项目依赖
安全配置主要依赖：
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-redis</artifactId>
<version>2.3.3.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-configuration-processor</artifactId>
<version>2.3.3.RELEASE</version>
<optional>true</optional>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
<version>2.3.3.RELEASE</version>
</dependency>
<dependency>
<groupId>io.springfox</groupId>
<artifactId>springfox-swagger2</artifactId>
<version>2.9.2</version>
</dependency>
<dependency>
<groupId>io.springfox</groupId>
<artifactId>springfox-swagger-ui</artifactId>
<version>2.9.2</version>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt</artifactId>
<version>0.9.1</version>
</dependency>
Security 核心配置
import com.base.common.utils.Md5Utils;
import com.base.web.config.security.filter.JwtAuthenticationTokenFilter;
import com.base.web.config.security.handler.*;
import com.base.web.service.UserService;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import javax.annotation.Resource;
import java.time.Duration;
import static java.util.Collections.singletonList;
/**
* Security config
*
* @author ming
* @version 1.0.0
* @date 2021/1/13 15:04
**/
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Resource
private UserService userService;
@Resource
private CustomAuthenticationFailureHandler authenticationFailureHandler;
@Resource
private CustomAuthenticationSuccessHandler authenticationSuccessHandler;
@Resource
private CustomAuthenticationEntryPointHandler authenticationEntryPointHandler;
@Resource
private CustomLogoutSuccessHandler logoutSuccessHandler;
@Resource
private CustomAccessDeniedHandler accessDeniedHandler;
@Resource
private JwtAuthenticationTokenFilter authenticationTokenFilter;
/**
* BCryptPasswordEncoder
*/
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
/**
* Implementation of user defined password encryption
*/
@Bean
public PasswordEncoder customPasswordEncoder() {
return new CustomPasswordEncoder();
}
/**
* 跨域配置
*/
@Bean
public CorsConfigurationSource corsConfigurationSource() {
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowCredentials(true);
configuration.setAllowedOrigins(singletonList("*"));
configuration.setAllowedMethods(singletonList("*"));
configuration.setAllowedHeaders(singletonList("*"));
configuration.setMaxAge(Duration.ofHours(1));
source.registerCorsConfiguration("/**", configuration);
return source;
}
/**
* URL whitelist
*/
private static final String[] AUTH_WHITELIST = {
// -- swagger ui
"/v2/api-docs",
"/swagger-resources/**",
"/swagger-resources/configuration/ui",
"/swagger-resources/configuration/security",
"/swagger-ui.html/**",
"/css/**",
"/js/**",
"/images/**",
"/webjars/**",
"**/favicon.ico",
"/",
"/csrf",
// -- user & common
"/user/registry",
"/user/login",
"/user/logout",
"/common"
};
/**
* 核心配置
*
* @param http HttpSecurity
* @throws Exception e
*/
@Override
protected void configure(HttpSecurity http) throws Exception {
http.formLogin()
//登录处理接口
//.loginPage("/login_page")
.loginProcessingUrl("/user/login")
//定义登录时，用户名的 key，默认为 username
.usernameParameter("username")
//定义登录时，用户密码的 key，默认为 password
.passwordParameter("password")
//登录成功处理
.successHandler(authenticationSuccessHandler)
//登录失败处理
.failureHandler(authenticationFailureHandler)
.permitAll()
.and()
//登出处理
.logout()
.logoutUrl("/user/logout")
//清除身份信息
.clearAuthentication(true)
.logoutSuccessHandler(logoutSuccessHandler)
.permitAll()
.and()
//开启跨域
.cors()
.configurationSource(corsConfigurationSource())
.and()
//取消跨站请求伪造防护
.csrf().disable()
//基于jwt，不需要session
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
//Url白名单
.and()
.authorizeRequests()
.antMatchers(AUTH_WHITELIST)
.permitAll()
.anyRequest()
.authenticated();
// 禁用缓存
http.headers().cacheControl();
// 添加JWT filter
http.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
//无token或者token无效的相关处理
http.exceptionHandling()
.authenticationEntryPoint(authenticationEntryPointHandler)
.accessDeniedHandler(accessDeniedHandler);
}
/**
* 配置用户签名服务 主要是user-details 机制
* (可以采用内存、数据库、loap、自定义) 这里是自定义
*
* @param auth 签名管理器构造器，用于构建用户具体权限控制
* @throws Exception e
*/
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userService).passwordEncoder(passwordEncoder());
}
/**
* 自定义密码加密实现(md5)
*/
private static class CustomPasswordEncoder implements PasswordEncoder {
@Override
public String encode(CharSequence plaintext) {
return Md5Utils.md5(String.valueOf(plaintext));
}
@Override
public boolean matches(CharSequence plaintext, String cipher) {
return cipher.equals(Md5Utils.md5(String.valueOf(plaintext)));
}
}
}
2.处理器 CustomAccessDeniedHandler.java
import com.base.common.ApiResponse;
import com.base.web.config.security.utils.WebMvcWriter;
import lombok.extern.slf4j.Slf4j;
import org.springframework.http.HttpStatus;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.web.access.AccessDeniedHandler;
