security学习案例总结

前言

• 参考

博客一

# pom.xml
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
    </dependencies>
 
# yml
server:
  port: 8080
 
# 配置类配置用户名和密码
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("test").password(passwordEncoder().encode("123456"))
                .authorities("admin");
    }
}

• 测试

# 浏览器访问 http://localhost:8080/hello
# 输入用户名和密码test:123456

博客二

• 参考
• 新建项目demo02，在demo01的基础上开发

# 在WebSecurityConfig配置类中添加如下：
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // 1、表单操作 表单请求成功处理器、失败处理器;与loginPage冲突，配置后，loginPage不生效
        FormLoginConfigurer<HttpSecurity> formLogin = http.formLogin();
        formLogin.loginPage(null);// 自定义登录页的路由（静态页面，或者mvc视图式的页面地址）
        formLogin.loginProcessingUrl(null);// 登录接口的路由地址：必须为post请求的接口地址
        formLogin.isCustomLoginPage();// 是否为自定义登录页，true为自定义的登录页；
        formLogin.passwordParameter(null);// 登录的表单的 密码的字段名称
        formLogin.usernameParameter(null);// 登录的表单的 用户名的字段名称
 
        formLogin.successForwardUrl(null);// 登录成功跳转的url
        formLogin.successHandler(null);// 登录成功的拦截器
        formLogin.defaultSuccessUrl(null);// 默认的成功的url
 
        formLogin.failureForwardUrl(null);// 失败跳转的url
        formLogin.failureHandler(null);// 失败的拦截器
        formLogin.failureUrl(null);// 失败的url
 
        formLogin.permitAll();// 放开不拦截，默认为true
        formLogin.permitAll(false);
 
        formLogin.disable();// 关闭表单的登录(其实只是拦截器链路上的一个拦截器)
 
        formLogin.init(http);// 初始化方法
        formLogin.authenticationDetailsSource(null);
        formLogin.addObjectPostProcessor(null);
        formLogin.withObjectPostProcessor(null);
        HttpSecurity and = formLogin.and();
        formLogin.setBuilder(and);
        formLogin.configure(http);
 
        http.addFilter(null);
        http.addFilterAfter(null, null);
        http.addFilterAt(null, null);
 
        AnonymousConfigurer<HttpSecurity> anonymous = http.anonymous();
        http.anonymous(null);
 
        http.cors();
        http.cors(null);
        http.csrf();
        http.csrf(null);
 
        http.headers();
        http.headers(null);
        http.httpBasic();
        http.httpBasic(null);
 
        http.logout().addLogoutHandler(null);
        http.logout(null);
 
        http.oauth2Client();
        http.oauth2Client(null);
        http.oauth2Login();
        http.oauth2Login(null);
        http.oauth2ResourceServer();
        http.oauth2ResourceServer(null);
 
        http.rememberMe();
        http.rememberMe(null);
 
        http.sessionManagement();
        http.sessionManagement(null);
 
        http.exceptionHandling();
        http.exceptionHandling(null);
        http.userDetailsService(null);
        http.authenticationProvider(null);
 
        http.antMatcher(null);
 
        http.apply(null);
 
        http.authorizeRequests().antMatchers("/**/*.js", "/**/*.css").permitAll().anyRequest().hasRole("admin");
        http.authorizeRequests();
        http.authorizeRequests(null);
 
        http.build();
    }

• 表单登录选项: 表单请求成功处理器、失败处理器;与loginPage冲突，配置后，loginPage不生效

        formLogin.loginPage(null);//自定义登录页的路由（静态页面，或者mvc视图式的页面地址）
        formLogin.loginProcessingUrl(null);//登录接口的路由地址：必须为post请求的接口地址
        formLogin.isCustomLoginPage();// 是否为自定义登录页，true为自定义的登录页；
        formLogin.passwordParameter(null);// 登录的表单的 密码的字段名称
        formLogin.usernameParameter(null);//登录的表单的 用户名的字段名称
 
        formLogin.successForwardUrl(null);// 登录成功跳转的url
        formLogin.successHandler(null);// 登录成功的拦截器
        formLogin.defaultSuccessUrl(null);// 默认的成功的url
 
