SpringBoot应用篇（二）：SpringSecurity实现带验证码的登录认证 附代码

spring.datasource.url=jdbc:mysql://localhost:3306/test?characterEncoding=utf8&useSSL=false&serverTimezone=GMT
spring.datasource.driver-class-name=com.mysql.jdbc.Driver
spring.datasource.username=root
spring.datasource.password=

package com.shf.security.security.config; import com.shf.security.user.entity.TUser;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails; import java.util.Collection; /**
* 描述：自定义UserDetails，使UserDetails具有TUser的实体结构
*
* @Author shf
* @Date 2019/4/19 10:30
* @Version V1.0
**/
public class CustomUserDetails extends TUser implements UserDetails {
public CustomUserDetails(TUser tUser){
if(null != tUser){
this.setId(tUser.getId());
this.setCode(tUser.getCode());
this.setCreateTime(tUser.getCreateTime());
this.setUpdateTime(tUser.getUpdateTime());
this.setUsername(tUser.getUsername());
this.setPassword(tUser.getPassword());
this.setIsDelete(tUser.getIsDelete());
this.setEmail(tUser.getEmail());
this.setPhone(tUser.getPhone());
this.setRole(tUser.getRole());
}
}
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return null;
} @Override
public boolean isAccountNonExpired() {
return true;
} @Override
public boolean isAccountNonLocked() {
return true;
} @Override
public boolean isCredentialsNonExpired() {
return true;
} @Override
public boolean isEnabled() {
return true;
}
}

package com.shf.security.security.config; import com.shf.security.user.entity.TUser;
import com.shf.security.user.service.TUserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Component; /**
* 描述：自定义UserDetailsService，从数据库读取用户信息，实现登录验证
*
* @Author shf
* @Date 2019/4/21 17:21
* @Version V1.0
**/
@Component
public class CustomUserDetailsService implements UserDetailsService {
@Autowired
private TUserService userService; /**
* 认证过程中 - 根据登录信息获取用户详细信息
*
* @param username 登录用户输入的用户名
* @return
* @throws UsernameNotFoundException
*/
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
//根据用户输入的用户信息，查询数据库中已注册用户信息
TUser user = userService.findByName(username);
//如果用户不存在直接抛出UsernameNotFoundException异常
if (user == null) throw new UsernameNotFoundException("用户名为" + username + "的用户不存在");
return new CustomUserDetails(user);
}
}

package com.shf.security.security.config; import org.springframework.security.web.authentication.WebAuthenticationDetails; import javax.servlet.http.HttpServletRequest; /**
* 描述：自定义WebAuthenticationDetails，将验证码和用户名、密码一同带入AuthenticationProvider中
*
* @Author shf
* @Date 2019/4/21 16:58
* @Version V1.0
**/
public class CustomWebAuthenticationDetails extends WebAuthenticationDetails {
private static final long serialVersionUID = 6975601077710753878L;
private final String verifyCode;
public CustomWebAuthenticationDetails(HttpServletRequest request) {
super(request);
verifyCode = request.getParameter("verifyCode");
} public String getVerifyCode() {
return verifyCode;
} @Override
public String toString() {
StringBuilder sb = new StringBuilder();
sb.append(super.toString()).append("; verifyCode: ").append(this.getVerifyCode());
return sb.toString();
}
}

package com.shf.security.security.config; import org.springframework.security.authentication.AuthenticationDetailsSource;
import org.springframework.security.web.authentication.WebAuthenticationDetails;
import org.springframework.stereotype.Component; import javax.servlet.http.HttpServletRequest; /**
* 描述：自定义AuthenticationDetailsSource，将HttpServletRequest注入到CustomWebAuthenticationDetails，使其能获取到请求中的验证码等其他信息
*
* @Author shf
* @Date 2019/4/21 17:03
* @Version V1.0
**/
@Component
public class CustomAuthenticationDetailsSource implements AuthenticationDetailsSource<HttpServletRequest, WebAuthenticationDetails> {
@Override
public WebAuthenticationDetails buildDetails(HttpServletRequest request) {
return new CustomWebAuthenticationDetails(request);
}
}

