> 虚幻大学 > 手撸一个springsecurity，了解一下security原理

手撸一个springsecurity，了解一下security原理

虚幻大学 xuhss 474℃ 0评论
文章目录 显示

Python微信订餐小程序课程视频

https://edu.csdn.net/course/detail/36074

Python实战量化交易理财系统

https://edu.csdn.net/course/detail/35475

手撸一个springsecurity，了解一下security原理

转载自：www.javaman.cn 手撸一个springsecurity，了解一下security原理

今天手撸一个简易版本的springsecurity，带大家理解下springsecurity的原理：

安全框架的两个特点就是认证和授权，让我们来通过代码了解下认证和授权的处理方式：

1、认证

认证就是指需要登录才能进行系统操作，如：登录qq、微信或者是web系统的登录都是认证的过程

1.1 工程目录

watermark,type d3F5LXplbmhlaQ,shadow 50,text Q1NETiBAa2V0dGxl5pWZ56iL5a2m5Lmg,size 12,color FFFFFF,t 70,g se,x 16#pic center - 手撸一个springsecurity，了解一下security原理

1.2 maven配置pom.xml

xml version="1.0" encoding="UTF-8"?
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0modelVersion>
    <parent>
        <groupId>org.springframework.bootgroupId>
        <artifactId>spring-boot-starter-parentartifactId>
        <version>2.6.3version>
        <relativePath/> 
    parent>
    <groupId>com.dashigroupId>
    <artifactId>securityartifactId>
    <version>0.0.1-SNAPSHOTversion>
    <name>securityname>
    <description>Demo project for Spring Bootdescription>
    <properties>
        <java.version>1.8java.version>
    properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.bootgroupId>
            <artifactId>spring-boot-starterartifactId>
        dependency>
        <dependency>
            <groupId>org.springframework.bootgroupId>
            <artifactId>spring-boot-starter-webartifactId>
        dependency>
        <dependency>
            <groupId>org.springframework.bootgroupId>
            <artifactId>spring-boot-starter-thymeleafartifactId>
        dependency>
        <dependency>
            <groupId>org.projectlombokgroupId>
            <artifactId>lombokartifactId>
            <optional>trueoptional>
        dependency>
        <dependency>
            <groupId>org.springframework.bootgroupId>
            <artifactId>spring-boot-starter-testartifactId>
            <scope>testscope>
        dependency>
    dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.bootgroupId>
                <artifactId>spring-boot-maven-pluginartifactId>
                <configuration>
                    <excludes>
                        <exclude>
                            <groupId>org.projectlombokgroupId>
                            <artifactId>lombokartifactId>
                        exclude>
                    excludes>
                configuration>
            plugin>
        plugins>
    build>

project>

1.3 application.yml

spring:
  mvc:
    view:
      prefix: /
      suffix: .html

1.4 创建User，模拟springsecurity的用户信息的核心接口UserDetails

import lombok.AllArgsConstructor;
import lombok.Data;

@Data
@AllArgsConstructor
public class User {
    private Integer id;
    private String username;
    private String password;
}

1.5 创建AuthenticationService，模拟springsecurity的UserDetailsService核心接口

public interface AuthenticationService {
    public User authentication(AuthenticationRequest authenticationRequest);
}

1.6 实现AuthenticationService，模拟实现UserDetailsService的过程

@Service
public class AuthenticationServiceImpl implements AuthenticationService {
    private Map users = new HashMap();
 @Override
 public User authentication(AuthenticationRequest authenticationRequest) {
 if(authenticationRequest == null||"".equals(authenticationRequest.getUsername())||"".equals(authenticationRequest.getPassword())){
 throw new RuntimeException("用户名或密码为空");
 }
 User user = users.get(authenticationRequest.getUsername());
 if(user == null){
 throw new RuntimeException("用户不存在");
 }
 if(!user.getPassword().equals(authenticationRequest.getPassword())){
 throw new RuntimeException("密码不正确");
 }
 return user; //模拟实现UserDetailS的User
 }

 public User getUser(String username){
 return users.get(username);
 }
 //创建两个账户，模拟管理员和普通的来宾用户
 {
 users.put("admin",new User(1,"admin","123")); //管理员
 users.put("guest",new User(2,"guest","111")); //来宾账户
 }
}

