網站首頁編程語言正文

SpringSecurity+JWT實現認證及授權詳細步驟

作者：小孫小孫夢想成真更新時間： 2022-08-13 編程語言

表單認證流程

想要實現SpringSecurity的認證授權，首先需要理解大致流程。
在這里插入圖片描述

準備工作

導入maven依賴

	<dependency>
	    <groupId>org.springframework.boot</groupId>
	    <artifactId>spring-boot-starter-security</artifactId>
	</dependency>
	<!--jwt工具-->
	<dependency>
	    <groupId>io.jsonwebtoken</groupId>
	    <artifactId>jjwt</artifactId>
	    <version>0.9.0</version>
	</dependency>

創建數據庫表

表數據如下：
創建生成jwtToken的工具類

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;

import java.util.Date;
import java.util.HashMap;
import java.util.Map;

/**
 * JwtToken生成的工具類
 */
@Component
public class JwtTokenUtil {
    private static final Logger LOGGER = LoggerFactory.getLogger(JwtTokenUtil.class);
    private static final String CLAIM_KEY_USERNAME = "sub";
    private static final String CLAIM_KEY_CREATED = "created";
    @Value("${jwt.secret}")
    private String secret;
    @Value("${jwt.expiration}")
    private Long expiration;

    /**
     * 根據負責生成JWT的token
     */
    private String generateToken(Map<String, Object> claims) {
        return Jwts.builder()
                .setClaims(claims)
                .setExpiration(generateExpirationDate())
                .signWith(SignatureAlgorithm.HS512, secret)
                .compact();
    }

    /**
     * 從token中獲取JWT中的負載
     */
    private Claims getClaimsFromToken(String token) {
        Claims claims = null;
        try {
            claims = Jwts.parser()
                    .setSigningKey(secret)
                    .parseClaimsJws(token)
                    .getBody();
        } catch (Exception e) {
            LOGGER.info("JWT格式驗證失敗:{}",token);
        }
        return claims;
    }

    /**
     * 生成token的過期時間
     */
    private Date generateExpirationDate() {
        return new Date(System.currentTimeMillis() + expiration * 1000);
    }

    /**
     * 從token中獲取登錄用戶名
     */
    public String getUserNameFromToken(String token) {
        String username;
        try {
            Claims claims = getClaimsFromToken(token);
            username =  claims.getSubject();
        } catch (Exception e) {
            username = null;
        }
        return username;
    }

    /**
     * 驗證token是否還有效
     *
     * @param token       客戶端傳入的token
     * @param userDetails 從數據庫中查詢出來的用戶信息
     */
    public boolean validateToken(String token, UserDetails userDetails) {
        String username = getUserNameFromToken(token);
        return username.equals(userDetails.getUsername()) && !isTokenExpired(token);
    }

    /**
     * 判斷token是否已經失效
     */
    private boolean isTokenExpired(String token) {
        Date expiredDate = getExpiredDateFromToken(token);
        return expiredDate.before(new Date());
    }

    /**
     * 從token中獲取過期時間
     */
    private Date getExpiredDateFromToken(String token) {
        Claims claims = getClaimsFromToken(token);
        return claims.getExpiration();
    }

    /**
     * 根據用戶信息生成token
     */
    public String generateToken(UserDetails userDetails) {
        Map<String, Object> claims = new HashMap<>();
        claims.put(CLAIM_KEY_USERNAME, userDetails.getUsername());
        claims.put(CLAIM_KEY_CREATED, new Date());
        return generateToken(claims);
    }

    /**
     * 判斷token是否可以被刷新
     */
    public boolean canRefresh(String token) {
        return !isTokenExpired(token);
    }

    /**
     * 刷新token
     */
    public String refreshToken(String token) {
        Claims claims = getClaimsFromToken(token);
        claims.put(CLAIM_KEY_CREATED, new Date());
        return generateToken(claims);
    }
}

實現

實現思路

實現UserDetailsService對象中的loadUserByUsername方法，根據用戶名查詢用戶信息以及權限信息；
自定義controller登錄接口；
自定義service層登錄邏輯，調用loadUserByUsername獲取用戶信息并且校驗密碼，如果認證成功則生成一個jwt返回，將用戶信息存入SecurityContextHolder上下文；
自定義JwtAuthenticationTokenFilter過濾器，獲取請求頭中的token，校驗token的有效性并從中獲取username，調用loadUserByUsername獲取用戶信息，存入SecurityContextHolder上下文。

