Springboot之security框架 登录安全验证授权流程

一、只进行用户验证，不验证密码（UserDetailsService）

　　1、导入security依赖（在前端html页面进行一些判断  需导入xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4"）

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

<dependency>
    <groupId>org.thymeleaf.extras</groupId>
    <artifactId>thymeleaf-extras-springsecurity5</artifactId>
    <version>3.0.4.RELEASE</version>
</dependency>

　　2、配置安全认证类

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import top.xiaoyl.service.CustomUserDetailService;

@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class MySecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //super.configure(http);
        //定制请求的授权规则
        http.authorizeRequests().antMatchers("/admin/**","/js/**","/css/**","/images/*","/fonts/**","/**/*.png","/**/*.jpg").permitAll()
                .antMatchers("/","/index.html").permitAll()
               .antMatchers("/report").hasRole("USER")
                .and()
                .csrf().ignoringAntMatchers("/druid/*");


        /*
         *  开启自动配置的登陆功能，效果，如果没有登陆，没有权限就会来到登陆页面
         *      1、login来到登陆页
         *      2、重定向到/login?error表示登陆失败
         *      3、更多详细规定
         *      4、默认post形式的 /login代表处理登陆
         *      5、一但定制loginPage；那么 loginPage的post请求就是登陆
         */
        http.formLogin().usernameParameter("username").passwordParameter("password")
                .loginPage("/login");


        /*
         *  开启自动配置的注销功能
         *      1、访问 /logout 表示用户注销，清空session
         *      注销成功会返回 /login?logout 页面；
         *      注销成功以后来到首页
         */
        http.logout().logoutSuccessUrl("/");


        /*
         *  开启记住我功能
         *      登陆成功以后，将cookie发给浏览器保存，以后访问页面带上这个cookie，只要通过检查就可以免登录
         *      点击注销会删除cookie
         */
        http.rememberMe().rememberMeParameter("remember");
    }

    @Bean
60     UserDetailsService customUserDetailService() { // 注册UserDetailsService 的bean
61         return new CustomUserDetailService();
62     }

    /**
     * 认证信息管理
     * spring5中摒弃了原有的密码存储格式，官方把spring security的密码存储格式改了
     *
     */
    @Autowired
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(customUserDetailService()) //认证信息存储(自定义)
                .passwordEncoder(passwordEncoder());
//
//        auth.inMemoryAuthentication() //认证信息存储到内存中
//                .passwordEncoder(passwordEncoder())
//                .withUser("user").password(passwordEncoder().encode("123")).roles("USER");

    }

    private PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

}

　　3、自定义用户验证类实现UserDetailsService接口，进行授权验证

@Service
public class CustomUserDetailService implements UserDetailsService {

    @Autowired
    private UserService userService;

    @Autowired
    HttpServletRequest request;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        HttpSession session = request.getSession();
        User user = userService.getUserByUsername(username);
        if(user==null){
            session.setAttribute("loginMsg","用户名"+username+"不存在");
            throw new UsernameNotFoundException("用户名"+username+"不存在");
        }
        List<SimpleGrantedAuthority> authorities = new ArrayList<>();
        authorities.add(new SimpleGrantedAuthority("USER"));
        return new org.springframework.security.core.userdetails.User(user.getUsername(),user.getPassword(),authorities);
    }
}

二、进行用户密码验证（AbstractUserDetailsAuthenticationProvider）

　　第一种方法虽然也能认证授权，但是问题显而易见，没有进行密码验证，主要用户名对了  就给权限  这很危险

　　流程跟一基本一样

　　1、导入依赖

　　2、配置安全认证类，需要报红色的地方修改一下

@Bean
    AbstractUserDetailsAuthenticationProvider customAuthenticationProvide() { // 注册AbstractUserDetailsAuthenticationProvider的bean
        return new CustomAuthenticationProvider();
    }
 
@Autowired
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(customAuthenticationProvide()); //认证信息存储(自定义)
//
//        auth.inMemoryAuthentication() //认证信息存储到内存中
//                .passwordEncoder(passwordEncoder())
//                .withUser("user").password(passwordEncoder().encode("123")).roles("USER");

    }

　　3、自定义用户验证类实现AbstractUserDetailsAuthenticationProvider类，进行授权验证

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import top.xiaoyl.entities.User;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;
import java.util.ArrayList;
import java.util.List;

@Service
public class CustomAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {

    @Autowired
    private UserService userService;

    @Autowired
    private HttpServletRequest request;

    @Override
    protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {

    }

    @Override
    protected UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
        System.out.println("retrieveUser");
        HttpSession session = request.getSession();
        if(username==null || username.length()==0){
            session.setAttribute("loginMsg","用户名不能为空");
            throw new UsernameNotFoundException("用户名不能为空");
        }
        User user = userService.getUserByUsername(username);
        if(user==null){
            session.setAttribute("loginMsg","用户名"+username+"不存在");
            throw new UsernameNotFoundException("用户名"+username+"不存在");
        }
        if(!authentication.getCredentials().toString().equals(user.getPassword())){
            session.setAttribute("loginMsg","密码不正确");
            throw new BadCredentialsException("密码不正确");
        }
        List<SimpleGrantedAuthority> authorities = new ArrayList<>();
        authorities.add(new SimpleGrantedAuthority("USER"));
        return new org.springframework.security.core.userdetails.User(user.getUsername(),user.getPassword(),authorities);
    }
}