package com.shf.security.security.config; import com.shf.security.utils.VerifyCodeUtil;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.DisabledException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes; import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession; /**
* 描述：自定义SpringSecurity的认证器
*
* @Author shf
* @Date 2019/4/21 17:30
* @Version V1.0
**/
@Component
@Slf4j
public class CustomAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {//implements AuthenticationProvider {
@Autowired
private CustomUserDetailsService userDetailsService; @Override
protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken) throws AuthenticationException { } @Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
//用户输入的用户名
String username = authentication.getName();
//用户输入的密码
String password = authentication.getCredentials().toString();
//通过CustomWebAuthenticationDetails获取用户输入的验证码信息
CustomWebAuthenticationDetails details = (CustomWebAuthenticationDetails) authentication.getDetails();
String verifyCode = details.getVerifyCode();
if(null == verifyCode || verifyCode.isEmpty()){
log.warn("未输入验证码");
throw new NullPointerException("请输入验证码");
}
//校验验证码
if(!validateVerifyCode(verifyCode)){
log.warn("验证码输入错误");
throw new DisabledException("验证码输入错误");
}
//通过自定义的CustomUserDetailsService，以用户输入的用户名查询用户信息
CustomUserDetails userDetails = (CustomUserDetails) userDetailsService.loadUserByUsername(username);
//校验用户密码
if(!userDetails.getPassword().equals(password)){
log.warn("密码错误");
throw new BadCredentialsException("密码错误");
}
Object principalToReturn = userDetails;
//将用户信息塞到SecurityContext中，方便获取当前用户信息
return this.createSuccessAuthentication(principalToReturn, authentication, userDetails);
} @Override
protected UserDetails retrieveUser(String s, UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken) throws AuthenticationException {
return null;
} /**
* 验证用户输入的验证码
* @param inputVerifyCode
* @return
*/
public boolean validateVerifyCode(String inputVerifyCode){
//获取当前线程绑定的request对象
HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();
// 这个VerifyCodeFactory.SESSION_KEY是在servlet中存入session的名字
HttpSession session = request.getSession();
String verifyCode = (String)session.getAttribute(VerifyCodeUtil.SESSION_KEY);
if(null == verifyCode || verifyCode.isEmpty()){
log.warn("验证码过期请重新验证");
throw new DisabledException("验证码过期，请重新验证");
}
// 不分区大小写
verifyCode = verifyCode.toLowerCase();
inputVerifyCode = inputVerifyCode.toLowerCase(); log.info("验证码：{}, 用户输入：{}", verifyCode, inputVerifyCode); return verifyCode.equals(inputVerifyCode);
} @Override
public boolean supports(Class<?> authentication) {
return authentication.equals(UsernamePasswordAuthenticationToken.class);
}
}

