Spring Security构建Rest服务-0702-短信验证码登录

先来看下 Spring Security密码登录大概流程，模拟这个流程，开发短信登录流程

1，密码登录请求发送给过滤器 UsernamePasswordAuthenticationFilter 

2，过滤器拿出用户名密码组装成 UsernamePasswordAuthenticationToken 对象传给AuthenticationManager

3，AuthenticationManager 会从一堆 AuthenticationProvider 里选出一个Provider 处理认证请求。挑选的依据是AuthenticationProvider 里有个

boolean supports(Class<?> authentication);方法，判断当前的provider是否支持传进的token，如果支持就用这个provider认证这个token，并调用authenticate() 方法 进行认证

4，认证过程会调用UserDetailsService获取用户信息，跟传进来的登录信息做比对。认证通过会把UsernamePasswordAuthenticationToken做一个标识   标记已认证，放进session。

做短信登录，不能在这个流程上改，这是两种不同的登录方式，混在一起代码质量不好，需要仿照这个流程写一套自己的流程：

SmsAuthenticationFilter：拦截短信登录请求，从请求中获取手机号，封装成 SmsAuthenticationToken 也会传给AuthenticationManager，AuthenticationManager会找适合的provider，自定义SmsAuthenticationProvider校验SmsAuthenticationToken 里手机号信息。也会调UserDetailsService 看是否能登录，能的话标记为已登录。

其中SmsAuthenticationFilter 参考UsernamePasswordAuthenticationFilter写，SmsCodeAuthenticationToken参考UsernamePasswordAuthenticationToken写，其实就是就是复制粘贴改改

从上图可知，需要写三个类：

1，SmsAuthenticationToken：复制UsernamePasswordAuthenticationToken，把没用的去掉

package com.imooc.security.core.authentication.mobile;

import java.util.Collection;

import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.SpringSecurityCoreVersion;

/**
 * 模仿UsernamePasswordAuthenticationToken写的短信登录token
 * ClassName: SmsCodeAuthenticationToken 
 * @Description: TODO
 * @author lihaoyang
 * @date 2018年3月7日
 */
public class SmsCodeAuthenticationToken extends AbstractAuthenticationToken {

    private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;


    //没登陆，放手机号，登录成功，放用户信息
    private final Object principal;



    /**
     * 没登录放手机号
     * <p>Description: </p>
     * @param mobile
     */
    public SmsCodeAuthenticationToken(String mobile) {
        super(null);
        this.principal = mobile;//没登录放手机号
        setAuthenticated(false);//没登录
    }

    
    public SmsCodeAuthenticationToken(Object principal, Object credentials,
            Collection<? extends GrantedAuthority> authorities) {
        super(authorities);
        this.principal = principal;
        super.setAuthenticated(true); // must use super, as we override
    }

    // ~ Methods
    // ========================================================================================================

    
    public Object getPrincipal() {
        return this.principal;
    }

    public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
        if (isAuthenticated) {
            throw new IllegalArgumentException(
                    "Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
        }

        super.setAuthenticated(false);
    }

    @Override
    public void eraseCredentials() {
        super.eraseCredentials();
    }

    @Override
    public Object getCredentials() {
        return null;
    }
}

2，SmsCodeAuthenticationFilter，参考UsernamePasswordAuthenticationFilter

package com.imooc.security.core.authentication.mobile;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.util.Assert;

/**
 * 模仿UsernamePasswordAuthenticationFilter 写的短信验证码过滤器
 * ClassName: SmsCodeAuthenticationFilter 
 * @Description: TODO
 * @author lihaoyang
 * @date 2018年3月8日
 */
public class SmsCodeAuthenticationFilter extends
AbstractAuthenticationProcessingFilter{
    
    public static final String IMOOC_FORM_MOBILE_KEY = "mobile";

    private String mobilePatameter = IMOOC_FORM_MOBILE_KEY;
    private boolean postOnly = true;

    // ~ Constructors
    // ===================================================================================================

    public SmsCodeAuthenticationFilter() {
        //过滤的请求url，登录表单的url
        super(new AntPathRequestMatcher("/authentication/mobile", "POST"));
    }