import org.springframework.stereotype.Component;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* 权限不足异常处理(用来解决认证过的用户访问无权限资源时的异常)
*
* @author ming
* @version 1.0.0
* @date 2021/1/15 14:35
**/
@Component
@Slf4j
public class CustomAccessDeniedHandler implements AccessDeniedHandler {
@Override
public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException e) throws IOException {
log.error("接口-> {} <-访问权限不足，请求失败: {}", request.getRequestURI(), e);
response.setContentType("application/json;charset=UTF-8");
response.setStatus(HttpStatus.FORBIDDEN.value());
ApiResponse resp = ApiResponse.failed(HttpStatus.FORBIDDEN.value(), "权限不足!!");
new WebMvcWriter().out(response, resp);
}
}
3.CustomAuthenticationEntryPointHandler.java
import com.base.common.ApiResponse;
import com.base.web.config.security.utils.JwtTokenUtils;
import com.base.web.config.security.utils.WebMvcWriter;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.StringUtils;
import org.springframework.http.HttpStatus;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.stereotype.Component;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* 令牌异常处理
* (用来解决匿名用户访问无权限资源时的异常)
*
* @author ming
* @version 1.0.0
* @date 2021/1/15 14:36
**/
@Component
@Slf4j
public class CustomAuthenticationEntryPointHandler implements AuthenticationEntryPoint {
@Override
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException e) throws IOException {
String token = request.getHeader(JwtTokenUtils.TOKEN_HEADER);
response.setContentType("application/json;charset=utf-8");
int status = HttpStatus.UNAUTHORIZED.value();
response.setStatus(status);
if (StringUtils.isEmpty(token)) {
String message = "未设置Token!!";
log.error("接口访问-> {} <-请求失败: {} , {}", request.getRequestURI(), e, message);
new WebMvcWriter().out(response, ApiResponse.failed(10000 + status, message));
return;
}
if (StringUtils.startsWith(token, JwtTokenUtils.TOKEN_PREFIX)) {
token = StringUtils.substring(token, JwtTokenUtils.TOKEN_PREFIX.length());
}
String username = JwtTokenUtils.getUsername(token);
if (StringUtils.isEmpty(username)) {
String message = "访问令牌不合法";
log.error("接口访问-> {} <-请求失败: {} , {}", request.getRequestURI(), e, message);
new WebMvcWriter().out(response, ApiResponse.failed(10000 + status, message));
}
}
}
4.CustomAuthenticationFailureHandler.java
import com.base.common.ApiResponse;
import com.base.web.config.security.utils.WebMvcWriter;
import lombok.extern.slf4j.Slf4j;
import org.springframework.http.HttpStatus;
import org.springframework.security.authentication.*;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.stereotype.Component;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* 登录失败处理
*
* @author ming
* @version 1.0.0
* @date 2021/1/21 14:37
**/
@Slf4j
@Component
public class CustomAuthenticationFailureHandler implements AuthenticationFailureHandler {
@Override
public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException e) throws IOException {
log.error("登录认证失败: {}", e);
response.setContentType("application/json;charset=utf-8");
response.setStatus(HttpStatus.UNAUTHORIZED.value());
ApiResponse resp;
if (e instanceof BadCredentialsException || e instanceof UsernameNotFoundException) {
resp = ApiResponse.failed(1111, "账户名或者密码输入错误!");
} else if (e instanceof LockedException) {
resp = ApiResponse.failed(1112, "账户被锁定，请联系管理员!");
} else if (e instanceof CredentialsExpiredException) {
resp = ApiResponse.failed(1113, "密码过期，请联系管理员!");
} else if (e instanceof AccountExpiredException) {
resp = ApiResponse.failed(1114, "账户过期，请联系管理员!");
} else if (e instanceof DisabledException) {
resp = ApiResponse.failed(1115, "账户被禁用，请联系管理员!");
} else {
resp = ApiResponse.failed(1116, "登录失败!");
}
new WebMvcWriter().out(response, resp);
}
}
5.CustomAuthenticationSuccessHandler.java
import cn.hutool.core.date.DatePattern;
import com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper;
import com.base.common.ApiResponse;
import com.base.common.entity.sys.SysUser;
import com.base.common.handle.RequestHolder;
import com.base.common.utils.IpUtil;
import com.base.common.utils.JsonUtils;
import com.base.common.utils.RedisCacheUtil;
import com.base.web.config.security.utils.JwtTokenUtils;
import com.base.web.config.security.utils.WebMvcWriter;
import com.base.web.entity.vo.UserInfoVO;
import com.base.web.service.SysMenuService;
import com.base.web.service.UserService;
import com.github.hiwepy.ip2region.spring.boot.IP2regionTemplate;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.ObjectUtils;
import org.springframework.http.HttpStatus;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.stereotype.Component;
import javax.annotation.Resource;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.time.LocalDateTime;
import java.time.format.DateTimeFormatter;
import java.util.HashMap;
import java.util.Map;
/**
* 登录成功处理
*
* @author ming