package com.shf.security.security.config; import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationDetailsSource;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.web.authentication.WebAuthenticationDetails;
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler; import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter; /**
* 描述：
*
* @Author shf
* @Date 2019/4/19 10:54
* @Version V1.0
**/
@Configuration
@EnableWebSecurity
@Slf4j
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private CustomAuthenticationProvider customAuthenticationProvider; @Autowired
private CustomUserDetailsService customUserDetailsService; @Autowired
private AuthenticationDetailsSource<HttpServletRequest, WebAuthenticationDetails> authenticationDetailsSource; @Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
//将自定义的CustomAuthenticationProvider装配到AuthenticationManagerBuilder
auth.authenticationProvider(customAuthenticationProvider);
//将自定的CustomUserDetailsService装配到AuthenticationManagerBuilder
auth.userDetailsService(customUserDetailsService).passwordEncoder(new PasswordEncoder() {
@Override
public String encode(CharSequence charSequence) {
return charSequence.toString();
} @Override
public boolean matches(CharSequence charSequence, String s) {
return s.equals(charSequence.toString());
}
});
}
@Override
public void configure(HttpSecurity http) throws Exception {
http
.cors()
.and().csrf().disable();//开启跨域
http /*匿名请求：不需要进行登录拦截的url*/
.authorizeRequests()
.antMatchers("/getVerifyCode").permitAll()
.anyRequest().authenticated()//其他的路径都是登录后才可访问
.and()
/*登录配置*/
.formLogin()
.loginPage("/login_page")//登录页，当未登录时会重定向到该页面
.successHandler(authenticationSuccessHandler())//登录成功处理
.failureHandler(authenticationFailureHandler())//登录失败处理
.authenticationDetailsSource(authenticationDetailsSource)//自定义验证逻辑，增加验证码信息
.loginProcessingUrl("/login")//restful登录请求地址
.usernameParameter("username")//默认的用户名参数
.passwordParameter("password")//默认的密码参数
.permitAll()
.and()
/*登出配置*/
.logout()
.permitAll()
.logoutSuccessHandler(logoutSuccessHandler());
} /**
* security检验忽略的请求，比如静态资源不需要登录的可在本处配置
* @param web
*/
@Override
public void configure(WebSecurity web){
// platform.ignoring().antMatchers("/");
} @Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService()).passwordEncoder(passwordEncoder());
auth.eraseCredentials(false);
}
//密码加密配置
@Bean
public BCryptPasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder(4);
}
//登入成功
@Bean
public AuthenticationSuccessHandler authenticationSuccessHandler() {
return new AuthenticationSuccessHandler() {
/**
* 处理登入成功的请求
*
* @param httpServletRequest
* @param httpServletResponse
* @param authentication
* @throws IOException
* @throws ServletException
*/
@Override
public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {
httpServletResponse.setContentType("application/json;charset=utf-8");
PrintWriter out = httpServletResponse.getWriter();
out.write("{\"status\":\"success\",\"msg\":\"登录成功\"}");
out.flush();
out.close();
}
};
}
//登录失败
@Bean
public AuthenticationFailureHandler authenticationFailureHandler(){
return new AuthenticationFailureHandler() {
/**
* 处理登录失败的请求
* @param httpServletRequest
* @param httpServletResponse
* @param e
* @throws IOException
* @throws ServletException
*/
@Override
public void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {
httpServletResponse.setContentType("application/json;charset=utf-8");
PrintWriter out = httpServletResponse.getWriter();
out.write("{\"status\":\"error\",\"msg\":\"登录失败\"}");
out.flush();
out.close();
}
};
}
//登出处理
@Bean
public LogoutSuccessHandler logoutSuccessHandler() {
return new LogoutSuccessHandler() {
/**
* 处理登出成功的请求
*
* @param httpServletRequest
* @param httpServletResponse
* @param authentication
* @throws IOException
* @throws ServletException
*/
@Override
public void onLogoutSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {
httpServletResponse.setContentType("application/json;charset=utf-8");
PrintWriter out = httpServletResponse.getWriter();
out.write("{\"status\":\"success\",\"msg\":\"登出成功\"}");
out.flush();
out.close();
}
};
}
}

package com.shf.security.utils; import com.shf.security.user.entity.TUser;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder; /**
* 描述：
*
* @Author shf
* @Description TODO
* @Date 2019/4/21 15:24
* @Version V1.0
**/
public class UserHolder {
public static TUser getUserDetail(){
SecurityContext ctx = SecurityContextHolder.getContext();
Authentication auth = ctx.getAuthentication();
TUser user = (TUser) auth.getPrincipal();
return user;
}
public static String getUserCode(){
SecurityContext ctx = SecurityContextHolder.getContext();
Authentication auth = ctx.getAuthentication();
TUser user = (TUser) auth.getPrincipal();
return user.getCode();
}
public static int getUserId(){
SecurityContext ctx = SecurityContextHolder.getContext();
Authentication auth = ctx.getAuthentication();
TUser user = (TUser) auth.getPrincipal();
return user.getId();
}
}

.and()
.addFilterBefore(new VerifyCodeFilter(),UsernamePasswordAuthenticationFilter.class)