    // ~ Methods
    // ========================================================================================================

    public Authentication attemptAuthentication(HttpServletRequest request,
            HttpServletResponse response) throws AuthenticationException {
        if (postOnly && !request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException(
                    "Authentication method not supported: " + request.getMethod());
        }

        String mobile = obtainMobile(request);

        if (mobile == null) {
            mobile = "";
        }


        mobile = mobile.trim();

        SmsCodeAuthenticationToken authRequest = new SmsCodeAuthenticationToken(mobile);

        // Allow subclasses to set the "details" property
        setDetails(request, authRequest);
        //在这里把SmsCodeAuthenticationToken交给AuthenticationManager
        return this.getAuthenticationManager().authenticate(authRequest);
    }

    /**
     * 获取手机号
     * @Description: TODO
     * @param @param request
     * @param @return   
     * @return String  
     * @throws
     * @author lihaoyang
     * @date 2018年3月7日
     */
    private String obtainMobile(HttpServletRequest request) {
        return request.getParameter(mobilePatameter);
    }

    protected void setDetails(HttpServletRequest request,
            SmsCodeAuthenticationToken authRequest) {
        authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
    }

    public void setPostOnly(boolean postOnly) {
        this.postOnly = postOnly;
    }

    

}

3，SmsCodeAuthenticationProvider：

 在 SmsCodeAuthenticationFilter 里 attemptAuthentication方法的最后， return this.getAuthenticationManager().authenticate(authRequest);这句话就是进到 SmsCodeAuthenticationProvider 先调用 supports() 方法，通过后，再调用 authenticate()方法进行认证

package com.imooc.security.core.authentication.mobile;

import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.InternalAuthenticationServiceException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;

/**
 * AuthenticationManager 认证时候需要用的一个Provider
 * ClassName: SmsCodeAuthenticationProvider 
 * @Description: TODO
 * @author lihaoyang
 * @date 2018年3月8日
 */
public class SmsCodeAuthenticationProvider implements AuthenticationProvider {

    private UserDetailsService userDetailsService;
    
    /**
     * 认证
     */
    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        //能进到这说明authentication是SmsCodeAuthenticationToken，转一下
        SmsCodeAuthenticationToken authenticationToken = (SmsCodeAuthenticationToken)authentication;
        //token.getPrincipal()就是手机号 mobile
        UserDetails user = userDetailsService.loadUserByUsername((String) authenticationToken.getPrincipal());
        
        //认证没通过
        if(user == null){
            throw new InternalAuthenticationServiceException("无法获取用户信息");
        }
        //认证通过
        SmsCodeAuthenticationToken authenticationResult = new SmsCodeAuthenticationToken(user, user.getAuthorities());
        //把认证之前得token里存的用户信息赋值给认证后的token对象
        authenticationResult.setDetails(authenticationToken.getDetails());
        return authenticationResult;
    }

    /**
     * 告诉AuthenticationManager，如果是SmsCodeAuthenticationToken的话用这个类处理
     */
    @Override
    public boolean supports(Class<?> authentication) {
        //判断传进来的authentication是不是SmsCodeAuthenticationToken类型的
        return SmsCodeAuthenticationToken.class.isAssignableFrom(authentication);
    }

    public UserDetailsService getUserDetailsService() {
        return userDetailsService;
    }

    public void setUserDetailsService(UserDetailsService userDetailsService) {
        this.userDetailsService = userDetailsService;
    }

}

短信 验证码过滤器，照着图片验证码过滤器写，其实可以重构，不会弄：

package com.imooc.security.core.validate.code;

import java.io.IOException;
import java.util.HashSet;
import java.util.Set;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.lang.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.social.connect.web.HttpSessionSessionStrategy;
import org.springframework.social.connect.web.SessionStrategy;
import org.springframework.util.AntPathMatcher;
import org.springframework.web.bind.ServletRequestBindingException;
import org.springframework.web.bind.ServletRequestUtils;
import org.springframework.web.context.request.ServletWebRequest;
import org.springframework.web.filter.OncePerRequestFilter;

import com.imooc.security.core.properties.SecurityConstants;
import com.imooc.security.core.properties.SecurityProperties;