1.7 接收请求参数封装对象

@Data
public class AuthenticationRequest {
    private String username;
    private String password;
}

1.8 登录Controller，对/login请求处理，它调用AuthenticationService完成认证并返回登录结果提示信息

@Controller
public class LoginController {

    @Autowired
    private AuthenticationService authenticationService;

    @GetMapping("/login")
    public String login(){
        return "login";
    }

    @PostMapping(value = "/login",produces = {"text/plain;charset=UTF-8"})
    public String login(AuthenticationRequest authenticationRequest, Model model){
        System.out.println("111"+authenticationRequest);
        User user = authenticationService.authentication(authenticationRequest);
        String loginMsg = user.getUsername()+"登录成功";
        System.out.println(loginMsg);
        model.addAttribute("loginMsg",loginMsg);
        return "loginsuccess";
    }
}

1.9 认证页面

HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
        "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
    <title>登录title>
head>
<body>
<form action="/login" method="post">
    用户名：<input type="text" name="username"><br>
    密码：<input type="password" name="password"><br>
    <input type="submit" value="登录1">
form>
body>
html>

HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
        "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head>
    <title>Titletitle>
head>
<body>
    <h1 th:text="${loginMsg}">h1>
body>
html>

1.10 认证成功后打印登录成功
1）登录界面如下
watermark,type d3F5LXplbmhlaQ,shadow 50,text Q1NETiBAa2V0dGxl5pWZ56iL5a2m5Lmg,size 14,color FFFFFF,t 70,g se,x 16#pic center - 手撸一个springsecurity，了解一下security原理

2）密码错误界面
watermark,type d3F5LXplbmhlaQ,shadow 50,text Q1NETiBAa2V0dGxl5pWZ56iL5a2m5Lmg,size 20,color FFFFFF,t 70,g se,x 16#pic center - 手撸一个springsecurity，了解一下security原理

3）登录成功界面
4d5df71c9f9b498eba454eec6e7ee15f - 手撸一个springsecurity，了解一下security原理

2、授权

授权就是控制什么样的用户或者角色访问什么功能，例如：管理员可以访问全部功能，guest普通用户只能访问某一个菜单或者功能

2.1 User增加权限authorities和session

package com.dashi.security.model;

import lombok.AllArgsConstructor;
import lombok.Data;

import java.util.Set;

@Data
@AllArgsConstructor
public class User {
    private Integer id;
    private String username;
    private String password;
    //登录用户,增加登录用户session
    public static final String LOGIN\_USER = "user";
    /**
 * 用户权限
 */
    private Set authorities;
}

2.2 用户增加角色authorities

import com.dashi.security.model.AuthenticationRequest;
import com.dashi.security.model.User;
import com.dashi.security.service.AuthenticationService;
import org.springframework.stereotype.Service;
import org.springframework.util.StringUtils;

import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;

@Service
public class AuthenticationServiceImpl implements AuthenticationService {
    private Map users = new HashMap();
 @Override
 public User authentication(AuthenticationRequest authenticationRequest) {
 if(authenticationRequest == null||"".equals(authenticationRequest.getUsername())||"".equals(authenticationRequest.getPassword())){
 throw new RuntimeException("用户名或密码为空");
 }
 User user = users.get(authenticationRequest.getUsername());
 if(user == null){
 throw new RuntimeException("用户不存在");
 }
 if(!user.getPassword().equals(authenticationRequest.getPassword())){
 throw new RuntimeException("密码不正确");
 }
 return user;
 }

 public User getUser(String username){
 return users.get(username);
 }

 {
 //增加管理员权限
 Set authorities1 = new HashSet<>();
 authorities1.add("admin");
 //增加来宾权限
 Set authorities2 = new HashSet<>();
 authorities2.add("guest");
 users.put("admin",new User(1,"admin","123",authorities1));
 users.put("guest",new User(2,"guest","111",authorities2));
 }
}

2.3登录成功后，将用户放到session中

import com.dashi.security.model.AuthenticationRequest;
import com.dashi.security.model.User;
import com.dashi.security.service.AuthenticationService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.ModelAttribute;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.servlet.ModelAndView;

import javax.servlet.http.HttpSession;

@Controller
public class LoginController {

    @Autowired
    private AuthenticationService authenticationService;

