spring boot之 springSecurity 结合JWT

package shang.handle;

import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.stereotype.Component;
import shang.entity.JsonMsg;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * @Auther: Administrator
 * @Date: 2021/2/21 19:49
 * @Description:这里为了之后结果更直观，自定义一个AuthenticationEntryPoint，
 * 用于在未登录是访问接口返回json而不是login.html
 * 当未登录或者token失效访问接口时，自定义的返回结果
 */
@Component
public class RestAuthenticationEntryPoint  implements AuthenticationEntryPoint
{
      @Override
      public void commence(HttpServletRequest httpServletRequest,
                           HttpServletResponse response, AuthenticationException e) throws IOException, ServletException
      {
            response.setCharacterEncoding("UTF-8");//设置编码格式
            response.setContentType("application/json");
            JsonMsg jsonMsg =new JsonMsg ();
            jsonMsg.setMsg (" AuthenticationException 【尚未登录，或者登录过期】触发了-->"+e.getMessage());
            jsonMsg.setStatusCode (403);
            //Jackson
            ObjectMapper mapper = new ObjectMapper ();
            String msgJson=mapper.writeValueAsString (jsonMsg);
            //response.getWriter().println(JSON.toJSONString(Result.error().message("尚未登录，或者登录过期   " + e.getMessage())));
            response.getWriter ().print (msgJson);
            response.getWriter().flush();
      }
}

package shang.handle;

import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import shang.entity.JsonMsg;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * @Auther: 三尾鱼
 * @Date: 2021/2/19 14:54
 * @Description:
 */
public class 登录失败处理器 implements AuthenticationFailureHandler
{
    private String url;


    public 登录失败处理器(String url)
    {
        this.url = url;
    }

    @Override
    public void onAuthenticationFailure(HttpServletRequest httpServletRequest,
                                        HttpServletResponse httpServletResponse,
                                        AuthenticationException e) throws IOException, ServletException
    {
        //httpServletResponse.sendRedirect (url);
        JsonMsg jsonMsg =new JsonMsg ();
        jsonMsg.setMsg ("自定义失败处理器 onAuthenticationFailure 触发了");
        jsonMsg.setStatusCode (302);
        //Jackson
        ObjectMapper mapper = new ObjectMapper ();

        String msgJson=mapper.writeValueAsString (jsonMsg);
        //有中文乱码，设置一下
        httpServletResponse.setHeader("Content-type", "application/json;charset=UTF-8");

        //OutputStream ps = httpServletResponse.getOutputStream ();
        //这句话的意思，使得放入流的数据是utf8格式
        //ps.write (personJson.getBytes (StandardCharsets.UTF_8));
        httpServletResponse.getWriter ().print (msgJson);
        //httpServletResponse.sendRedirect (url);
    }
}

package shang.handle;

import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import shang.entity.JsonMsg;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * @Auther: 三尾鱼
 * @Date: 2021/2/19 14:36
 * @Description:
 */
public class 登录成功处理器 implements AuthenticationSuccessHandler
{
    private String url;

    public 登录成功处理器(String url)
    {
        this.url = url;
    }

    /*@Override
    public void onAuthenticationSuccess(HttpServletRequest request,
                                        HttpServletResponse response,
                                        FilterChain chain,
                                        Authentication authentication) throws IOException, ServletException
    {

    }*/

    @Override
    public void onAuthenticationSuccess(HttpServletRequest httpServletRequest,
                                        HttpServletResponse httpServletResponse,
                                        Authentication authentication) throws IOException, ServletException
    {
        User user = (User) authentication.getPrincipal ();
        System.out.println (user.getUsername ());
        System.out.println (user.getPassword ());
        System.out.println (user.getAuthorities ());//权限列表，就是UserDetailsServiceImpl放进去的【权限、角色】 数据

        System.out.println (httpServletRequest.getRemoteAddr ());

        JsonMsg jsonMsg =new JsonMsg ();
        jsonMsg.setMsg ("onAuthenticationSuccess 触发了--token:"+"abcd1234admin");
        jsonMsg.setStatusCode (200);
        //Jackson
        ObjectMapper mapper = new ObjectMapper ();

        String personJson=mapper.writeValueAsString (jsonMsg);
        //有中文乱码，设置一下
        httpServletResponse.setHeader("Content-type", "application/json;charset=UTF-8");

        //OutputStream ps = httpServletResponse.getOutputStream ();
        //这句话的意思，使得输出流的数据是utf8格式
        //ps.write (personJson.getBytes (StandardCharsets.UTF_8));
        httpServletResponse.getWriter ().print (personJson);

        //httpServletResponse.sendRedirect (url);
    }
}

package shang.handle;

import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.security.access.AccessDecisionManager;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.web.access.AccessDeniedHandler;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;
import java.util.HashMap;
import java.util.Map;

/**
 * @Auther: 三尾鱼
 * @Date: 2021/2/19 17:26
 * @Description: 前后端分离的开发 都是要返回JSON
 */
public  class 鉴权失败处理器 implements AccessDeniedHandler
{
    @Override
    public void handle(HttpServletRequest httpServletRequest,
                       HttpServletResponse httpServletResponse,
                       AccessDeniedException e) throws IOException, ServletException
    {
        httpServletResponse.setStatus (httpServletResponse.SC_FORBIDDEN);//403

        //有中文乱码，设置一下
        httpServletResponse.setHeader("Content-type", "application/json;charset=UTF-8");
        PrintWriter pw=httpServletResponse.getWriter ();
        Map<String,Object> map=new HashMap<String,Object> ();
        map.put ("status",403);
        map.put ("msg", "权限不够，请联系管理员");
        ObjectMapper mapper = new ObjectMapper ();