* @version 1.0.0
* @date 2021/1/21 14:49
**/
@Slf4j
@Component
public class CustomAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
@Resource
private UserService userService;
@Resource
private RedisCacheUtil redisCacheUtil;
@Resource
private IP2regionTemplate ip2region;
@Resource
private SysMenuService menuService;
@Override
public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication auth) throws IOException {
String username = auth.getName();
log.info("用户-> {} <-登录成功", username);
response.setContentType("application/json;charset=utf-8");
response.setStatus(HttpStatus.OK.value());
SysUser user = userService.getSysUser(username);
try {
String jwtToken = JwtTokenUtils.createToken(userService.loadUserByUsername(username), false);
// 生成令牌并设置到响应头中
// response.setHeader(JwtTokenUtils.TOKEN_HEADER, token);
// refresh user info
user.setLoginIp(IpUtil.getIp(new RequestHolder().getRequest()));
user.setLoginAddress(ip2region.getRegion(user.getLoginIp()));
user.setModifyTime(LocalDateTime.now().format(DateTimeFormatter.ofPattern(DatePattern.NORM_DATETIME_PATTERN)));
if (redisCacheUtil.hasKey(jwtToken)) {
//获得redis中用户的token刷新时效
String userJson = redisCacheUtil.getString(jwtToken);
UserInfoVO userInfoVO = JsonUtils.parseJsonToObj(userJson, UserInfoVO.class);
UserDetails userDetails = userService.loadUserByUsername(username);
if (ObjectUtils.isNotEmpty(userInfoVO)) {
// 说明用户存在且未过期
jwtToken = JwtTokenUtils.createToken(userDetails, false);
// TODO: 2021/1/22 这里可能还需要更新登录地点和登录IP
userInfoVO.setJwtToken(jwtToken);
// 刷新缓存
redisCacheUtil.delete(jwtToken);
redisCacheUtil.setString(jwtToken, JsonUtils.parseObjToJson(userInfoVO), JwtTokenUtils.EXPIRATION);
Map<String, String> map = new HashMap<>(1);
map.put(JwtTokenUtils.TOKEN_HEADER, JwtTokenUtils.TOKEN_PREFIX + jwtToken);
new WebMvcWriter().out(response, ApiResponse.successful(map));
return;
}
}
// 修改登录IP和登录地址
user.setLoginIp(user.getLoginIp());
user.setLoginAddress(user.getLoginAddress());
if (!userService.update(user, new UpdateWrapper<>(user))) {
log.error("用户信息更新失败!!");
ApiResponse.failed(2, "用户信息更新失败!!");
}
// 验证通过返回用户部分信息 以及 拥有的角色和菜单
UserInfoVO userVO = userService.userInfo(user.getUsername());
userVO.setMyMenus(userVO.getRoles());
userVO.setUserRoutes(menuService.getMenuTree(userVO.getMenus()));
userVO.setModifyTime(user.getModifyTime());
userVO.setJwtToken(jwtToken);
redisCacheUtil.setString(jwtToken, JsonUtils.parseObjToJson(userVO), JwtTokenUtils.EXPIRATION);
Map<String, String> map = new HashMap<>(1);
map.put(JwtTokenUtils.TOKEN_HEADER, JwtTokenUtils.TOKEN_PREFIX + jwtToken);
new WebMvcWriter().out(response, ApiResponse.successful(map));
} catch (Exception e) {
log.error("登录认证失败: {}", e);
new WebMvcWriter().out(response, ApiResponse.failed(HttpStatus.UNAUTHORIZED.value(), "创建token失败，请与管理员联系"));
}
}
}
6.CustomLogoutSuccessHandler.java
import com.base.common.ApiResponse;
import com.base.common.entity.sys.SysUser;
import com.base.common.enumeration.ResponseMessageEnum;
import com.base.common.exception.BusinessException;
import com.base.common.utils.RedisCacheUtil;
import com.base.web.config.security.utils.JwtTokenUtils;
import com.base.web.config.security.utils.WebMvcWriter;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.StringUtils;
import org.springframework.http.HttpStatus;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
import org.springframework.stereotype.Component;
import javax.annotation.Resource;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* 注销登录处理
*
* @author ming
* @version 1.0.0
* @date 2021/1/21 14:53
**/
@Slf4j
@Component
public class CustomLogoutSuccessHandler implements LogoutSuccessHandler {
@Resource
private RedisCacheUtil redisCacheUtil;
@Override
public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication auth) throws IOException {
String token = request.getHeader(JwtTokenUtils.TOKEN_HEADER);
if (token != null && StringUtils.startsWith(token, JwtTokenUtils.TOKEN_PREFIX)) {
token = StringUtils.substring(token, JwtTokenUtils.TOKEN_PREFIX.length());
} else {
log.error("登出失败，未设置Token");
throw new BusinessException("登出失败");
}
String username = JwtTokenUtils.getUsername(token);
log.debug(String.format("%s 用户正在登出!!", username));
if (redisCacheUtil.hasKey(token)) {
redisCacheUtil.delete(token);
}
log.info("用户-> {} <-登出成功", ((SysUser) auth).getUsername());
response.setContentType("application/json;charset=utf-8");
response.setStatus(HttpStatus.OK.value());
//response.sendRedirect("/login_page");
new WebMvcWriter().out(response, ApiResponse.successful(ResponseMessageEnum.USER_LOGOUT_SUCCESS.getCode(), ResponseMessageEnum.USER_LOGOUT_SUCCESS.getMsg()));
}
}
过滤器
JwtAuthenticationTokenFilter.java
import com.base.common.ApiResponse;
import com.base.common.enumeration.ResponseMessageEnum;
import com.base.common.utils.JsonUtils;
import com.base.common.utils.RedisCacheUtil;