這里為什么要將用戶信息及權限存入SecurityContextHolder上下文中？
SecurityContextHolder基于ThreadLocal，SpringSecurity的底層就是一個過濾器鏈，并且這些過濾器都是一條線執行的。
在這里插入圖片描述
而權限的驗證主要就是在FilterSecurityInterceptor過濾器中執行的，將用戶權限信息存入SecurityContextHolder上下文中，就是為了使后面的過濾器在執行相關權限驗證的功能時能夠獲取到用戶的權限信息。

SpringSecurity配置類

/**
 * SpringSecurity配置類
 */
@Configuration
@EnableWebSecurity  // 開啟Security
@EnableGlobalMethodSecurity(prePostEnabled=true)    // 開啟權限功能
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private RestAuthenticationEntryPoint restAuthenticationEntryPoint;

    @Autowired
    private RestfulAccessDeniedHandler restfulAccessDeniedHandler;

    @Autowired
    private UserMapper userMapper;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf()// 由于使用的是JWT，我們這里不需要csrf
                .disable()
                .sessionManagement()// 基于token，所以不需要session
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .authorizeRequests()
                .antMatchers(HttpMethod.GET, // 允許對于網站靜態資源的無授權訪問
                        "/",
                        "/*.html",
                        "/favicon.ico",
                        "/**/*.html",
                        "/**/*.css",
                        "/**/*.js",
                        "/swagger-resources/**",
                        "/v2/api-docs/**"
                )
                .permitAll()
                .antMatchers("/user/login", "/user/register")// 對登錄注冊要允許匿名訪問
                .permitAll()
                .antMatchers(HttpMethod.OPTIONS)//跨域請求會先進行一次options請求
                .permitAll()
                .anyRequest()// 除上面外的所有請求全部需要鑒權認證
                .authenticated();
        // 禁用緩存
        http.headers().cacheControl();
        // 添加JWT filter
        http.addFilterBefore(jwtAuthenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class);
        //添加自定義未授權和未登錄結果返回
        http.exceptionHandling()
                .accessDeniedHandler(restfulAccessDeniedHandler)
                .authenticationEntryPoint(restAuthenticationEntryPoint);
    }

    @Bean
    public UserDetailsService userDetailsService() {
        // loadUserByUsername()
        return username -> {
            // 查詢用戶信息
            User user = userMapper.getUserByUsername(username);
            if (!Objects.isNull(user)) {
                // 查詢該用戶的權限信息
                List<Menu> menus = userMapper.getPermsByUserId(user.getId());
                return new UserAuthDetails(user, menus);
            }
            // 用戶名不存在
            throw new UserNotExistException("該用戶不存在");
        };
    }

    /**
     * 密碼加密方式
     */
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter(){
        return new JwtAuthenticationTokenFilter();
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
}

UserDetailsService：注冊該組件并實現核心邏輯方法，根據傳來用戶名查詢該用戶的信息。
PasswordEncoder：指定加密方式為BCryptPasswordEncoder，不指定則使用默認的明文存儲密碼的方式。
JwtAuthenticationTokenFilter：jwt登錄授權過濾器，用于驗證請求頭攜帶token的是否有效。
方法詳細見下文。

RestAuthenticationEntryPoint

當未登錄或者token失效訪問接口時，自定義的返回結果。

@Component
public class RestAuthenticationEntryPoint implements AuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException {
        response.setCharacterEncoding("UTF-8");
        response.setContentType("application/json");
        response.getWriter().println(R.error(10002, "無效的token"));
        response.getWriter().flush();
    }
}

RestfulAccessDeniedHandler

當訪問接口沒有權限時，自定義的返回結果。

@Component
public class RestfulAccessDeniedHandler implements AccessDeniedHandler{
    @Override
    public void handle(HttpServletRequest request,
                       HttpServletResponse response,
                       AccessDeniedException e) throws IOException, ServletException {
        response.setCharacterEncoding("UTF-8");
        response.setContentType("application/json");
        response.getWriter().println(R.error(10003, "無權限訪問"));
        response.getWriter().flush();
    }
}

JwtAuthenticationTokenFilter

public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
    private static final Logger LOGGER = LoggerFactory.getLogger(JwtAuthenticationTokenFilter.class);
    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private JwtTokenUtil jwtTokenUtil;

    @Value("${jwt.tokenHeader}")
    private String tokenHeader; // 請求頭名: token

    @Value("${jwt.tokenHead}")
    private String tokenHead;   // jwt中的header部分

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain chain) throws ServletException, IOException {
        // 獲取請求頭中的token
        String authToken = request.getHeader(this.tokenHeader);

        if (authToken != null && authToken.startsWith(this.tokenHead)) {
            // 從token中獲取username
            String username = jwtTokenUtil.getUserNameFromToken(authToken);
            LOGGER.info("checking username:{}", username);
            if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
                UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
                // 驗證該token是否有效
                if (jwtTokenUtil.validateToken(authToken, userDetails)) {
                    // 將 userDetails 封裝為一個 authentication 對象
                    UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
                    authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                    LOGGER.info("authenticated user:{}", username);
                    // 存儲 authentication對象 至SecurityContextHolder上下文中
                    SecurityContextHolder.getContext().setAuthentication(authentication);
                }
            }
        }
        chain.doFilter(request, response);
    }
}