/**
 * 短信验证码过滤器
 * ClassName: ValidateCodeFilter 
 * @Description:
 *  继承OncePerRequestFilter：spring提供的工具，保证过滤器每次只会被调用一次
 *  实现 InitializingBean接口的目的：
 *      在其他参数都组装完毕的时候，初始化需要拦截的urls的值
 * @author lihaoyang
 * @date 2018年3月2日
 */
public class SmsCodeFilter extends OncePerRequestFilter implements InitializingBean{

    private Logger logger = LoggerFactory.getLogger(getClass());
    
    //认证失败处理器
    private AuthenticationFailureHandler authenticationFailureHandler;

    //获取session工具类
    private SessionStrategy sessionStrategy = new HttpSessionSessionStrategy();
    
    //需要拦截的url集合
    private Set<String> urls = new HashSet<>();
    //读取配置
    private SecurityProperties securityProperties;
    //spring工具类
    private AntPathMatcher antPathMatcher = new AntPathMatcher();
    
    /**
     * 重写InitializingBean的方法，设置需要拦截的urls
     */
    @Override
    public void afterPropertiesSet() throws ServletException {
        super.afterPropertiesSet();
        //读取配置的拦截的urls
        String[] configUrls = StringUtils.splitByWholeSeparatorPreserveAllTokens(securityProperties.getCode().getSms().getUrl(), ",");
        //如果配置了需要验证码拦截的url，不判断，如果没有配置会空指针
        if(configUrls != null && configUrls.length > 0){
            for (String configUrl : configUrls) {
                logger.info("ValidateCodeFilter.afterPropertiesSet()--->配置了验证码拦截接口:"+configUrl);
                urls.add(configUrl);
            }
        }else{
            logger.info("----->没有配置拦验证码拦截接口<-------");
        }
        //短信验证码登录一定拦截
        urls.add(SecurityConstants.DEFAULT_LOGIN_PROCESSING_URL_MOBILE);
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        //如果是 登录请求 则执行
//        if(StringUtils.equals("/authentication/form", request.getRequestURI())
//                &&StringUtils.equalsIgnoreCase(request.getMethod(), "post")){
//            try {
//                validate(new ServletWebRequest(request));
//            } catch (ValidateCodeException e) {
//                //调用错误处理器，最终调用自己的
//                authenticationFailureHandler.onAuthenticationFailure(request, response, e);
//                return ;//结束方法，不再调用过滤器链
//            }
//        }
        
        
        /**
         * 可配置的验证码校验
         * 判断请求的url和配置的是否有匹配的，匹配上了就过滤
         */
        boolean action = false;
        for(String url:urls){
            if(antPathMatcher.match(url, request.getRequestURI())){
                action = true;
            }
        }
        if(action){
            try {
                validate(new ServletWebRequest(request));
            } catch (ValidateCodeException e) {
                //调用错误处理器，最终调用自己的
                authenticationFailureHandler.onAuthenticationFailure(request, response, e);
                return ;//结束方法，不再调用过滤器链
            }
        }
        
        //不是登录请求，调用其它过滤器链
        filterChain.doFilter(request, response);
    }

    /**
     * 校验验证码
     * @Description: 校验验证码
     * @param @param request
     * @param @throws ServletRequestBindingException   
     * @return void  
     * @throws ValidateCodeException
     * @author lihaoyang
     * @date 2018年3月2日
     */
    private void validate(ServletWebRequest request) throws ServletRequestBindingException {
        //拿出session中的ImageCode对象
        ValidateCode smsCodeInSession = (ValidateCode) sessionStrategy.getAttribute(request, ValidateCodeController.SESSION_KEY_SMS);
        //拿出请求中的验证码
        String imageCodeInRequest = ServletRequestUtils.getStringParameter(request.getRequest(), "smsCode");
        //校验
        if(StringUtils.isBlank(imageCodeInRequest)){
            throw new ValidateCodeException("验证码不能为空");
        }
        if(smsCodeInSession == null){
            throw new ValidateCodeException("验证码不存在，请刷新验证码");
        } 
        if(smsCodeInSession.isExpired()){
            //从session移除过期的验证码
            sessionStrategy.removeAttribute(request, ValidateCodeController.SESSION_KEY_SMS);
            throw new ValidateCodeException("验证码已过期，请刷新验证码");
        }
        if(!StringUtils.equalsIgnoreCase(smsCodeInSession.getCode(), imageCodeInRequest)){
            throw new ValidateCodeException("验证码错误");
        }
        //验证通过，移除session中验证码
        sessionStrategy.removeAttribute(request, ValidateCodeController.SESSION_KEY_SMS);
    }

