使用Spring Security+jwt+redis实现登录注册逻辑

news/2024/10/18 1:09:01/

Spring Security

Spring Security 是一个提供身份验证、授权和防御常见攻击的框架。它为保护命令式和响应式应用程序提供了一流的支持，是保护基于 Spring 的应用程序的事实标准。
这篇博客主要是记录自己第一次使用springSecurity实现登录逻辑的过程。

使用Spring Security+jwt+redis实现登录注册逻辑

1. 导入依赖
<!--jwt依赖-->
<dependency><groupId>io.jsonwebtoken</groupId><artifactId>jjwt</artifactId>
</dependency>
<dependency><groupId>com.auth0</groupId><artifactId>java-jwt</artifactId>
</dependency>
<dependency><groupId>javax.xml.bind</groupId><artifactId>jaxb-api</artifactId>
</dependency>
<!--SpringSecurity启动器-->
<dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-security</artifactId>
</dependency>
<!-- redis -->
<dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>
  1. 创建JwtUtils工具类
java">package com.h3m.utils;import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import lombok.Data;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;import java.util.Date;@Data
@Component
@ConfigurationProperties(prefix = "config.jwt",ignoreInvalidFields = true)
public class JwtUtils {private String secret;private long expire;// private String header;  /*** 生成token, 根据用户名* @param username* @return*/public String createToken(String username){// 获取当前时间Date nowDate = new Date();// 过期时间Date expireDate = new Date(nowDate.getTime() + expire * 1000);// 生成tokenreturn Jwts.builder().setHeaderParam("typ", "JWT").setSubject(username).setIssuedAt(nowDate).setExpiration(expireDate).signWith(SignatureAlgorithm.HS512, secret).compact();}/*** 获取token中的信息* @param token* @return*/public Claims getTokenClaim(String token){try {return Jwts.parser().setSigningKey(secret).parseClaimsJws(token).getBody();}catch (Exception e){e.printStackTrace();return null;}}/*** 获取token中的用户名* @param token* @return*/public String getUsernameFromToken(String token){Claims claims = getTokenClaim(token);if(claims == null){return null;}return claims.getSubject();}/*** Validate the token* @param token* @param userDetails* @return 返回true表示有效*/public boolean validateToken(String token, UserDetails userDetails) {String username = getUsernameFromToken(token);return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));}/*** Check if the token is expired* @param token* @return 返回true表示过期*/private boolean isTokenExpired(String token) {Date expiration = getTokenClaim(token).getExpiration();return expiration.before(new Date());}
}
  1. 创建Result结果类
java">package com.h3m.domain;import com.h3m.constants.SYSConstant;
import lombok.Data;@Data
public class Result {private Integer code;private String message;private Object data;public Result() {}public Result(Integer code) {this.code = code;}public Result(Integer code, String message) {this.code = code;this.message = message;}public Result(Integer code, String message, Object data) {this.code = code;this.message = message;this.data = data;}// 创建一些静态常量字段public static final Result ADD_SUCCESS = new Result(SYSConstant.CODE_SUCCESS,SYSConstant.ADD_SUCCESS);public static final Result ADD_ERROR = new Result(SYSConstant.CODE_ERROR, SYSConstant.ADD_ERROR);public static final Result UPDATE_SUCCESS = new Result(SYSConstant.CODE_SUCCESS, SYSConstant.UPDATE_SUCCESS);public static final Result UPDATE_ERROR = new Result(SYSConstant.CODE_ERROR, SYSConstant.UPDATE_ERROR);public static final Result DELETE_SUCCESS = new Result(SYSConstant.CODE_SUCCESS, SYSConstant.DELETE_SUCCESS);public static final Result DELETE_ERROR = new Result(SYSConstant.CODE_ERROR, SYSConstant.DELETE_ERROR);public static final Result LOGIN_SUCCESS = new Result(SYSConstant.CODE_SUCCESS, SYSConstant.LOGIN_SUCCESS);public static final Result LOGIN_ERROR = new Result(SYSConstant.CODE_ERROR, SYSConstant.LOGIN_ERROR);
}
  1. 创建SecurityUser实体类