UserAuthDetails（UserDetails ）對象

用戶信息以及對應的權限信息都封裝在該對象中，loadUserByUsername方法的返回值。

public class UserAuthDetails implements UserDetails {

    private User user;
    private List<Menu> menus;   // 封裝了user的權限列表信息

    public UserAuthDetails(User user, List<Menu> perms) {
        this.user = user;
        this.menus = perms;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        // 封裝權限信息
        return menus.stream().filter(menu -> menu.getPerm() != null).map(menu -> {
            // 獲取該user對應的權限 封裝到GrantedAuthority對象中
            return new SimpleGrantedAuthority(menu.getPerm());
        }).collect(Collectors.toList());
    }

    @Override
    public String getPassword() {
        return user.getPassword();
    }

    @Override
    public String getUsername() {
        return user.getUsername();
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }
}

Controller

登錄接口以及兩個需要權限訪問的業務功能，以便后續測試。

@Slf4j
@RestController
@RequestMapping("/user")
public class UserController {
    @Autowired
    private UserService userService;

    @PostMapping("/login")
    public R login(@RequestBody User user) {
        String token = null;
        try {
            token = userService.login(user);
        } catch (Exception e) {
            return R.error(10001, e.getMessage());
        }
        log.info("the token is created: {}", token);
        return R.ok().setData(token);
    }
    
    @GetMapping("/list")
    @PreAuthorize("hasAuthority('list')")
    public R list() {
        return R.ok();
    }

    @DeleteMapping("/delete")
    @PreAuthorize("hasAuthority('delete')")
    public R delete() {
        return R.ok();
    }
}

UserService接口及實現類

public interface UserService {

    List<Menu> getPermsByUserId(Integer userId);

    /**
     * 登錄
     * @param user username & password
     * @return token
     */
    String login(User user);
}

@Service
public class UserServiceImpl implements UserService {

    @Autowired
    private UserMapper userMapper;

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Autowired
    private JwtTokenUtil jwtTokenUtil;
    
    @Override
    public List<Menu> getPermsByUserId(Integer userId) {
        return userMapper.getPermsByUserId(userId);
    }

    @Override
    public String login(User user) {
        String token = null;
        String username = user.getUsername();
        String password = user.getPassword();
        UserDetails userDetails = userDetailsService.loadUserByUsername(username);
        if (!Objects.isNull(userDetails)) {
            // 校驗密碼
            boolean matches = passwordEncoder.matches(password, userDetails.getPassword());
            if (!matches) {
                throw new PasswordNotMatchException("用戶名或密碼錯誤");
            }
            // 將UserDetails對象封裝到authentication對象中 并保存至SecurityContextHolder上下文
            UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
            SecurityContextHolder.getContext().setAuthentication(authentication);
            // 生成token返回
            token = jwtTokenUtil.generateToken(userDetails);
        }
        return token;
    }
}

重點查看login方法，上述代碼手動調用了loadUserByUsername方法與matches方法校驗密碼，其實還有一種簡單的方式，從開頭的流程圖中可以發現，在調用ProviderManager對象的authenticate方法時，他在內部已經幫我們調用了loadUserByUsername方法和matches方法進行用戶的認證，并且在認證成功之后會返回一個Authentication，該對象封裝了UserDetails 對象，所以我們也可以直接調用authenticate方法進行認證。

    @Autowired
    private AuthenticationManager authenticationManager;
    @Override
    public String login(User user) {
        String token = null;
        String username = user.getUsername();
        String password = user.getPassword();

        // 將用戶名和密碼封裝為一個Authentication對象
        UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(username, password);
        // 調用認證方法
        Authentication authenticate = authenticationManager.authenticate(authenticationToken);
        if (Objects.isNull(authenticate)) {
            throw new PasswordNotMatchException("用戶名或密碼錯誤");
        }
        UserAuthDetails userDetails = (UserAuthDetails) authenticate.getPrincipal();
        UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null,  userDetails.getAuthorities());
        SecurityContextHolder.getContext().setAuthentication(authentication);
        // 生成token返回
        token = jwtTokenUtil.generateToken(userDetails);

        return token;
    }