Spring boot整合Spring Security实现验证码登陆
验证码登陆在日常使用软件中是很常见的，甚至可以说超过了密码登陆。
如何通过Spring Security框架实现验证码登陆，并且登陆成功之后也同样返回和密码登陆类似的token？
- 先看一张Spring Security拦截请求的流程图
可以发现Spring Security默认有用户名密码登陆拦截器，查看 UsernamePasswordAuthenticationFilter 实现了 AbstractAuthenticationProcessingFilter类 。根据UsernamePasswordAuthenticationFilter的设计模式可以在Spring security的基础上拓展自己的拦截器，实现相应的功能。
- 新增一个 SmsCodeAuthenticationToken 实体类，需要继承IrhAuthenticationToken，而IrhAuthenticationToken继承了 AbstractAuthenticationToken 用来封装验证码登陆时需要的信息，并且自定义一个AuthenticationToken的父类的作用就是用来在管理在具有多种登陆方式的系统中，能记录最核心的两个信息，一个是用户身份，一个是登陆口令；并且在后期能直接向上转型而不报错。
package top.imuster.auth.config; import org.springframework.security.core.GrantedAuthority; import java.util.Collection; /** * @ClassName: SmsCodeAuthenticationToken * @Description: 验证码登录验证信息封装类 * @author: hmr * @date: 2020/4/30 13:59 */ public class SmsCodeAuthenticationToken extends IrhAuthenticationToken { public SmsCodeAuthenticationToken(Object principal, Object credentials) { super(principal, credentials); } public SmsCodeAuthenticationToken(Object principal, Object credentials, Collection<? extends GrantedAuthority> authorities) { super(principal, credentials, authorities); } }
package top.imuster.auth.config; import org.springframework.security.authentication.AbstractAuthenticationToken; import org.springframework.security.core.GrantedAuthority; import java.util.Collection; /** * @Author hmr * @Description 自定义AbstractAuthenticationToken * @Date: 2020/5/1 13:51 * @param irh平台的认证实体类 可以通过继承该类来实现不同的登录逻辑 * @reture: **/ public class IrhAuthenticationToken extends AbstractAuthenticationToken { private static final long serialVersionUID = 110L; //用户信息 protected final Object principal; //密码或者邮箱验证码 protected Object credentials; /** * This constructor can be safely used by any code that wishes to create a * <code>UsernamePasswordAuthenticationToken</code>, as the {@link * #isAuthenticated()} will return <code>false</code>. * */ public IrhAuthenticationToken(Object principal, Object credentials) { super(null); this.principal = principal; this.credentials = credentials; this.setAuthenticated(false); } /** * This constructor should only be used by <code>AuthenticationManager</code> or <code>AuthenticationProvider</code> * implementations that are satisfied with producing a trusted (i.e. {@link #isAuthenticated()} = <code>true</code>) * token token. * * @param principal * @param credentials * @param authorities */ public IrhAuthenticationToken(Object principal, Object credentials, Collection<? extends GrantedAuthority> authorities) { super(authorities); this.principal = principal; this.credentials = credentials; super.setAuthenticated(true); } @Override public Object getCredentials() { return this.credentials; } @Override public Object getPrincipal() { return this.principal; } public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException { if(isAuthenticated) { throw new IllegalArgumentException("Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead"); } else { super.setAuthenticated(false); } } public void eraseCredentials() { super.eraseCredentials(); this.credentials = null; } }
- 继承AbstractAuthenticationProcessingFilter之后就可以将自定义的Filter假如到过滤器链中。所以自定义一个 SmsAuthenticationFilter 类并且继承 AbstractAuthenticationProcessingFilter 类，并且该Filter中只校验输入参数是否正确，如果不完整，则抛出 AuthenticationServiceException异常，如果抛出自定义异常，会被Security框架处理。用原生异常可以设置异常信息，直接返回给前端。
package top.imuster.auth.component.login; import org.apache.commons.lang3.StringUtils; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.authentication.AuthenticationServiceException; import org.springframework.security.core.Authentication; import org.springframework.security.core.AuthenticationException; import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter; import org.springframework.security.web.util.matcher.AntPathRequestMatcher; import top.imuster.auth.config.SecurityConstants; import top.imuster.auth.config.SmsCodeAuthenticationToken; import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; /** * @ClassName: SmsCodeAuthenticationFilter * @Description: 自定义拦截器，拦截登录请求中的登录类型 * @author: hmr * @date: 2020/4/30 12:16 */ public class SmsCodeAuthenticationFilter extends AbstractAuthenticationProcessingFilter { private static final Logger log = LoggerFactory.getLogger(SmsCodeAuthenticationFilter.class); private static final String POST = "post"; private boolean postOnly = true; public SmsCodeAuthenticationFilter(){ super(new AntPathRequestMatcher("/emailCodeLogin", "POST")); } @Autowired AuthenticationManager authenticationManager; @Override @Autowired public void setAuthenticationManager(AuthenticationManager authenticationManager) { super.setAuthenticationManager(authenticationManager); } @Override public Authentication attemptAuthentication(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws AuthenticationException, IOException, ServletException { if(postOnly && !POST.equalsIgnoreCase(httpServletRequest.getMethod())){ throw new AuthenticationServiceException("不允许{}这种的请求方式: " + httpServletRequest.getMethod()); } //邮箱地址 String loginName = obtainParameter(httpServletRequest, SecurityConstants.LOGIN_PARAM_NAME); //验证码 String credentials = obtainParameter(httpServletRequest, SecurityConstants.EMAIL_VERIFY_CODE); loginName = loginName.trim(); if(StringUtils.isBlank(loginName)) throw new AuthenticationServiceException("登录名不能为空"); if(StringUtils.isBlank(credentials)) throw new AuthenticationServiceException("验证码不能为空"); SmsCodeAuthenticationToken authenticationToken = new SmsCodeAuthenticationToken(loginName, credentials); //将输入的信息封装成一个SmsCodeAuthenicationToken对象，并向后传递 setDetails(httpServletRequest, authenticationToken); return authenticationManager.authenticate(authenticationToken); } private void setDetails(HttpServletRequest request, SmsCodeAuthenticationToken authRequest) { authRequest.setDetails(authenticationDetailsSource.buildDetails(request)); } /** * @Author hmr * @Description 从request中获得参数 * @Date: 2020/4/30 12:22 * @param request * @reture: java.lang.String **/ protected String obtainParameter(HttpServletRequest request, String type){ return request.getParameter(type); } }
- 设置了Filter拦截到登陆请求之后，还需要一个具体的校验验证码是否正确的类 SmsAuthenticationProvider，该类才是具体的业务代码
package top.imuster.auth.component.login; import org.apache.commons.lang3.StringUtils; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.data.redis.core.RedisTemplate; import org.springframework.security.authentication.AuthenticationProvider; import org.springframework.security.authentication.AuthenticationServiceException; import org.springframework.security.core.Authentication; import org.springframework.security.core.AuthenticationException; import top.imuster.auth.config.SmsCodeAuthenticationToken; import top.imuster.common.core.utils.RedisUtil; /** * @ClassName: IrhAuthenticationProvider * @Description: IrhAuthenticationProvider * @author: hmr * @date: 2020/4/30 14:36 */ public class SmsAuthenticationProvider implements AuthenticationProvider { private final Logger log = LoggerFactory.getLogger(this.getClass()); @Autowired RedisTemplate redisTemplate; @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { SmsCodeAuthenticationToken authenticationToken = (SmsCodeAuthenticationToken) authentication; //先将authentication强转成SmsCodeAuthenticationToken //登录名 String loginName = authenticationToken.getPrincipal() == null?"NONE_PROVIDED":authentication.getName(); //验证码 String verify = (String)authenticationToken.getCredentials(); String redisCode = (String)redisTemplate.opsForValue().get(RedisUtil.getConsumerLoginByEmail(loginName)); //从redis中获得申请到的验证码 if(StringUtils.isEmpty(redisCode) || !verify.equalsIgnoreCase(redisCode)){ throw new AuthenticationServiceException("验证码失效或者错误"); } return authentication; } @Override public boolean supports(Class<?> aClass) { return (SmsCodeAuthenticationToken.class.isAssignableFrom(aClass)); } }
并且在一个继承了 WebSecurityConfigurerAdapter的类中将Filter和Provide声明成Bean
package top.imuster.auth.config; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.core.annotation.Order; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.authentication.ProviderManager; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.WebSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import top.imuster.auth.component.login.*; import top.imuster.auth.service.Impl.UsernameUserDetailsServiceImpl; import java.util.Arrays; @Configuration @EnableWebSecurity @Order(2147483636) class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Bean
public SmsCodeAuthenticationFilter smsCodeAuthenticationFilter(){
SmsCodeAuthenticationFilter smsCodeAuthenticationFilter = new SmsCodeAuthenticationFilter();
try {
smsCodeAuthenticationFilter.setAuthenticationManager(this.authenticationManager());
} catch (Exception e) {
e.printStackTrace();
}
smsCodeAuthenticationFilter.setAuthenticationSuccessHandler(irhAuthenticationSuccessHandler());
smsCodeAuthenticationFilter.setAuthenticationFailureHandler(irhAuthenticationFailHandler());
return smsCodeAuthenticationFilter;
}
@Bean
public SmsAuthenticationProvider smsAuthenticationProvider(){
SmsAuthenticationProvider provider = new SmsAuthenticationProvider();
// 设置userDetailsService
// 禁止隐藏用户未找到异常
return provider;
}
@Bean
@Override
public AuthenticationManager authenticationManager() throws Exception {
ProviderManager authenticationManager = new ProviderManager(Arrays.asList(smsAuthenticationProvider()));
return authenticationManager;
}
}
说明：Filter是用来拦截Request请求，并且从request请求中将指定的信息提取出来，判断一些必要信息是否存在，不对信息进行校验，校验信息合法之后将其封装到token中，向后传递给provide如；provider则
将filter中得到的信息进行校验，在provider中，主要要注意的就是需要重写 supports(Class<?> aClass) 方法，该方法的作用就是假如在系统中有多个filter，并且向后传递了多个不同的token，那么对应的token只能传递到对应的provider中，所以该方法返回到是一个boolean类型，用来给Spring Security决策是否需要进入该provider。
- 获取验证码
/** * @Author hmr * @Description 发送email验证码 * @Date: 2020/4/30 10:12 * @param email 接受code的邮箱 * @param type 1-注册 2-登录 3-忘记密码 * @reture: top.imuster.common.base.wrapper.Message<java.lang.String> **/ @ApiOperation(value = "发送email验证码",httpMethod = "GET") @Idempotent(submitTotal = 5, timeTotal = 30, timeUnit = TimeUnit.MINUTES) @GetMapping("/sendCode/{type}/{email}") public Message<String> getCode(@ApiParam("邮箱地址") @PathVariable("email") String email, @PathVariable("type") Integer type) throws Exception { if(type != 1 && type != 2 && type != 3 && type != 4){ return Message.createByError("参数异常,请刷新后重试"); } userLoginService.getCode(email, type); return Message.createBySuccess(); }
具体代码我已经开源到GitHub上，仓库地址为https://github.com/HMingR/irh，该项目中还有利用Spring security实现微信小程序登陆，用户名密码登陆等。