    public AuthenticationFailureHandler getAuthenticationFailureHandler() {
        return authenticationFailureHandler;
    }

    public void setAuthenticationFailureHandler(AuthenticationFailureHandler authenticationFailureHandler) {
        this.authenticationFailureHandler = authenticationFailureHandler;
    }

    public SecurityProperties getSecurityProperties() {
        return securityProperties;
    }

    public void setSecurityProperties(SecurityProperties securityProperties) {
        this.securityProperties = securityProperties;
    }
    
    
}

把新建的这三个类做下配置，让spring security知道

SmsCodeAuthenticationSecurityConfig：

package com.imooc.security.core.authentication.mobile;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.SecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.DefaultSecurityFilterChain;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.stereotype.Component;

/**
 * 短信验证码配置
 * ClassName: SmsCodeAuthenticationSecurityConfig 
 * @Description: TODO
 * @author lihaoyang
 * @date 2018年3月8日
 */
@Component
public class SmsCodeAuthenticationSecurityConfig extends SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity> {

    @Autowired
    private AuthenticationFailureHandler imoocAuthenticationFailureHandler;
    
    @Autowired
    private AuthenticationSuccessHandler imoocAuthenticationSuccessHandler;
    
    @Autowired
    private UserDetailsService userDetailsService;
    
    @Override
    public void configure(HttpSecurity http) throws Exception {
        //1，配置短信验证码过滤器
        SmsCodeAuthenticationFilter smsCodeAuthenticationFilter = new SmsCodeAuthenticationFilter();
        smsCodeAuthenticationFilter.setAuthenticationManager(http.getSharedObject(AuthenticationManager.class));
        //设置认证失败成功处理器
        smsCodeAuthenticationFilter.setAuthenticationSuccessHandler(imoocAuthenticationSuccessHandler);
        smsCodeAuthenticationFilter.setAuthenticationFailureHandler(imoocAuthenticationFailureHandler);
        
        //配置pprovider
        SmsCodeAuthenticationProvider smsCodeAuthenticationProvider = new SmsCodeAuthenticationProvider();
        smsCodeAuthenticationProvider.setUserDetailsService(userDetailsService);
    
        http.authenticationProvider(smsCodeAuthenticationProvider)
            .addFilterAfter(smsCodeAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
    }

    
}

最后在BrowserSecurityConfig里配置短信验证码

@Configuration //这是一个配置
public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter{
    
    //读取用户配置的登录页配置
    @Autowired
    private SecurityProperties securityProperties;
    
    //自定义的登录成功后的处理器
    @Autowired
    private AuthenticationSuccessHandler imoocAuthenticationSuccessHandler;
    
    //自定义的认证失败后的处理器
    @Autowired
    private AuthenticationFailureHandler imoocAuthenticationFailureHandler;
    
    //数据源
    @Autowired
    private DataSource dataSource;
    
    
    @Autowired
    private UserDetailsService userDetailsService;
    
    @Autowired
    private SmsCodeAuthenticationSecurityConfig smsCodeAuthenticationSecurityConfig;
    
    @Autowired
    private SpringSocialConfigurer imoocSocialSecurityConfig;

    //注意是org.springframework.security.crypto.password.PasswordEncoder
    @Bean
    public PasswordEncoder passwordencoder(){
        //BCryptPasswordEncoder implements PasswordEncoder
        return new BCryptPasswordEncoder();
    }
    