        String JsonStr=mapper.writeValueAsString(map);
        pw.write (JsonStr);
        //pw.write ("{\"status\":\"error\",\"msg\":\"权限不够，请联系管理员\"}  ");
        pw.flush ();
        pw.close();
    }
}

package shang.service;

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;

import java.util.Date;

/**
 * @Auther: Administrator
 * @Date: 2021/2/21 19:37
 * @Description:
 */

@Component
public class JwtUtils
{
      private static final String CLAIM_KEY_USERNAME = "sub";
      private static final String CLAIM_KEY_CREATED = "created";
      @Value("${jwt.secret}")
      private String secret;
      @Value("${jwt.expiration}")
      private Long expiration;

      // 创建token
      public String generateToken(String username)
      {
            return Jwts.builder ()
                    .signWith (SignatureAlgorithm.HS512, secret)
                    .setSubject (username)
                    .setIssuedAt (new Date ())
                    .setExpiration (new Date (System.currentTimeMillis () + expiration * 1000))
                    .compact ();

      }

      // 从token中获取用户名
      public String getUserNameFromToken(String token)
      {
            return getTokenBody (token).getSubject ();
      }

      // 是否已过期
      public boolean isExpiration(String token)
      {
            return getTokenBody (token).getExpiration ().before (new Date ());
      }

      private Claims getTokenBody(String token)
      {
            return Jwts.parser ()
                    .setSigningKey (secret)
                    .parseClaimsJws (token)
                    .getBody ();
      }
}

package shang.service;


import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;

/**
 * @Auther: 三尾鱼
 * @Date: 2020/11/24 12:20
 * @Description:
 * USE ipranDB
 * GO
 * CREATE UNIQUE NONCLUSTERED               --唯一 非聚集
 * INDEX  username_唯一_user on         --索引名称
 * [ipranDB].[dbo].[user]   --表名称
 * (username)                  -- 表的字段名称CREATE UNIQUE NONCLUSTERED               --唯一 非聚集
 * GO
 *
 */
@Service
public class UserDetailsServiceImpl implements UserDetailsService
{
    @Autowired
    PasswordEncoder passwordEncoder;
    @Override
    public UserDetails loadUserByUsername(String username
                                            //username 是前端传递过来的
                                         ) throws UsernameNotFoundException
    {
        System.out.println ("执行了自定义登录逻辑！！");
        //这里注入数据库访问类，可以改造成按数据库验证账号和口令
        //需要从数据库获取的信息有：1、用户名，2、加密后的口令 3、权限因子或角色

        //1、根据用户名到数据库去查询，返回UserDetails的实现类
        /*User user;
        if (user == null)
        {
            throw new UsernameNotFoundException ("用户不存在！");
        }*/

        if(!"admin".equals (username)){
            throw new UsernameNotFoundException ("用户不存在！");
        }

        //2、比较密码（注册时已经加密过），如果匹配成功返回UserDetails，
        String password=passwordEncoder.encode("123");
        //从数据库获取当前用户的所有角色
        //3、这里的user是org.springframework.security.core.userdetails.User 它实现了UserDetails接口
        //这里的"admin,normal"是权限因子，如果是角色，必须是【ROLE_】前缀开头，例如  ROLE_admin,ROLE_user
        return new User (username, password, AuthorityUtils.commaSeparatedStringToAuthorityList
                ("admin,normal,ROLE_admin,ROLE_user,/toSuccess,/insert,/delete"));
        //user.setRoles (userMapper.getUserRolesByUid (user.getId ()));
        //return user;
    }
}

package shang.service;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Service;

import javax.servlet.http.HttpServletRequest;
import java.util.Collection;

/**
 * @Auther: 三尾鱼
 * @Date: 2021/2/20 09:34
 * @Description:
 */
@Service
public class MyAccessControImpl implements I自定义权限控制接口
{
    //类名，不可写中文，否则配置不进去
    @Override
    public boolean hasPermission(HttpServletRequest request,
                                 Authentication authentication)
    {
        Object principal = authentication.getPrincipal ();
        if (principal instanceof UserDetails)
        {
            UserDetails userDetails = (UserDetails) principal;
            //获取当前登录用户的授权集合列表
            Collection<? extends GrantedAuthority> authorities = userDetails.getAuthorities ();
            return authorities.contains (new SimpleGrantedAuthority (request.getRequestURI ()));//基于访问URL的权限控制
        }

        return false;
    }
}

spring:
  datasource:
    driver-class-name: com.mysql.cj.jdbc.Driver

      #指定url，xxx是数据库的名字，serverTimezone=Asia/Shanghai 解决时区问题，&useUnicode=true&characterEncoding=utf-8指定字符的编码集
#      jdbc-url: jdbc:mysql://localhost:3306/ipran_db?serverTimezone=Asia/Shanghai&useUnicode=true&characterEncoding=utf-8
#      username: root
#      password: aatl?451
    url: jdbc:mysql://localhost:3306/ipran_db?serverTimezone=Asia/Shanghai&useUnicode=true&characterEncoding=utf-8
    username: root
    password: aatl?451

jwt:
  tokenHeader: Authorization #JWT存储的请求头
  secret: my-springsecurity-plus #JWT加解密使用的密钥
  expiration: 604800 #JWT的超期限时间(60*60*24*7)
  tokenHead: ‘Bearer ‘ #JWT负载中拿到开头，空格别忘了