        formLogin.failureForwardUrl(null);// 失败跳转的url
        formLogin.failureHandler(null);// 失败的拦截器
        formLogin.failureUrl(null);// 失败的url
 
        formLogin.permitAll();// 放开不拦截，默认为true
        formLogin.permitAll(false);
		formLogin.disable();// 关闭表单的登录(其实只是拦截器链路上的一个拦截器)
	    //其他配置项
		formLogin.init(http);// 初始化方法
        formLogin.authenticationDetailsSource(null);
        formLogin.addObjectPostProcessor(null);
        formLogin.withObjectPostProcessor(null);
        HttpSecurity and = formLogin.and();
        formLogin.setBuilder(and);
        formLogin.configure(http);
 

• 过滤器

        http.addFilter(null);// 增加一个拦截器
        http.addFilterAfter(null, null);//增加一个拦截器 在xxx拦截器之后
        http.addFilterAt(null, null);//增加一个拦截器 在xxx拦截器之前

• 其他

# 匿名用户
        http.anonymous();
# 跨域
        http.cors();
        http.cors(null);
# csrf
        http.csrf();
        http.csrf(null);
# httpbasic，前后端分离时关闭
        http.httpBasic();
        http.httpBasic(null);
# 登出
        http.logout();
        http.logout(null);
        http.logout().addLogoutHandler(null);//配置登出处理器
        http.logout().disable();// 关闭登出操作；等jwt超时
# 记住我
        http.rememberMe();
        http.rememberMe(null);
# session会话管理
       http.sessionManagement();
       http.sessionManagement(null);
       http.sessionManagement().disable();// 关闭session 管理器
# 认证处理器
       http.userDetailsService(null);//帐号密码认证
       http.authenticationProvider(null);//认证处理
# 鉴权管理
       http.authorizeRequests();
       http.authorizeRequests(null);
# 异常处理
       http.exceptionHandling();
       http.exceptionHandling(null);

• oauth2

       http.oauth2Client();
       http.oauth2Client(null);
       http.oauth2Login();
       http.oauth2Login(null);
       http.oauth2ResourceServer();
       http.oauth2ResourceServer(null);

• 启动报错

Error starting ApplicationContext. To display the conditions report re-run your application with 'debug' enabled.
2022-04-05 19:46:28.199 ERROR 22748 --- [           main] o.s.boot.SpringApplication               : Application run failed
 
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'springSecurityFilterChain' defined in class path resource [org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is java.lang.IllegalArgumentException: Pattern cannot be null or empty
	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:655) ~[spring-beans-5.2.8.RELEASE.jar:5.2.8.RELEASE]

博客三

• 参考
• 启动项目报错：Error creating bean with name 'xmlModelPlugin': Lookup method resolution failed
• 解决方案：注释swagger2相关的代码
• pom.xml

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>com.alibaba</groupId>
            <artifactId>fastjson</artifactId>
            <version>1.2.78</version>
        </dependency>
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <optional>true</optional>
        </dependency>
    </dependencies>

• 返回数据工具类

@Data
public class Result {
    private Integer code;
    private String message;
    private Result(Integer code, String messgae) {
        this.code = code;
        this.message = messgae;
    }
    public static Result success(String message) {
        return new Result(200, message);
    }
    public static Result result(Integer code, String messgae) {
        return new Result(code, messgae);
    }
}

• security配置类

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    // 放行的接口
    private static final String[] EXCLUDE_URLS = { "/**/*.js", "/**/*.css", "/**/*.jpg", "/**/*.png", "/**/*.gif",
            "/v2/**", "/errors", "/error", "/favicon.ico", "/swagger-ui.html/**", "/swagger-ui/**", "/webjars/**",
            "/swagger-resources/**", "/auth/login" };
    @Autowired
    private AuthenticationSuccessHandler successHandler;
    @Autowired
    private AuthenticationFailureHandler failureHandler;
    @Autowired
    AccessDeniedHandler deniedHandler;
    @Autowired
    AuthenticationEntryPoint entryPoint;
    // 加密方式
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    // 配置用户名、密码
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("test").password(passwordEncoder().encode("123456"))
                .authorities("admin");
    }
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // 全局异常配置
        http.exceptionHandling().accessDeniedHandler(deniedHandler).authenticationEntryPoint(entryPoint);
        // 放行的路由接口
        http.authorizeRequests().antMatchers(EXCLUDE_URLS).permitAll();
        // 1、表单操作
        FormLoginConfigurer<HttpSecurity> formLogin = http.formLogin();
        // 表单请求成功处理器、失败处理器;与loginPage冲突，配置后，loginPage不生效
        formLogin.successHandler(successHandler).failureHandler(failureHandler);
        // 表单提交的post请求地址,用户参数名称
        formLogin.loginProcessingUrl("/auth/login");
        // 关闭csrf防护
        http.csrf().disable();
    }
}