​ 我们需要创建一个用于Security的实体类，并实现UserDetails接口

java">package com.h3m.domain.entity;import lombok.AllArgsConstructor;
import lombok.Data;
import lombok.NoArgsConstructor;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;import java.util.Collection;
import java.util.List;
import java.util.stream.Collectors;@Data
@AllArgsConstructor
@NoArgsConstructor
public class SecurityUser implements UserDetails {private User CurrentUserInfo;
//    private Collection<? extends GrantedAuthority> authorities;private List<Access> accessList;@Overridepublic Collection<? extends GrantedAuthority> getAuthorities() {List<GrantedAuthority> authorities = accessList.stream().map(access -> new SimpleGrantedAuthority(access.getAccessName())).collect(Collectors.toList());return authorities;}@Overridepublic String getPassword() {return CurrentUserInfo.getPassword();}@Overridepublic String getUsername() {return CurrentUserInfo.getUserName();}@Overridepublic boolean isAccountNonExpired() {return true;}@Overridepublic boolean isAccountNonLocked() {return true;}@Overridepublic boolean isCredentialsNonExpired() {return true;}@Overridepublic boolean isEnabled() {return true;}
}
  1. 创建ResponseUtils工具类

​ 这个工具类主要是用于返回数据到前端的。

java">package com.h3m.utils;import com.fasterxml.jackson.databind.ObjectMapper;
import com.h3m.domain.Result;import javax.servlet.http.HttpServletResponse;
import java.io.IOException;public class ResponseUtils {public static void writeResponse(HttpServletResponse response, Result result) throws IOException {response.setCharacterEncoding("UTF-8");response.setContentType("application/json; charset=UTF-8");ObjectMapper objectMapper = new ObjectMapper();String jsonResponse = objectMapper.writeValueAsString(result);response.getWriter().write(jsonResponse);}
}
  1. 创建登录过滤器jwtLoginFilter