import com.base.web.config.security.utils.JwtTokenUtils;
import com.base.web.config.security.utils.WebMvcWriter;
import com.base.web.entity.vo.UserInfoVO;
import com.base.web.service.UserService;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.ObjectUtils;
import org.apache.commons.lang3.StringUtils;
import org.springframework.http.HttpStatus;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;
import javax.annotation.Resource;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* Jwt Token Effectiveness Filter
*
* @author ming
* @version 1.0.0
* @date 2021/1/15 14:35
**/
@Slf4j
@Component
public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
@Resource
private UserService userService;
@Resource
private RedisCacheUtil redisCacheUtil;
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
String token = request.getHeader(JwtTokenUtils.TOKEN_HEADER);
if (token != null && StringUtils.startsWith(token, JwtTokenUtils.TOKEN_PREFIX)) {
token = StringUtils.substring(token, JwtTokenUtils.TOKEN_PREFIX.length());
} else {
filterChain.doFilter(request, response);
return;
}
String username = JwtTokenUtils.getUsername(token);
if (username != null && redisCacheUtil.hasKey(token)) {
//获得redis中用户的token刷新时效
String userJson = redisCacheUtil.getString(token);
UserInfoVO userInfoVO = JsonUtils.parseJsonToObj(userJson, UserInfoVO.class);
UserDetails userDetails = userService.loadUserByUsername(username);
if (ObjectUtils.isNotEmpty(userInfoVO)) {
// 说明用户存在且未过期
String jwtToken = JwtTokenUtils.createToken(userDetails, false);
// TODO: 2021/1/22 这里可能还需要更新登录地点和登录IP
userInfoVO.setJwtToken(jwtToken);
// 刷新缓存
redisCacheUtil.delete(token);
redisCacheUtil.setString(jwtToken, JsonUtils.parseObjToJson(userInfoVO), JwtTokenUtils.EXPIRATION);
response.setHeader(JwtTokenUtils.TOKEN_HEADER, JwtTokenUtils.TOKEN_PREFIX + jwtToken);
}
}
try {
if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
UserDetails userDetails = userService.loadUserByUsername(username);
if (JwtTokenUtils.validateToken(token, userDetails)) {
UsernamePasswordAuthenticationToken authentication =
new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(authentication);
}
}
} catch (Exception e) {
log.error("接口访问-> {} <-请求失败,不合法的令牌!!", request.getRequestURI());
response.setContentType("application/json;charset=UTF-8");
response.setStatus(HttpStatus.UNAUTHORIZED.value());
new WebMvcWriter().out(response, ApiResponse.failed(HttpStatus.UNAUTHORIZED.value(), ResponseMessageEnum.USER_TOKEN_INVALID.getMsg()));
return;
}
filterChain.doFilter(request, response);
}
}
工具类
1.JwtTokenUtils.java
import com.base.common.exception.BusinessException;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.UserDetails;
import java.util.Date;
import java.util.HashMap;
import java.util.List;
import java.util.Set;
/**
* JWT utils
*
* @author : ming
* @version 1.0
*/
public class JwtTokenUtils {
public static final String TOKEN_HEADER = "Authorization";
public static final String TOKEN_PREFIX = "Bearer ";
/**
* 密钥key
*/
private static final String SECRET = "security";
/**
* JWT的发行人
*/
private static final String ISS = "ming";
/**
* 自定义用户信息
*/
private static final String ROLE_CLAIMS = "rol";
/**
* 过期时间是3600秒，既是1个小时
*/
public static final long EXPIRATION = 3600L * 1000;
/**
* 选择了记住我之后的过期时间为7天
*/
public static final long EXPIRATION_REMEMBER = 604800L * 1000;
/**
* 创建token
*
* @param details 登录名
* @param isRememberMe 是否记住我
* @return String
*/
public static String createToken(UserDetails details, boolean isRememberMe) throws BusinessException {
// 如果选择记住我，则token的过期时间为
long expiration = isRememberMe ? EXPIRATION_REMEMBER : EXPIRATION;
HashMap<String, Object> map = new HashMap<>();
// 角色名字,"ROLE_"开头的权限才是用户角色
map.put(ROLE_CLAIMS, details.getAuthorities());
return Jwts.builder()
// 加密算法
.signWith(SignatureAlgorithm.HS512, SECRET)
// 自定义信息
.setClaims(map)
// jwt发行人
.setIssuer(ISS)
// jwt面向的用户
.setSubject(details.getUsername())
// jwt发行时间
.setIssuedAt(new Date())
// jwt过期时间
.setExpiration(new Date(System.currentTimeMillis() + expiration))
.compact();
}
/**
* 从token获取用户信息
*
* @param token token
* @return username
*/
public static String getUsername(String token) throws BusinessException {
return getTokenBody(token).getSubject();
}
/**
* 从token中获取用户角色
*
* @param token token
* @return GrantedAuthority
*/
@SuppressWarnings("unchecked")
public static Set<String> getUserRole(String token) throws BusinessException {
List<GrantedAuthority> userAuthorities = (List<GrantedAuthority>) getTokenBody(token).get(ROLE_CLAIMS);
return AuthorityUtils.authorityListToSet(userAuthorities);
}
/**
* 是否已过期
*
* @param token token
* @return boolean
*/
private static boolean isExpiration(String token) throws BusinessException {
return getTokenBody(token).getExpiration().before(new Date());
}
/**
* 解析token
*
* @param token token
* @return Claims
* @throws BusinessException e
