Spring Security 访问控制 源码解析
上篇 Spring Security 登录校验 源码解析 分析了使用Spring Security时用户登录时验证并返回token过程，本篇分析下用户带token访问时，如何验证用户登录状态及权限问题
用户访问控制相对简单，本质同登录验证一样，均采用过滤器拦截请求进行验证
这里需要自定义过滤器JwtAuthenticationTokenFilter并自定义路径匹配器RequestMatcher ，JwtAuthenticationTokenFilter继承AbstractAuthenticationProcessingFilter，并实现attemptAuthentication、successfulAuthentication、unsuccessfulAuthentication方法
1 AbstractAuthenticationProcessingFilter
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest)req; HttpServletResponse response = (HttpServletResponse)res; //判断访问是否需要过滤 if(!this.requiresAuthentication(request, response)) { chain.doFilter(request, response); } else { if(this.logger.isDebugEnabled()) { this.logger.debug("Request is to process authentication"); } Authentication authResult; //调用子类JwtAuthenticationTokenFilter实现 try { authResult = this.attemptAuthentication(request, response); if(authResult == null) { return; } //session控制策略，因为用jwt，故不进行深入分析 this.sessionStrategy.onAuthentication(authResult, request, response); } catch (InternalAuthenticationServiceException var8) { this.logger.error("An internal error occurred while trying to authenticate the user.", var8); //验证失败，调用子类unsuccessfulAuthentication方法 this.unsuccessfulAuthentication(request, response, var8); return; } catch (AuthenticationException var9) { //验证失败，调用子类unsuccessfulAuthentication方法 this.unsuccessfulAuthentication(request, response, var9); return; } if(this.continueChainBeforeSuccessfulAuthentication) { chain.doFilter(request, response); } //验证成功，调用子类successfulAuthentication方法 this.successfulAuthentication(request, response, chain, authResult); } }
2 JwtAuthenticationTokenFilter
@Component public class JwtAuthenticationTokenFilter extends AbstractAuthenticationProcessingFilter { @Autowired private UserDetailsService userDetailsService; @Autowired private JwtTokenUtil jwtTokenUtil; @Autowired private ObjectMapper mapper; @Value("${jwt.header}") private String tokenHeader; @Value("${jwt.tokenHead}") private String tokenHead; @Value("${jwt.appExpiration}") private Long appExpiration; @Value("${jwt.pcExpiration}") private Long pcExpiration; public JwtAuthenticationTokenFilter(RequestMatcher requiresAuthenticationRequestMatcher) { super(requiresAuthenticationRequestMatcher); setAuthenticationManager(authentication -> authentication); } @Override public Authentication attemptAuthentication(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws AuthenticationException, IOException, ServletException { //获得header String authHeader = httpServletRequest.getHeader(this.tokenHeader); throwException(authHeader == null, new TokenVerifyException(RESPONSE_CODE.BACK_CODE_UNAUTHORIZED, "令牌缺失")); throwException(!authHeader.startsWith(this.tokenHead), new TokenVerifyException(RESPONSE_CODE.BACK_CODE_UNAUTHORIZED, "令牌格式不正确")); String authToken = authHeader.substring(this.tokenHead.length()); UserDetails userDetails; try { Claims claims = jwtTokenUtil.getClaimsFromToken(authToken); throwException(claims.getSubject() == null, new TokenVerifyException(RESPONSE_CODE.BACK_CODE_UNAUTHORIZED, "令牌格式不正确")); // 校验密码是否已修改 userDetails = this.verifyPasswordChanged(claims.getSubject(), claims.getIssuedAt()); } catch (ExpiredJwtException ex) { this.refreshToken(httpServletResponse, authToken); throw new TokenParseException(RESPONSE_CODE.BACK_CODE_ACCESS_KEY_NOT_EFFECT, "令牌已过期"); } catch (UnsupportedJwtException ex) { throw new TokenParseException(RESPONSE_CODE.BACK_CODE_UNAUTHORIZED, "令牌错误"); } catch (MalformedJwtException ex) { throw new TokenParseException(RESPONSE_CODE.BACK_CODE_UNAUTHORIZED, "令牌格式不正确"); } catch (SignatureException ex) { throw new TokenParseException(RESPONSE_CODE.BACK_CODE_UNAUTHORIZED, "签名错误"); } Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); if (authentication == null) { authentication = new UsernamePasswordAuthenticationToken( userDetails, null, userDetails.getAuthorities()); ((UsernamePasswordAuthenticationToken) authentication).setDetails( new WebAuthenticationDetailsSource().buildDetails(httpServletRequest)); } return