​ 这里我们主要是重写三个方法，实现整个登录的过滤。

java">package com.h3m.filter;import com.fasterxml.jackson.databind.ObjectMapper;
import com.h3m.constants.SYSConstant;
import com.h3m.domain.Result;
import com.h3m.utils.JwtUtils;
import com.h3m.domain.entity.SecurityUser;
import com.h3m.domain.entity.User;
import com.h3m.utils.ResponseUtils;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.ArrayList;public class JwtLoginFilter extends UsernamePasswordAuthenticationFilter {private JwtUtils jwtConfig;private AuthenticationManager authenticationManager;private RedisTemplate redisTemplate;public JwtLoginFilter(AuthenticationManager authenticationManager, JwtUtils jwtConfig, RedisTemplate redisTemplate) {this.authenticationManager = authenticationManager;this.jwtConfig = jwtConfig;this.redisTemplate = redisTemplate;super.setFilterProcessesUrl("/login");}/*** 这个方法是在用户登录的时候调用的方法* @param request* @param response* @return* @throws AuthenticationException*/@Overridepublic Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {//获取表单提供的数据ObjectMapper objectMapper = new ObjectMapper();try {User user = objectMapper.readValue(request.getInputStream(), User.class);//校验==认证的过程Authentication authenticate = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.getUserName(), user.getPassword(), new ArrayList<>()));return authenticate;} catch (IOException e) {e.printStackTrace();throw new RuntimeException("认证失败");}}/*** 这个方法是在用户登录成功后调用的方法* @param request* @param response* @param chain* @param authResult*/@Overrideprotected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws ServletException, IOException {//得到用户名SecurityUser securityUser = (SecurityUser) authResult.getPrincipal();System.out.println("securityUser = " + securityUser);String username = securityUser.getUsername();//生成tokenString token = jwtConfig.createToken(username);//存入到redis  username: 权限redisTemplate.opsForValue().set(username, securityUser.getAuthorities());// 返回tokenresponse.addHeader("Authorization", "Bearer " + token);// 登录成功后，封装用户以及对应权限信息返回// 返回用户信息Result result = new Result(SYSConstant.CODE_SUCCESS, SYSConstant.LOGIN_SUCCESS, securityUser);ResponseUtils.writeResponse(response, result);}/*** 这个方法是在用户登录失败后调用的方法* @param request* @param response* @param failed* @throws AuthenticationException*/@Overrideprotected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws AuthenticationException, ServletException, IOException {ResponseUtils.writeResponse(response, new Result(SYSConstant.CODE_ERROR, "登录失败, 主要原因："+failed.getMessage()));}
}
  1. 创建权限过滤器 AuthFilter
package com.h3m.filter;import com.h3m.utils.JwtUtils;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;public class AuthFilter extends BasicAuthenticationFilter {private JwtUtils jwtConfig;private RedisTemplate redisTemplate;public AuthFilter(AuthenticationManager authenticationManager, RedisTemplate redisTemplate, JwtUtils jwtConfig) {super(authenticationManager);this.jwtConfig = jwtConfig;this.redisTemplate = redisTemplate;}/*** 这里我们只需要重写过滤方法，在其中实现我们的逻辑即可**/@Overrideprotected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {// 从请求头中获取token所在的字段String authorizationHeader = request.getHeader("Authorization");if (authorizationHeader != null && !authorizationHeader.isEmpty() && authorizationHeader.startsWith("Bearer ")) {// 获取tokenString token = authorizationHeader.substring(7);// 解析token，获得用户名String username = jwtConfig.getUsernameFromToken(token);//从redis中获得该用户名对应的权限List<String> authList = (List<String>) redisTemplate.opsForValue().get(username);//将取出的权限存入到权限上下文中，表示当前token对应的用户具备哪些权限Collection<GrantedAuthority> authorities = new ArrayList<>();if (authList != null) {for (String auth : authList) {authorities.add(new SimpleGrantedAuthority(auth));}}// 生成认证信息对象UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(username, null, authorities);// 把认证信息对象存入到权限上下文中SecurityContextHolder.getContext().setAuthentication(authenticationToken);}// 放行chain.doFilter(request, response);}}
  1. 创建登出处理器
java">package com.h3m.handler;import com.h3m.constants.SYSConstant;
import com.h3m.domain.Result;
import com.h3m.utils.JwtUtils;
import com.h3m.utils.ResponseUtils;
import com.mysql.cj.util.StringUtils;
import lombok.RequiredArgsConstructor;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.logout.LogoutHandler;
import org.springframework.stereotype.Component;import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;@RequiredArgsConstructor
@Component
public class TokenLogOutHandler implements LogoutHandler {private final JwtUtils jwtConfig;private final RedisTemplate redisTemplate;@Overridepublic void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {//1.获取token所在请求头String authorizationHeader = request.getHeader("Authorization");if (!StringUtils.isNullOrEmpty(authorizationHeader) && authorizationHeader.startsWith("Bearer ")) {String token = authorizationHeader.substring(7); // 去掉 "Bearer " 前缀，得到 token// 使用 token 进行后续操作String username = jwtConfig.getUsernameFromToken(token);redisTemplate.delete(username);}try {ResponseUtils.writeResponse(response, new Result(SYSConstant.CODE_SUCCESS, "登出成功"));} catch (IOException e) {throw new RuntimeException(e);}}
}
  1. 创建UserDetailServiceImpl实现类
java">package com.h3m.service.ServiceImpl;import com.h3m.domain.entity.Access;
import com.h3m.domain.entity.SecurityUser;
import com.h3m.domain.entity.User;
import com.h3m.domain.entity.UserRole;
import com.h3m.service.AccessService;
import com.h3m.service.RoleAccessService;
import com.h3m.service.UserRoleService;
import com.h3m.service.UserService;
import lombok.RequiredArgsConstructor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.web.PortResolverImpl;
import org.springframework.stereotype.Service;import java.math.BigInteger;
import java.util.List;
import java.util.Objects;
import java.util.stream.Collectors;@RequiredArgsConstructor
@Service
public class UserDetailServiceImpl implements UserDetailsService {private final UserService userService;private final UserRoleService userRoleService;private final RoleAccessService roleAccessService;private final AccessService accessService;@Overridepublic UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {//根据用户名从数据库查询到该用户的信息User user = userService.selectByUsername(username);if(Objects.isNull(user)) {throw new UsernameNotFoundException("当前用户不存在");}// 查询用户的权限信息// 1. 根据user_id查询用户的角色_idUserRole userRole = userRoleService.selectByUserId(user.getId());// 2. 根据角色id查询用户的权限_idList<BigInteger> AccessIdList = roleAccessService.selectByRoleId(userRole.getRoleId());// 3. 根据权限id查询用户的权限信息List<Access> accessList = accessService.selectByAccessIdList(AccessIdList);// 将权限信息转换为 GrantedAuthority 集合
//        List<GrantedAuthority> authorities = accessList.stream()
//                .map(access -> new SimpleGrantedAuthority(access.getAccessName()))
//                .collect(Collectors.toList());// 返回SecurityUser对象return new SecurityUser(user, accessList);}
}
  1. 创建SpringSecurity配置类
java">package com.h3m.config;import com.h3m.filter.AuthFilter;
import com.h3m.filter.JwtLoginFilter;import com.h3m.handler.TokenLogOutHandler;
import com.h3m.utils.JwtUtils;
import lombok.RequiredArgsConstructor;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;import javax.servlet.http.HttpServletResponse;@Configuration
@RequiredArgsConstructor
public class SecurityConfig {private final JwtUtils jwtConfig;private final TokenLogOutHandler logoutHandler;private final RedisTemplate redisTemplate;@Beanpublic SecurityFilterChain securityFilterChain(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception {JwtLoginFilter jwtLoginFilter = new JwtLoginFilter(authenticationManager, jwtConfig, redisTemplate);AuthFilter authFilter = new AuthFilter(authenticationManager, redisTemplate, jwtConfig);http.csrf().disable().authorizeHttpRequests().antMatchers("/login", "/user/register").permitAll().anyRequest().authenticated().and().addFilter(jwtLoginFilter)  // 登录请求需要经过这个过滤器.addFilterBefore(authFilter, UsernamePasswordAuthenticationFilter.class)  // 确保 authFilter 在合适的位置.logout().logoutUrl("/logout").addLogoutHandler(logoutHandler).logoutSuccessHandler((request, response, authentication) -> response.setStatus(HttpServletResponse.SC_OK));return http.build();}@Beanpublic PasswordEncoder passwordEncoder() {return new BCryptPasswordEncoder();}@Beanpublic AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {return authenticationConfiguration.getAuthenticationManager();}}
  1. 编写接口