*/
private static Claims getTokenBody(String token) throws BusinessException {
return Jwts.parser().setSigningKey(SECRET).parseClaimsJws(token).getBody();
}
/**
* 验证token
*
* @param token token
* @param userDetails user
* @return boolean
*/
public static boolean validateToken(String token, UserDetails userDetails) throws BusinessException {
final String username = getUsername(token);
return (username.equals(userDetails.getUsername()) && !isExpiration(token));
}
}
2.WebMvcWriter.java
import com.base.common.ApiResponse;
import com.fasterxml.jackson.databind.ObjectMapper;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;
/**
* Web mvc out
*
* @author ming
* @version 1.0.0
* @date 2021/1/21 14:42
**/
public class WebMvcWriter {
public void out(HttpServletResponse response, ApiResponse resp) throws IOException {
ObjectMapper om = new ObjectMapper();
PrintWriter out = response.getWriter();
out.write(om.writeValueAsString(resp));
out.flush();
out.close();
}
}
权限判断
CustomPermissionEvaluator.java
import lombok.extern.slf4j.Slf4j;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.access.PermissionEvaluator;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import java.io.Serializable;
/**
* 自定义权限判断
* 注解使用方式(@PreAuthorize("hasPermission('user','add')" ))
*
* @author ming
* @version 1.0.0
* @date 2021/1/13 18:52
**/
@Configuration
@Slf4j
public class CustomPermissionEvaluator implements PermissionEvaluator {
@Override
public boolean hasPermission(Authentication auth, Object o, Object o1) {
boolean access = false;
log.info(auth.getPrincipal().toString());
// 权限判断
if (auth.getPrincipal().toString().compareToIgnoreCase("anonymousUser") != 0) {
String privilege = o + ":" + o1;
for (GrantedAuthority authority : auth.getAuthorities()) {
if (privilege.equalsIgnoreCase(authority.getAuthority())) {
access = true;
break;
}
}
}
return access;
}
@Override
public boolean hasPermission(Authentication authentication, Serializable serializable, String s, Object o) {
return false;
}
}
MethodSecurityConfig.java
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration;
/**
* 全局方法安全配置(权限评估)
*
* @author ming
* @version 1.0.0
* @date 2021/1/21 15:49
**/
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
private CustomPermissionEvaluator customPermissionEvaluator;
@Autowired
public void setCustomPermissionEvaluator(CustomPermissionEvaluator customPermissionEvaluator) {
this.customPermissionEvaluator = customPermissionEvaluator;
}
@Override
protected MethodSecurityExpressionHandler createExpressionHandler() {
DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
expressionHandler.setPermissionEvaluator(customPermissionEvaluator);
return expressionHandler;
}
}
同意响应类
ApiResponse.java
import com.base.common.enumeration.ResponseMessageEnum;
import io.swagger.annotations.ApiModel;
import io.swagger.annotations.ApiModelProperty;
import lombok.AllArgsConstructor;
import lombok.Data;
import java.io.Serializable;
/**
* Global Return
*
* @author ming
* @version 1.0.0
* @since 2020/4/14 14:30
**/
@Data
@ApiModel("统一响应类")
@AllArgsConstructor
public class ApiResponse<T> implements Serializable {
private static final long serialVersionUID = 9024462031856060619L;
@ApiModelProperty("状态码")
private Integer code;
@ApiModelProperty("信息")
private String msg;
@ApiModelProperty("数据")
private T data;
private ApiResponse() {
super();
}
public static <T> ApiResponse<T> successful(Integer code, String msg) {
return getApiResponseWithoutData(code, msg);
}
public static <T> ApiResponse<T> successful(T data) {
ApiResponse<T> apiResponse = new ApiResponse<>();
apiResponse.setCode(ResponseMessageEnum.OPERATION_SUCCESS.getCode());
apiResponse.setMsg("");
apiResponse.setData(data);
return apiResponse;
}
public static <T> ApiResponse<T> successful(Integer code, String msg, T data) {
return getApiResponseWithData(code, msg, data);
}
public static <T> ApiResponse<T> failed(Integer code, String msg) {
return getApiResponseWithoutData(code, msg);
}
private static <T> ApiResponse<T> getApiResponseWithoutData(Integer code, String msg) {
ApiResponse<T> apiResponse = new ApiResponse<>();
apiResponse.setCode(code);
apiResponse.setMsg(msg);
apiResponse.setData(null);
return apiResponse;
}
private static <T> ApiResponse<T> getApiResponseWithData(Integer code, String msg, T data) {
ApiResponse<T> apiResponse = new ApiResponse<>();
apiResponse.setCode(code);
apiResponse.setMsg(msg);
apiResponse.setData(data);
return apiResponse;
}
}
RedisUtils
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.StringUtils;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.stereotype.Component;
import javax.annotation.Resource;
import java.util.*;
import java.util.concurrent.TimeUnit;
/**
* redis 缓存工具类
*
* @author ming
* @version 1.0.0
* @since 2019/8/22 17:27
**/
@Slf4j
@Component
public class RedisCacheUtil {