this.getAuthenticationManager().authenticate(authentication); } private void refreshToken(HttpServletResponse response, String oldToken) { try { Claims claims = jwtTokenUtil.getClaimsAllowedClockSkew(oldToken, Integer.MAX_VALUE); String username = claims.getSubject(); this.verifyPasswordChanged(username, claims.getIssuedAt()); String newToken; if (JwtUser.LOGIN_WAY_APP.equals(claims.getAudience())) { newToken = jwtTokenUtil.refreshToken(oldToken, appExpiration); } else if (JwtUser.LOGIN_WAY_PC.equals(claims.getAudience())) { newToken = jwtTokenUtil.refreshToken(oldToken, pcExpiration); } else { throw new TokenParseException(RESPONSE_CODE.BACK_CODE_UNAUTHORIZED, "未识别的客户端"); } response.addHeader(this.tokenHeader, this.tokenHead + newToken); } catch (ExpiredJwtException ex) { throw new TokenParseException(RESPONSE_CODE.BACK_CODE_RELOGIN, "登录已过期"); } catch (UnsupportedJwtException ex) { throw new TokenParseException(RESPONSE_CODE.BACK_CODE_UNAUTHORIZED, "令牌错误"); } catch (MalformedJwtException ex) { throw new TokenParseException(RESPONSE_CODE.BACK_CODE_UNAUTHORIZED, "令牌格式不正确"); } catch (SignatureException ex) { throw new TokenParseException(RESPONSE_CODE.BACK_CODE_UNAUTHORIZED, "签名错误"); } } //验证密码是否变更 private UserDetails verifyPasswordChanged(String username, Date tokenCreateTime) { JwtUser user = (JwtUser) userDetailsService.loadUserByUsername(username); if (jwtTokenUtil.isCreatedBeforeLastPasswordReset(tokenCreateTime, user.getLastPasswordResetDate())) { throw new TokenVerifyException(RESPONSE_CODE.BACK_CODE_RELOGIN, "密码变更,需重新登录"); } return user; } private void throwException(boolean expression, AuthenticationException ex) { if (expression) { throw ex; } } //认证结果放入缓存 @Override protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException { SecurityContextHolder.getContext().setAuthentication(authResult); chain.doFilter(request, response); } //认证失败，封装返回信息 @Override protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws IOException, ServletException { BackResult<String> result = new BackResult<>(); result.setCode(RESPONSE_CODE.BACK_CODE_EXCEPTION.value); if (failed instanceof TokenVerifyException) { TokenVerifyException ex = (TokenVerifyException) failed; result.setCode(ex.getResponseCode().value); result.setExceptions(ex.getMessage()); } else if (failed instanceof TokenParseException) { TokenParseException ex = (TokenParseException) failed; result.setCode(ex.getResponseCode().value); result.setExceptions(ex.getMessage()); } else { logger.error("Token校验异常", failed); result.setExceptions(SystemConstant.HIDE_ERROR_TIP); } response.setContentType(MediaType.APPLICATION_JSON_VALUE); response.setCharacterEncoding("UTF-8"); mapper.writeValue(response.getWriter(), result); } }
3 SkipPathRequestMatcher
public class SkipPathRequestMatcher implements RequestMatcher { private OrRequestMatcher matchers; private RequestMatcher processingMatcher; public SkipPathRequestMatcher(@NotEmpty List<String> pathsToSkip, String processingPath) { List<RequestMatcher> m = pathsToSkip.stream().map(AntPathRequestMatcher::new).collect(Collectors.toList()); matchers = new OrRequestMatcher(m); processingMatcher = new AntPathRequestMatcher(processingPath); } @Override public boolean matches(HttpServletRequest request) { return !matchers.matches(request) && processingMatcher.matches(request); } } WebSecurityConfig 类中定义SkipPathRequestMatcher public static final String TOKEN_BASED_ENTRY_POINT = "/limit/**"; public static final String TOKEN_AUTH_ENTRY_POINT = "/auth/**"; public static final String TOKEN_LOGIN_ENTRY_POINT = "/login/**"; public static final String TOKEN_OPEN_ENTRY_POINT = "/open/**"; //路径匹配器，跳过/auth/**类请求，验证/limit/**类请求 @Bean public SkipPathRequestMatcher skipPathRequestMatcher() { List<String> pathsToSkip = Collections.singletonList(TOKEN_AUTH_ENTRY_POINT); return new SkipPathRequestMatcher(pathsToSkip, TOKEN_BASED_ENTRY_POINT); } //JwtAuthenticationTokenFilter设置路径匹配器 @Bean public JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter() { return new JwtAuthenticationTokenFilter(skipPathRequestMatcher()); }