/login

由于我们在过滤器中已经实现了jwt的生成，以及返回信息，实际上登录接口这里我们不需要实现任何内容。

java">    /*** 登录接口* @return*/@PostMapping("/login")public void login() {// 获取当前登录用户的信息
//        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
//        SecurityUser currentUser = (SecurityUser) authentication.getPrincipal();
//        return new Result(SYSConstant.CODE_SUCCESS, SYSConstant.LOGIN_SUCCESS, currentUser);}

/register 我们在注册的时候需要对密码进行编码

java">private final PasswordEncoder passwordEncoder;private final UserService userService;private final UserRoleService userRoleService;@PostMapping("/register")public Result register(@RequestBody User user) {log.info("用户注册: {}", user);// 对密码进行加密user.setPassword(passwordEncoder.encode(user.getPassword()));// 注册用户, 调用save方法插入一条记录boolean flag_1 = userService.save(user);// 创建默认用户角色UserRole userRole = new UserRole();userRole.setUserId(user.getId());// 插入一条记录, 虽然这里只传入了一个userId,但是roleId字段有默认值为2，即普通用户boolean flag_2 = userRoleService.save(userRole);if (flag_1 && flag_2) {return new Result(SYSConstant.CODE_SUCCESS, "注册成功");} else {return new Result(SYSConstant.CODE_ERROR, "注册失败");}}