// 注： 这里不能用Autowired按类型装配注入,必须用@Resource
// StringRedisTemplate默认采用的是String的序列化策略,
// RedisTemplate默认采用的是JDK的序列化策略，保存的key和value都是采用此策略序列化保存的
/**
* 注入redis
*/
@Resource
private RedisTemplate<String, Object> redisTemplate;
/**
* 生成业务查询使用的缓存key , 带分页
*
* @param username 用户名
* @param obj 业务相关命名
* @return key
*/
public String generateCachePageKey(String username, String obj, Integer pageNo, Integer pageSize) {
return generateCacheKey(username, obj) + "_page[" + pageNo + "," + pageSize + "]";
}
/**
* 生成业务查询使用的缓存key
*
* @param username 用户名
* @param obj 业务相关命名
* @return key
*/
public String generateCacheKey(String username, String obj) {
if (StringUtils.isBlank(username) || StringUtils.isBlank(obj)) {
return null;
}
return username + "_" + obj;
}
/**
* 指定缓存失效时间
*
* @param key 键
* @param time 时间(秒)
*/
private void expire(String key, long time) {
if (time > 0) {
redisTemplate.expire(key, time, TimeUnit.SECONDS);
}
}
/**
* 根据key 获取过期时间
*
* @param key 键 不能为null
* @return 时间(秒) 返回0代表为永久有效
*/
public Long getExpire(String key) {
return redisTemplate.getExpire(key, TimeUnit.SECONDS);
}
/**
* 判断key是否存在
*
* @param key 键
* @return true 存在 false不存在
*/
public Boolean hasKey(String key) {
try {
return redisTemplate.hasKey(key);
} catch (Throwable e) {
return false;
}
}
/**
* 删除缓存
*
* @param key 可以传一个值 或多个
*/
public Long delete(String... key) {
if (key != null && key.length > 0) {
Collection<String> collection = Arrays.asList(key);
if (key.length == 1) {
Boolean re = redisTemplate.delete(key[0]);
if (re) {
return 1L;
} else {
return 0L;
}
} else {
return redisTemplate.delete(collection);
}
}
return 0L;
}
// ============================ String =============================
/**
* 获取字符串
*
* @param key key
* @return String value
*/
public String getString(String key) {
Object obj = redisTemplate.opsForValue().get(key);
return obj.toString();
}
/**
* 保存字符串
*
* @param key 键
* @param value 值
*/
public void setString(String key, Object value) {
redisTemplate.opsForValue().set(key, value);
}
/**
* 普通缓存放入并设置时间
*
* @param key 键
* @param value 值
* @param expireTime 时间(秒) time要大于0 如果time小于等于0 将设置无限期
*/
public void setString(String key, Object value, long expireTime) {
if (expireTime > 0) {
redisTemplate.opsForValue().set(key, value, expireTime, TimeUnit.SECONDS);
} else {
setString(key, value);
}
}
// ============================ Object =============================
/**
* 获取对象
*
* @param key key
* @return obj
*/
public Object getObject(String key) {
return redisTemplate.opsForValue().get(key);
}
/**
* 普通缓存放入并设置时间
*
* @param key 键
* @param value 值
* @param time 时间(秒) time要大于0 如果time小于等于0 将设置无限期
*/
public void setObject(String key, Object value, long time) {
//JsonUtils.toJson
if (time > 0) {
redisTemplate.opsForValue().set(key, value, time, TimeUnit.SECONDS);
} else {
setObject(key, value);
}
}
/**
* 普通缓存放入
*
* @param key 键
* @param value 值
*/
public void setObject(String key, Object value) {
redisTemplate.opsForValue().set(key, value);
}
/**
* 递增
*
* @param key 键
* @param delta 要增加几(大于0)
* @return long
*/
public Long incr(String key, long delta) {
if (delta < 0) {
throw new RuntimeException("递增因子必须大于0");
}
return redisTemplate.opsForValue().increment(key, delta);
}
/**
* 递减
*
* @param key 键
* @param delta 要减少几(小于0)
* @return long
*/
public Long decr(String key, long delta) {
if (delta < 0) {
throw new RuntimeException("递减因子必须大于0");
}
return redisTemplate.opsForValue().increment(key, -delta);
}
// ================================ Map =================================
/**
* HashGet
*
* @param key 键 不能为null
* @param item 项 不能为null
* @return 值
*/
public Object hget(String key, String item) {
return redisTemplate.opsForHash().get(key, item);
}
/**
* 获取hashKey对应的所有键值
*
* @param key 键
* @return 对应的多个键值
*/
public Map<Object, Object> hmget(String key) {
return redisTemplate.opsForHash().entries(key);
}
/**
* HashSet
*
* @param key 键
* @param map 对应多个键值
*/
public void hmset(String key, Map<String, Object> map) {
redisTemplate.opsForHash().putAll(key, map);
}
/**
* HashSet 并设置时间
*
* @param key 键
* @param map 对应多个键值
* @param time 时间(秒)
*/
public void hmset(String key, Map<String, Object> map, long time) {
redisTemplate.opsForHash().putAll(key, map);
if (time > 0) {
expire(key, time);
}
}
/**
* 向一张hash表中放入数据,如果不存在将创建
*
* @param key 键
* @param item 项
* @param value 值
*/
public void hset(String key, String item, Object value) {
redisTemplate.opsForHash().put(key, item, value);
}
/**
* 向一张hash表中放入数据,如果不存在将创建
*
* @param key 键
* @param item 项
* @param value 值
* @param time 时间(秒) 注意:如果已存在的hash表有时间,这里将会替换原有的时间
*/
public void hset(String key, String item, Object value, long time) {
redisTemplate.opsForHash().put(key, item, value);
if (time > 0) {
expire(key, time);
}
}
/**
* 删除hash表中的值
*
* @param key 键 不能为null
* @param item 项 可以使多个 不能为null
*/
public void hdel(String key, Object... item) {
redisTemplate.opsForHash().delete(key, item);