    @GetMapping("/login")
    public String login(){
        return "login";
    }

    @PostMapping(value = "/login",produces = {"text/plain;charset=UTF-8"})
    public String login(AuthenticationRequest authenticationRequest, Model model, HttpSession session){
        System.out.println("111"+authenticationRequest);
        User user = authenticationService.authentication(authenticationRequest);
        session.setAttribute(User.LOGIN_USER,user);
        String loginMsg = user.getUsername()+"登录成功";
        System.out.println(loginMsg);
        model.addAttribute("loginMsg",loginMsg);
        return "loginsuccess";
    }
}

2.4 增加Springboot拦截器配置，判断是admin用户，可以访问所有资源resource1和resource2，如果是guest用户只允许访问resource2资源

import com.dashi.security.model.User;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;

@Component
public class MyAuthenInterceptor implements HandlerInterceptor {
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        Object object = request.getSession().getAttribute(User.LOGIN_USER);
        System.out.println("object = " + object);
        if(object == null){
            writeContent(response,"请登录");
        }
        //获取请求的url
        String requestURI = request.getRequestURI();
        User user = (User)object;
        if(user.getAuthorities().contains("admin") && requestURI.contains("/resource1") || requestURI.contains("/resource2")){
            writeContent(response,user.getUsername()+"访问："+requestURI+"访问成功!");
            return true;
        }
        if(user.getAuthorities().contains("guest") && requestURI.contains("/resource2")){
            writeContent(response,user.getUsername()+"访问："+requestURI+"访问成功!");
            return true;
        }
        writeContent(response,"权限不足!");
        return false;
    }

    private void writeContent(HttpServletResponse response,String msg) throws IOException {
        response.setContentType("text/html;charset=utf-8");
        PrintWriter printWriter = response.getWriter();
        printWriter.write(msg);
        printWriter.close();
        response.resetBuffer();
    }
}

2.5 拦截器进行请求拦截，拦截/resource/**请求

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class LoginConfig implements WebMvcConfigurer {
    @Autowired
    private MyAuthenInterceptor myAuthenInterceptor;

    public void addInterceptors(InterceptorRegistry registry){
        registry.addInterceptor(myAuthenInterceptor).addPathPatterns("/resource/**");
    }
}

2.6 授权测试界面如下：

1）登录成功后设置resource1和resource2访问功能
watermark,type d3F5LXplbmhlaQ,shadow 50,text Q1NETiBAa2V0dGxl5pWZ56iL5a2m5Lmg,size 12,color FFFFFF,t 70,g se,x 16#pic center - 手撸一个springsecurity，了解一下security原理

2）admin用户访问资源1和资源2
fba8cb415306478cbb12a20acc3c661e - 手撸一个springsecurity，了解一下security原理
6c4abf16327d47baa518367af3d89050 - 手撸一个springsecurity，了解一下security原理
3）guest用户只能访问资源2，不能访问资源1
53e4c18f2b8241bbbef167047bb286bb - 手撸一个springsecurity，了解一下security原理
e6c755cce46b4daeb2c57c05cfae93ba - 手撸一个springsecurity，了解一下security原理

2.7 实现了springsecurity的认证和授权

1、 认证功能：
loginPage("/login.html")即为认证
2、 授权功能：
.antMatchers("/resource/resource1").hasAuthority(“admin”)
.antMatchers("/resource/resource2").hasAuthority(“admin”)
.antMatchers("/resource/resource2").hasAuthority(“guest”)

  @Override
    protected void configure(HttpSecurity http) throws Exception {
            //以下五步是表单登录进行身份认证最简单的登录环境
            http.formLogin() //表单登陆
                .loginPage("/login.html") //指定登陆页面
                .loginProcessingUrl("/authentication/form")//登陆页面提交的页面 开始使用UsernamePasswordAuthenticationFilter过滤器处理请求
                .and() //
                .authorizeRequests() //下面的都是授权的配置 
                .antMatchers("/resource/resource1").hasAuthority("admin")                                 
                .antMatchers("/resource/resource2").hasAuthority("admin") .antMatchers("/resource/resource2").hasAuthority("guest")    
                .and()
                .csrf().disable();//关闭跨站请求伪造攻击拦截

转载请注明：xuhss » 手撸一个springsecurity，了解一下security原理

喜欢 (0)

您必须 登录 才能发表评论！