider(authenticationProvider);
    }

    /**
     * 具体配置登陆细节
     * @param http 登陆访问对象
     * @throws Exception 登陆异常
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //关闭csrf
        http.csrf().disable()
                //关闭Session
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                //开放api路径
                .authorizeRequests().antMatchers("/api/**","/five-service/blog-article/search/**","/five-service/blog-article/point","/five-service/blog-user/login").
                permitAll()
                .anyRequest().authenticated()
                //开启自动配置的登陆功能
                .and()
                //自定义登录请求路径(post请求)
                .formLogin().usernameParameter("userName").passwordParameter("userPassword")
                .loginProcessingUrl("/five-service/login")
                //验证成功处理器
                .successHandler(authenticationSuccessHandler)
                //验证失败处理器
                .failureHandler(authenticationFailureHandler).permitAll()
                .and()
                //关闭拦截未登录自动跳转,改为返回json信息
                .exceptionHandling().authenticationEntryPoint(selfLoginUrlAuthenticationEntryPoint())
                //开启自动配置的注销功能
                .and()
                .logout()
                .logoutUrl("/five-service/logout")
                //注销成功处理器
                .logoutSuccessHandler(logoutSuccessHandler).permitAll()
                .and()
                //添加token过滤器
                .addFilter(new TokenAuthenticationFilter(authenticationManagerBean()));
    }

    /**
     * 身份认证失败处理类
     * @return AuthenticationEntryPoint
     */
    @Bean
    public AuthenticationEntryPoint selfLoginUrlAuthenticationEntryPoint() {
        return new SelfLoginUrlAuthenticationEntryPoint("/");
    }

    /**
     * 重写方法，是上下文可以获取本地缓存对象
     * @return AuthenticationManager  本地缓存对象
     * @throws Exception 异常
     */
    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

}

首先是自定义登录处理 SelfAuthenticationProvider

@Component
public class SelfAuthenticationProvider implements AuthenticationProvider {

    //DAO查询用户
    @Autowired
    private SelfUserDetailsServiceImpl userDetailsService;

    //密码加密解密
    @Autowired
    private BCryptPasswordEncoder bCryptPasswordEncoder;

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        //表单输入的用户名
        String username = (String) authentication.getPrincipal();
        //表单输入的密码
        String password = (String) authentication.getCredentials();
        UserDetails userDetails = userDetailsService.loadUserByUsername(username);
        //对加密密码进行验证
        if(bCryptPasswordEncoder.matches(password,userDetails.getPassword())){
            return new UsernamePasswordAuthenticationToken(username,password,null);
        }else {
            throw new BadCredentialsException("密码错误");
        }
    }

    @Override
    public boolean supports(Class<?> aClass) {
        return true;
    }

然后是登陆成功处理类 UrlAuthenticationSuccessHandler

@Component
public class UrlAuthenticationSuccessHandler implements AuthenticationSuccessHandler {

    @Override
    public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException {        
        //security在分布式环境token使用，下一章会写道
        Cookie token = TokenUtils.createToken(httpServletRequest);
        httpServletResponse.addCookie(token);
        httpServletResponse.setHeader("Content-Type", "application/json;charset=utf-8");
        httpServletResponse.setStatus(200);
        PrintWriter writer = httpServletResponse.getWriter();
        writer.write(HttpResult.getJsonResult(200,"登陆成功"));
        writer.flush();
        writer.close();
    }
}

然后是登录失败处理类 UrlAuthenticationFailureHandler

@Component
public class UrlAuthenticationFailureHandler implements AuthenticationFailureHandler {

    @Override
    public void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException {
        httpServletResponse.setCharacterEncoding("UTF-8");
        httpServletResponse.setStatus(401);
        PrintWriter writer = httpServletResponse.getWriter();
        writer.write(HttpResult.getJsonResult(401,"登陆失败"));
        writer.flush();
        writer.close();
    }
}

最后是注销成功处理类

@Component
public class UrlLogoutSuccessHandler implements LogoutSuccessHandler {

    @Override
    public void onLogoutSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException {
        httpServletResponse.setCharacterEncoding("UTF-8");
        httpServletResponse.setStatus(200);
        PrintWriter writer = httpServletResponse.getWriter();
        writer.write(HttpResult.getJsonResult(100,"注销成功"));
        writer.flush();
        writer.close();
    }
}

至此后端代码就全部完成，前端根据JSON解析来完成登录及身份验证的全部动作。在配置类中可以看到我开启禁用session配置，目的是将用户信息存入redis，实现分布式身份验证需求。在单机环境下，可以开启session（默认开启），同时在过滤链中将自定义的TokenAuthenticationFilter去掉即可。

下一章我将介绍在分布式集群环境下使用spring security的详细配置。

本文章为转载内容，我们尊重原作者对文章享有的著作权。如有内容错误或侵权问题，欢迎原作者联系我们进行内容更正或删除文章。