}
/**
* 判断hash表中是否有该项的值
*
* @param key 键 不能为null
* @param item 项 不能为null
* @return true 存在 false不存在
*/
public boolean hHasKey(String key, String item) {
return redisTemplate.opsForHash().hasKey(key, item);
}
/**
* hash递增 如果不存在,就会创建一个 并把新增后的值返回
*
* @param key 键
* @param item 项
* @param by 要增加几(大于0)
* @return double
*/
public double hincr(String key, String item, double by) {
return redisTemplate.opsForHash().increment(key, item, by);
}
/**
* hash递减
*
* @param key 键
* @param item 项
* @param by 要减少记(小于0)
* @return double
*/
public double hdecr(String key, String item, double by) {
return redisTemplate.opsForHash().increment(key, item, -by);
}
// ============================ set =============================
/**
* 根据key获取Set中的所有值
*
* @param key 键
* @return Set
*/
public Set<Object> sGet(String key) {
return redisTemplate.opsForSet().members(key);
}
/**
* 根据value从一个set中查询,是否存在
*
* @param key 键
* @param value 值
* @return Boolean
*/
public Boolean sHasKey(String key, Object value) {
return redisTemplate.opsForSet().isMember(key, value);
}
/**
* 将数据放入set缓存
*
* @param key 键
* @param values 值 可以是多个
* @return Long 成功个数
*/
public Long sSet(String key, Object... values) {
return redisTemplate.opsForSet().add(key, values);
}
/**
* 将set数据放入缓存
*
* @param key 键
* @param time 时间(秒)
* @param values 值可以是多个
* @return 成功个数
*/
public Long sSetAndTime(String key, long time, Object... values) {
try {
Long count = redisTemplate.opsForSet().add(key, values);
if (time > 0) {
expire(key, time);
}
return count;
} catch (Throwable e) {
return 0L;
}
}
/**
* 获取set缓存的长度
*
* @param key 键
* @return Long
*/
public Long sGetSetSize(String key) {
try {
return redisTemplate.opsForSet().size(key);
} catch (Throwable e) {
return 0L;
}
}
/**
* 移除值为value的
*
* @param key 键
* @param values 值可以是多个
* @return 移除的个数
*/
public Long setRemove(String key, Object... values) {
try {
return redisTemplate.opsForSet().remove(key, values);
} catch (Throwable e) {
return 0L;
}
}
// ===============================list=================================
/**
* 通过索引 获取list中的值
*
* @param key 键
* @param index 索引 index>=0时， 0 表头，1 第二个元素，依次类推；index<0时，-1，表尾，-2倒数第二个元素，依次类推
* @return Obj
*/
public Object lGetIndex(String key, long index) {
try {
return redisTemplate.opsForList().index(key, index);
} catch (Throwable e) {
return null;
}
}
/**
* 将list放入缓存
*
* @param key 键
* @param value 值
*/
public void lSet(String key, Object value) {
redisTemplate.opsForList().rightPush(key, value);
}
/**
* 将list放入缓存
*
* @param key 键
* @param value 值
* @param time 时间(秒)
*/
public void lSet(String key, Object value, long time) {
redisTemplate.opsForList().rightPush(key, value);
if (time > 0) {
expire(key, time);
}
}
/**
* 将list放入缓存
*
* @param key 键
* @param value 值
*/
public void lSet(String key, List<Object> value) {
redisTemplate.opsForList().rightPushAll(key, value);
}
/**
* 将list放入缓存
*
* @param key 键
* @param value 值
* @param time 时间(秒)
*/
public void lSet(String key, List<Object> value, long time) {
redisTemplate.opsForList().rightPushAll(key, value);
if (time > 0) {
expire(key, time);
}
}
/**
* 根据索引修改list中的某条数据
*
* @param key 键
* @param index 索引
* @param value 值
* @return boolean
*/
public boolean lUpdateIndex(String key, long index, Object value) {
try {
redisTemplate.opsForList().set(key, index, value);
return true;
} catch (Throwable e) {
return false;
}
}
/**
* 移除N个值为value
*
* @param key 键
* @param count 移除多少个
* @param value 值
* @return 移除的个数
*/
public Long lRemove(String key, long count, Object value) {
try {
return redisTemplate.opsForList().remove(key, count, value);
} catch (Throwable e) {
return 0L;
}
}
}
Swagger 配置
1.SwaggerConfig.java
import com.base.web.config.security.utils.JwtTokenUtils;
import lombok.AllArgsConstructor;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.env.Environment;
import org.springframework.core.env.Profiles;
import springfox.documentation.builders.ApiInfoBuilder;
import springfox.documentation.builders.ParameterBuilder;
import springfox.documentation.builders.PathSelectors;
import springfox.documentation.builders.RequestHandlerSelectors;
import springfox.documentation.schema.ModelRef;
import springfox.documentation.service.ApiInfo;
import springfox.documentation.service.Contact;
import springfox.documentation.service.Parameter;
import springfox.documentation.spi.DocumentationType;
import springfox.documentation.spring.web.plugins.Docket;
import springfox.documentation.swagger2.annotations.EnableSwagger2;
import java.util.*;
/**
* Swagger config
*
* @author ming
* @version 1.0.0
* @date 2020/04/15
**/
@Configuration
@EnableSwagger2
@AllArgsConstructor
public class SwaggerConfig {
private final SwaggerProperties properties;
/**
* frps-console (7000)
* frp_0.34.3_linux_386 (ali Centos 7)
* <p>
* Client
* cmd : frpc: frpc.exe -c frpc.ini
* <p>
* http://gua.esbug.com:7000/swagger-ui/index.html