http://www.ppmy.cn/news/1538499.html

相关文章

2410git,git合并pr

2410git,git合并pr

git remote add dy https://github.com/dlang/dmd //添加远程,可以多添加几个,作为基础. git remote update //远程更新,全部拉进本地 git remote -v git branch -r //查看 git checkout -b pt dd/private-this //从某个分支拉到本地为pt分支 git checkout master //切换到主分…
阅读更多...
Llama 3.2 智能代理开发教程

Llama 3.2 智能代理开发教程

构建研究代理可能很复杂&#xff0c;但使用 LangChain 和 Ollama&#xff0c;它会变得更加简单和模块化。 在本教程中&#xff0c;我们将向你展示如何基于Llama 3.2创建一个研究代理&#xff0c;该代理可以路由查询、执行网络搜索并使用工作流和 LLM 的组合生成详细响应。最后…
阅读更多...
【Linux系统编程】第三十一弹---深入理解静态库：从零开始制作与高效使用的完全指南

【Linux系统编程】第三十一弹---深入理解静态库：从零开始制作与高效使用的完全指南

✨个人主页&#xff1a; 熬夜学编程的小林 &#x1f497;系列专栏&#xff1a; 【C语言详解】 【数据结构详解】【C详解】【Linux系统编程】 目录 1、静态库 1.1、怎么做静态库 1.2、怎么使用静态库 1、静态库 1.1、怎么做静态库 在Linux环境下&#xff0c;通常使用GCC&am…
阅读更多...
Hi3061M——不定长串口接收实现

Hi3061M——不定长串口接收实现

这里写目录标题 前言串口接收流程串口中断函数ReadITCallBack1中断接收函数 补充结果展示 前言 Hi3061M给了很多相关的串口案例&#xff0c;但大多数是定长的&#xff0c;指定长度进行接收读取&#xff0c;而实际需求往往需要用到不定长的接收。 串口接收流程 首先介绍下Hi3…
阅读更多...
rpa批量发送邮件如何通过编辑器编发邮件？

rpa批量发送邮件如何通过编辑器编发邮件？

rpa批量发送邮件的技巧&#xff1f;怎么使用rpa邮箱群发助手&#xff1f; 手动发送邮件变得越来越繁琐且效率低下。为了解决这一问题&#xff0c;越来越多的企业开始采用RPA技术来批量发送邮件。AokSend将详细探讨如何通过编辑器来实现rpa批量发送邮件的功能&#xff0c;从而提…
阅读更多...
C#WPF自定义表盘实例

C#WPF自定义表盘实例

本文实现C#WPF自定义美观的表盘。 先看效果 目录 表盘一 表盘二 窗体中使用 表盘一 <UserControlx:Class="MyControl.ucSpeedDialPlate"xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"xmlns:x="http://schemas.microsof…
阅读更多...
社区团购便利店蔬菜超市分销商城小程序

社区团购便利店蔬菜超市分销商城小程序

#分销 裂变分销&#xff0c;智能锁粉快速沉淀客户 #团队分红 拓展销售渠道&#xff0c;增强品牌知名度&#xff0c;提升团队成员宣传积极性&#xff0c;打造人气商城。 #供应商 供应关系搭建&#xff0c;供应周期管理 #积分商城 完成积分兑换&#xff0c;实现积分价…
阅读更多...
网络安全之XXE攻击

网络安全之XXE攻击

0x01 什么是 XXE 个人认为&#xff0c;XXE 可以归结为一句话&#xff1a;构造恶意 DTD 介绍 XXE 之前&#xff0c;我先来说一下普通的 XML 注入&#xff0c;这个的利用面比较狭窄&#xff0c;如果有的话应该也是逻辑漏洞。 既然能插入 XML 代码&#xff0c;那我们肯定不能善罢…
阅读更多...
最新文章

Copyright @ 2022~2023