• 拒绝访问处理器

@Component
public class DeniedHandler implements AccessDeniedHandler {
    @SuppressWarnings("deprecation")
    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response,
            AccessDeniedException accessDeniedException) throws IOException, ServletException {
        String error = "请求Url:" + request.getRequestURI() + " 鉴权失败:" + accessDeniedException.getMessage();
        response.setContentType(MediaType.APPLICATION_JSON_UTF8_VALUE);
        PrintWriter writer = response.getWriter();
        writer.print(JSON.toJSONString(Result.result(HttpStatus.UNAUTHORIZED.value(), error)));
        writer.flush();
        writer.close();
    }
}

• 未认证处理器

@Component
public class EntryPoint implements AuthenticationEntryPoint {
    @SuppressWarnings("deprecation")
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response,
            AuthenticationException authException) throws IOException, ServletException {
        String error = "请求Url:" + request.getRequestURI() + " 认证失败:" + authException.getMessage();
        response.setContentType(MediaType.APPLICATION_JSON_UTF8_VALUE);
        PrintWriter writer = response.getWriter();
        writer.print(JSON.toJSONString(Result.result(HttpStatus.UNAUTHORIZED.value(), error)));
        writer.flush();
        writer.close();
    }
}

• 认证成功处理器

@Component
@Slf4j
public class SuccessHandler implements AuthenticationSuccessHandler {
    @SuppressWarnings("deprecation")
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
            Authentication authentication) throws IOException, ServletException {
        response.setContentType(MediaType.APPLICATION_JSON_UTF8_VALUE);
        log.info("登录成功:{}", authentication.getPrincipal());
        PrintWriter writer = response.getWriter();
        writer.print(JSON.toJSONString(Result.success(authentication.getPrincipal().toString())));
        writer.flush();
        writer.close();
    }
}

• 认证失败处理器

@Component
public class FailureHandler implements AuthenticationFailureHandler {
    private Logger log = LoggerFactory.getLogger(getClass());
    @SuppressWarnings("deprecation")
    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
            AuthenticationException exception) throws IOException, ServletException {
        log.info("登录失败,{}", exception.getMessage());
        response.setContentType(MediaType.APPLICATION_JSON_UTF8_VALUE);
        PrintWriter writer = response.getWriter();
        writer.print(JSON.toJSONString(Result.result(400, exception.getMessage())));
        writer.flush();
        writer.close();
    }
}

• 登录接口编写

@RestController
public class LoginController {
    @PostMapping("/auth/login")
    public void login(@RequestParam(name = "username", required = true) String username,
            @RequestParam(name = "password", required = true) String password) {
    }
}

• 测试
  

博客五

• 参考

• 新建demo04，在demo03的基础上开发

• 使用用户名+密码或手机号+密码或者邮箱+密码登录，但并没有构建Provider

• 认证流程
  

# 首先发送请求会进入AuthenticationFilter，由AuthenticationFilter生成一个UserNamepasswordAuthenticationToken
# 之后UserNamepasswordAuthenticationToken进入AuthenticationManager
# AuthenticationManager主要进行认证
# AuthenticationManager中有多个AuthenticationProviders
# 每个AuthenticationProviders是不同的认证机制
# 之后通过UserDetailsService查询数据库获取用户信息
# 最后按原来的流程将认证成功后的用户信息放到Authentication中