* swagger-ui V3:
* http://localhost:8818/swagger-ui/index.html
* swagger-ui V2:
* http://localhost:8818/swagger-ui.html
*/
@Bean
public Docket createRestApi(Environment environment) {
//设置要显示swagger的环境
Profiles profiles = Profiles.of("uat", "dev");
//判断不同环境中profiles的布尔值,并将enable传到enable(enable)方法中
Boolean enable = environment.acceptsProfiles(profiles);
ParameterBuilder parameterBuilder = new ParameterBuilder();
List<Parameter> parameters = new ArrayList<>();
parameterBuilder.name(JwtTokenUtils.TOKEN_HEADER).description("令牌").modelRef(new ModelRef("string")).parameterType("header").required(false).build();
parameters.add(parameterBuilder.build());
return new Docket(DocumentationType.SWAGGER_2)
.pathMapping("/")
.groupName("通用模块")
.enable(enable)
// 将api的元信息设置为包含在json ResourceListing响应中。
.apiInfo(apiInfo())
// 选择哪些接口作为swagger的doc发布
.select()
.apis(RequestHandlerSelectors.basePackage(properties.getBasePackage()))
.paths(PathSelectors.any())
.build()
// 支持的通讯协议集合
.protocols(newHashSet("https", "http"))
.globalOperationParameters(parameters)
//.globalRequestParameters()
// 授权信息设置，必要的header token等认证信息
/*.securitySchemes(Collections.singletonList(securitySchema()))
// 授权信息全局应用
.securityContexts(Collections.singletonList(securityContext()))*/;
}
/**
* API 文档相关信息
*/
private ApiInfo apiInfo() {
return new ApiInfoBuilder()
.title(properties.getTitle())
.description(properties.getDescription())
.termsOfServiceUrl(properties.getUrl())
.version(properties.getVersion())
.contact(new Contact(properties.getContact().getName(), properties.getContact().getUrl(), properties.getContact().getEmail()))
.build();
}
@SafeVarargs
private final <T> Set<T> newHashSet(T... ts) {
if (ts.length > 0) {
return new LinkedHashSet<>(Arrays.asList(ts));
}
return null;
}
}
2.SwaggerContact.java
import lombok.Data;
/**
* @author ming
* @version 1.0.0
* @date 2021/1/5 10:44
**/
@Data
class SwaggerContact {
private String name;
private String url;
private String email;
}
3.SwaggerProperties.java
import lombok.Data;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.stereotype.Component;
/**
* @author ming
* @version 1.0.0
* @date 2021/1/5 10:14
**/
@ConfigurationProperties(prefix = "swagger-doc")
@Component
@Data
public class SwaggerProperties {
private String accessTokenKey;
private String basePackage;
private String title;
private String description;
private String url;
private String version;
private SwaggerContact contact;
}
4.自定义 yml 配置
###### swagger-ui ######
### doc
swagger-doc:
access-token-key: ""
base-package: "com.base.web.controller"
title: "基础服务API"
description: "基础服务API"
url: "http://localhost:${server.port}/swagger-ui.html"
version: "0.0.1"
contact:
name: "ming"
url: "http://www.itwetouch.com/"
email: "an23gn@163.com"
权限注解使用
不需要权限判断的开放的接口可以加入到核心配置的白名单中
@PreAuthorize("hasPermission('user','list')")
@GetMapping("list")
@ApiOperation(value = "用户列表", notes = "后台用户列表")
@ApiImplicitParams({
@ApiImplicitParam(name = "current", value = "当前页码", dataType = "int", paramType = "query", defaultValue = "1"),
@ApiImplicitParam(name = "size", value = "每页显示数", dataType = "int", paramType = "query", defaultValue = "10", example = "10", allowableValues = "10,20,40,60"),
@ApiImplicitParam(name = "userName", value = "用户名", dataType = "string", paramType = "query"),
@ApiImplicitParam(name = "telephone", value = "手机号", dataType = "string", paramType = "query"),
@ApiImplicitParam(name = "email", value = "邮箱", dataType = "string", paramType = "query"),
})
public ApiResponse getUserList(@RequestParam(name = "current", required = false, defaultValue = WebConstant.PAGE_NO) Integer current,
@RequestParam(name = "size", required = false, defaultValue = WebConstant.PAGE_SIZE) Integer size,
@RequestParam(name = "userName", required = false, defaultValue = "") String userName,
@RequestParam(name = "telephone", required = false, defaultValue = "") String telephone,
@RequestParam(name = "email", required = false, defaultValue = "") String email) {
return userService.userList(current, size, userName, telephone, email);
}
登录接口
@PostMapping("login")
@ApiOperation(value = "登录", notes = "用户登录(支持用户名/手机号码/邮箱)")
@ApiImplicitParams({
@ApiImplicitParam(name = "username", value = "用户名", dataType = "string", paramType = "query", required = true, defaultValue = "admin"),
@ApiImplicitParam(name = "password", value = "密码", dataType = "string", paramType = "query", required = true, defaultValue = "123456")
})
public void login(@RequestParam(name = "username") String username,
@RequestParam(name = "password") String password) throws Exception {
// nothing to do
}
登出接口
@PostMapping("logout")
@ApiOperation(value = "登出", notes = "用户登出")
@ResponseStatus(HttpStatus.OK)
public void logout() throws Exception {
// nothing to do
}
欢迎来到这里！
我们正在构建一个小众社区，大家在这里相互信任，以平等 • 自由 • 奔放的价值观进行分享交流。最终，希望大家能够找到与自己志同道合的伙伴，共同成长。
注册 关于