Spring Security

http://localhost:8080/order/login

{

"password": "123",

"username": "admin"

}

{

"code": 200,

"msg": null,

"data": {

"authorities": [],

"details": {

"remoteAddress": "0:0:0:0:0:0:0:1",

"sessionId": null

"authenticated": false,

"principal": "admin",

"credentials": "123",

"token": "eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbiIsImV4cCI6MTYyNzA2NDc5MiwiY3JlYXRlZCI6MTYyNzAyMTU5Mjc5MCwiYXV0aG9yaXRpZXMiOlt7ImF1dGhvcml0eSI6InN5czp1c2VyOmFkZCJ9LHsiYXV0aG9yaXR5Ijoic3lzOnVzZXI6ZGVsZXRlIn0seyJhdXRob3JpdHkiOiJzeXM6dXNlcjplZGl0In0seyJhdXRob3JpdHkiOiJzeXM6dXNlcjp2aWV3In1dfQ.2xT0XAYzU2KGxHEC3h2YBdKY9AD145LucOWx6RaKoqUUtQkAsCXn1LY0Q3oKQ1wQeFe6aI09ruw_8clJrG0M8A",

"name": "admin"

}

anonymous() 允许匿名用户访问
permitAll() 无条件允许访问

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry permitAll() {
    return this.access("permitAll");
}

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry anonymous() {
    return this.access("anonymous");
}

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry rememberMe() {
    return this.access("rememberMe");
}

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry denyAll() {
    return this.access("denyAll");
}

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry authenticated() {
    return this.access("authenticated");
}

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry fullyAuthenticated() {
    return this.access("fullyAuthenticated");
}


@Override
protected void configure(HttpSecurity http) throws Exception {
    // 禁用 csrf, 由于使用的是JWT，我们这里不需要csrf
    http.cors().and().csrf().disable()
      .authorizeRequests()
      // 跨域预检请求
        .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
        // 登录URL
        .antMatchers("/login").permitAll()
        // swagger
        .antMatchers("/swagger-ui.html").permitAll()
        .antMatchers("/swagger-resources").permitAll()
        .antMatchers("/v2/api-docs").permitAll()
        .antMatchers("/webjars/springfox-swagger-ui/**").permitAll()
        // 其他所有请求需要身份认证
        .anyRequest().authenticated();
    // 退出登录处理器
    http.logout().logoutSuccessHandler(new HttpStatusReturningLogoutSuccessHandler());
    // 开启登录认证流程过滤器，如果使用LoginController的login接口, 需要注释掉此过滤器，根据使用习惯二选一即可
    http.addFilterBefore(new JwtLoginFilter(authenticationManager()), UsernamePasswordAuthenticationFilter.class);
    // 访问控制时登录状态检查过滤器
    http.addFilterBefore(new JwtAuthenticationFilter(authenticationManager()), UsernamePasswordAuthenticationFilter.class);
}


拿到正确Token

/**
 * 启动登录认证流程过滤器
 * @author Louis
 * @date Nov 28, 2018
 */
public class JwtLoginFilter extends UsernamePasswordAuthenticationFilter


第一步

第二步

第三步

第四步

/**
 * 根据请求令牌获取登录认证信息
 * @param token 令牌
 * @return 用户名
 */
public static Authentication getAuthenticationeFromToken(HttpServletRequest request) {
   Authentication authentication = null;
   // 获取请求携带的令牌
   String token = JwtTokenUtils.getToken(request);
   if(token != null) {
      // 请求令牌不能为空
      if(SecurityUtils.getAuthentication() == null) {
         // 上下文中Authentication为空
         Claims claims = getClaimsFromToken(token);
         if(claims == null) {
            return null;
         }
         String username = claims.getSubject();
         if(username == null) {
            return null;
         }
         if(isTokenExpired(token)) {
            return null;
         }
         Object authors = claims.get(AUTHORITIES);
         List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
         if (authors != null && authors instanceof List) {
            for (Object object : (List) authors) {
               authorities.add(new GrantedAuthorityImpl((String) ((Map) object).get("authority")));
            }
         }
         authentication = new JwtAuthenticatioToken(username, null, authorities, token);
      } else {
         if(validateToken(token, SecurityUtils.getUsername())) {
            // 如果上下文中Authentication非空，且请求令牌合法，直接返回当前登录认证信息
            authentication = SecurityUtils.getAuthentication();
         }
      }
   }
   return authentication;
}