    
    /**
     * 记住我TokenRepository配置，在登录成功后执行
     * 登录成功后往数据库存token的
     * @Description: 记住我TokenRepository配置
     * @param @return   JdbcTokenRepositoryImpl
     * @return PersistentTokenRepository  
     * @throws
     * @author lihaoyang
     * @date 2018年3月5日
     */
    @Bean
    public PersistentTokenRepository persistentTokenRepository(){
        JdbcTokenRepositoryImpl jdbcTokenRepository = new JdbcTokenRepositoryImpl();
        jdbcTokenRepository.setDataSource(dataSource);
        //启动时自动生成相应表，可以在JdbcTokenRepositoryImpl里自己执行CREATE_TABLE_SQL脚本生成表
        //第二次启动表已存在，需要注释
//        jdbcTokenRepository.setCreateTableOnStartup(true);
        return jdbcTokenRepository;
    }
    
  //版本二：可配置的登录页
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //~~~-------------> 图片验证码过滤器 <------------------
        ValidateCodeFilter validateCodeFilter = new ValidateCodeFilter();
        //验证码过滤器中使用自己的错误处理
        validateCodeFilter.setAuthenticationFailureHandler(imoocAuthenticationFailureHandler);
        //配置的验证码过滤url
        validateCodeFilter.setSecurityProperties(securityProperties);
        validateCodeFilter.afterPropertiesSet();
        
        //~~~-------------> 短信验证码过滤器 <------------------
        SmsCodeFilter smsCodeFilter = new SmsCodeFilter();
        //验证码过滤器中使用自己的错误处理
        smsCodeFilter.setAuthenticationFailureHandler(imoocAuthenticationFailureHandler);
        //配置的验证码过滤url
        smsCodeFilter.setSecurityProperties(securityProperties);
        smsCodeFilter.afterPropertiesSet();
        
        
        
        //实现需要认证的接口跳转表单登录,安全=认证+授权
        //http.httpBasic() //这个就是默认的弹框认证
        //
        http 
            .addFilterBefore(smsCodeFilter, UsernamePasswordAuthenticationFilter.class)
//            .apply(imoocSocialSecurityConfig)//社交登录
//            .and()
            //把验证码过滤器加载登录过滤器前边
            .addFilterBefore(validateCodeFilter, UsernamePasswordAuthenticationFilter.class)
            //表单认证相关配置
            .formLogin() 
                .loginPage(SecurityConstants.DEFAULT_UNAUTHENTICATION_URL) //处理用户认证BrowserSecurityController
                //登录过滤器UsernamePasswordAuthenticationFilter默认登录的url是"/login"，在这能改
                .loginProcessingUrl(SecurityConstants.DEFAULT_LOGIN_PROCESSING_URL_FORM) 
                .successHandler(imoocAuthenticationSuccessHandler)//自定义的认证后处理器
                .failureHandler(imoocAuthenticationFailureHandler) //登录失败后的处理
                .and()
            //记住我相关配置    
            .rememberMe()
                .tokenRepository(persistentTokenRepository())//TokenRepository，登录成功后往数据库存token的
                .tokenValiditySeconds(securityProperties.getBrowser().getRememberMeSeconds())//记住我秒数
                .userDetailsService(userDetailsService) //记住我成功后，调用userDetailsService查询用户信息
            .and()
            //授权相关的配置 
            .authorizeRequests() 
                // /authentication/require：处理登录，securityProperties.getBrowser().getLoginPage():用户配置的登录页
                .antMatchers(SecurityConstants.DEFAULT_UNAUTHENTICATION_URL,
                securityProperties.getBrowser().getLoginPage(),//放过登录页不过滤，否则报错
                SecurityConstants.DEFAULT_VALIDATE_CODE_URL_PREFIX+"/*").permitAll() //验证码
                .anyRequest()        //任何请求
                .authenticated()    //都需要身份认证
            .and()
                .csrf().disable() //关闭csrf防护
            .apply(smsCodeAuthenticationSecurityConfig);//把短信验证码配置应用上
    }
}

访问登陆页，点击发送验证码模拟发送验证码

输入后台打印的验证码

登录成功：

完整代码在github：https://github.com/lhy1234/spring-security