1. 向手机发送手机验证码，使用第三方短信平台 SDK 发送，如: 阿里云短信服务（阿里大于）
2. 登录表单输入短信验证码
3. 使用自定义过滤器 MobileValidateFilter 
4. 当验证码校验通过后，进入自定义手机认证过滤器 MobileAuthenticationFilter 校验手机号是否存在
5. 自定义 MobileAuthenticationToken 提供给  MobileAuthenticationFilter
6. 自定义 MobileAuthenticationProvider 提供给 ProviderManager 处理
7. 创建针对手机号查询用户信息的  MobileUserDetailsService ，交给  MobileAuthenticationProvider
8. 自定义 MobileAuthenticationConfig 配置类将上面组件连接起来，添加到容器中
9. 将 MobileAuthenticationConfig 添加到 SpringSecurityConfig 安全配置的过滤器链上

• UsernamePasswordAuthenticationProvider

@Slf4j
public class UsernamePasswordAuthenticationProvider implements AuthenticationProvider {
 
    @Getter
    @Setter
    private UserDetailsService userDetailsService;
    @Autowired
    private PasswordEncoder passwordEncoder;
 
    public UsernamePasswordAuthenticationProvider(UserDetailsService userDetailsService) {
        super();
        this.userDetailsService = userDetailsService;
    }
 
    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        // 获取表单用户名
        String username = (String) authentication.getPrincipal();
        // 获取表单用户填写的密码
        String password = (String) authentication.getCredentials();
        UserDetails userDetails;
        try {
            userDetails = userDetailsService.loadUserByUsername(username);
        } catch (Exception e) {
            // 异常不是鉴权异常的时候，异常无法向上抛出，异常处理的controller无法返回默认异常，需要把异常处理成鉴权异常
            throw new AuthenticationServiceException(e.getMessage());
        }
        if (!passwordEncoder.matches(password, userDetails.getPassword())) {
            log.info("当前登录人:{},当前登录密码:{}", username, password);
            throw new BadCredentialsException("用户密码不正确");
        }
        return new UsernamePasswordAuthenticationToken(username, null, userDetails.getAuthorities());
    }
 
    @Override
    public boolean supports(Class<?> authentication) {
        // 帐号密码登录使用的校验器
        return UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication);
    }
}

• SecurityConfig

@Configuration
public class SecurityConfig {
 
    static final List<UserEntity> USER_LIST = new ArrayList<>();
 
    static {
        for (int i = 1; i < 6; i++) {
            UserEntity userEntity = new UserEntity();
            userEntity.setId(i);
            userEntity.setName("测试人员" + i);
            userEntity.setUsername("ceshi_" + i);
            // 密码使用 PasswordEncoder 类对123456 加密之后的结果
            userEntity.setPassword("$2a$10$D1q09WtH./yTfFTh35n0k.o6yZIXwxIW1/ex6/EjYTF7EiNxXyF7m");
            userEntity.setEmail("100" + i + "@qq.com");
            userEntity.setPhone("186xxxx351" + i);
            USER_LIST.add(userEntity);
        }
    }
 
    /************************帐号密码登录**********************/
    @Bean
    public UserDetailsService usernamePasswordUserDetails() {
        return new UserDetailsService() {
            @Override
            public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
                UserEntity user = null;
                for (UserEntity userEntity : USER_LIST) {
                    if (username.equals(userEntity.getUsername()) || username.equals(userEntity.getPhone())
                            || username.equals(userEntity.getEmail())) {
                        user = userEntity;
                    }
                }
                if (user != null) {
                    return new SystemUserDetails(user.getUsername(), user.getPassword(), user, null);
                }
                throw new UsernameNotFoundException("用户未注册，请先注册");
            }
        };
    }
 
    @Bean
    public AuthenticationProvider usernamePasswordAuthenticationProvider() {
        return new UsernamePasswordAuthenticationProvider(usernamePasswordUserDetails());
    }
    
}

• 启动项目后，curl测试通过

curl -X POST "http://localhost:8080/auth/login?username=ceshi_1&password=123456" -H "accept: */*"
curl -X POST "http://localhost:8080/auth/login?username=1001@qq.com&password=123456" -H "accept: */*"
curl -X POST "http://localhost:8080/auth/login?username=186xxxx3511&password=123456" -H "accept: */*"

博客六

• 参考