示例项目地址: https://git.code.tencent.com/xinzhang0618/oa.git
参考文档:
使用JDK生成公钥: https://blog.csdn.net/mmingxiang/article/details/108611390
公钥的使用: https://blog.csdn.net/qq_15973399/article/details/106903103

实现思路

(使用oauth2+jwt+gateway+rsa)
做认证主要是登录, 访问刷新, token过期, 登出

  1. 登录, 前端组装oauth2的url访问gateway, 直接跳转auth服务获取token;
  2. 访问刷新, gateway添加后置过滤器, 当token快过期时, 重新请求auth服务获取token, 请求头添加token刷新的事件, 前端接收后刷新token
  3. token过期, jwt过期
  4. 登录, redis添加token的黑名单, 过期时间为token的过期时间, 每次访问校验token不能存在于黑名单

尴尬点:

  1. oauth2本用作第三方登录, 用在这里只为做一个token生成器, 若应用有多个前端(web, app等), 则更有应用场景一些; 且oauth2有诸多限制, 获取token以及刷新有固定的url, 导致appSecret暴露在url且刷新极为不便; 导致这套体系之下, token的刷新使用”重新获取”更便利些; 所以, 建议在一般的分布式认证中, 直接用jwt就够了
  2. 在gateway重新获取token依然不便, 不能将用户密码以及appSecret等暴露在jwt中, 因此重新获取token, 还是需要在gateway请求auth服务拿到用户以及客户端信息, 然后拼接url重新请求oauth2
  3. jwt是无状态的, 但是用户登陆必须要可以登出; 此处有两种方案, 一是利用短时效的token, 允许用户登出后token依然有效; 另一种就是借助redis给token加上过期的状态, 但每次访问就都要走redis校验了
  4. 此外oauth2的sso方案之前尝试过, 配置虽然简单, 但资源服务器会在每次请求时都访问鉴权服务器以校验token, 增加了延时, 不建议用
  5. 纯吐槽, oauth2的配置网上的版本颇多, 甚至不同依赖不同配置, 坑也非常非常多, 这部分我尽量写详细

配置解析

项目采用通用的结构

  • auth-认证鉴权服务
  • gateway-网关
  • web-资源服务

    认证鉴权服务

    1. <!--oauth2-->
    2.   <dependency>
    3.     <groupId>org.springframework.cloud</groupId>
    4.     <artifactId>spring-cloud-starter-oauth2</artifactId>
    5.     <version>Greenwich.SR3</version>
    6.   </dependency>
    7. <!--jwt-->
    8.   <dependency>
    9.     <groupId>com.auth0</groupId>
    10.     <artifactId>java-jwt</artifactId>
    11.     <version>3.10.3</version>
    12.   </dependency>
    AuthServerConfig, oauth2认证服务器配置
  1. @EnableResourceServer, @EnableAuthorizationServer俩注解都不能掉, 它是认证服务器的同事也是资源服务器, 这样才能保证携带token能访问auth服务(便于后续的token刷新/重新获取)
  2. auth服务存放.jks文件(gateway存放pubkey.txt), 至于秘钥库和公钥的生成, 以及配置, 详见文档顶部的参考文档
  3. 自定义客户端的获取(oauth2的客户端模式通用)—>CustomClientDetailsService, 自定义用户信息的获取(oauth2的密码模式通用)—>CustomUserDetailsService, JWT的使用—>JWTTokenEnhancer
  4. AuthenticationManager这个bean一定要定义, 参见下方WebSecurityConfig中定义了 ```java package top.xinzhang0618.oa.config;

import java.security.KeyPair; import java.util.ArrayList; import java.util.List;

import org.springframework.beans.factory.annotation.Autowired; import org.springframework.cloud.bootstrap.encrypt.KeyProperties; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.http.HttpHeaders; import org.springframework.http.HttpMethod; import org.springframework.http.ResponseEntity; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.oauth2.common.exceptions.OAuth2Exception; import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer; import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter; import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer; import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer; import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer; import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer; import org.springframework.security.oauth2.provider.error.DefaultWebResponseExceptionTranslator; import org.springframework.security.oauth2.provider.error.WebResponseExceptionTranslator; import org.springframework.security.oauth2.provider.token.TokenEnhancer; import org.springframework.security.oauth2.provider.token.TokenEnhancerChain; import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter; import org.springframework.security.oauth2.provider.token.store.JwtTokenStore; import org.springframework.security.oauth2.provider.token.store.KeyStoreKeyFactory;

import javax.annotation.Resource;

/**

  • oauth2认证服务器配置 *
  • @author xinzhang

  • @date 2020/11/16 17:19 */ @Configuration @EnableAuthorizationServer @EnableResourceServer public class AuthServerConfig extends AuthorizationServerConfigurerAdapter { @Resource(name = “keyProp”) private KeyProperties keyProperties;

    @Bean(“keyProp”) public KeyProperties keyProperties() {

    1.  return new KeyProperties();

    }

    @Autowired private AuthenticationManager authenticationManager; @Autowired private JWTTokenEnhancer jwtTokenEnhancer; @Autowired private CustomClientDetailsService clientDetailsService; @Autowired private CustomUserDetailsService userDetailsService;

// /* // 辅助排查问题, 保留 // @return // / // @Bean // public WebResponseExceptionTranslator loggingExceptionTranslator() { // return new DefaultWebResponseExceptionTranslator() { // @Override // public ResponseEntity translate(Exception e) throws Exception { // e.printStackTrace(); // ResponseEntity responseEntity = super.translate(e); // HttpHeaders headers = new HttpHeaders(); // headers.setAll(responseEntity.getHeaders().toSingleValueMap()); // OAuth2Exception excBody = responseEntity.getBody(); // return new ResponseEntity<>(excBody, headers, responseEntity.getStatusCode()); // } // }; // }

  1. @Bean
  2. public JwtAccessTokenConverter accessTokenConverter() {
  3.     JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
  4.     KeyPair keyPair = (new KeyStoreKeyFactory(this.keyProperties.getKeyStore().getLocation(),
  5.             this.keyProperties.getKeyStore().getSecret().toCharArray())).getKeyPair(this.keyProperties.getKeyStore().getAlias(),
  6.             this.keyProperties.getKeyStore().getPassword().toCharArray());
  7.     converter.setKeyPair(keyPair);
  8.     return converter;
  9. }
  11. @Bean
  12. public JwtTokenStore jwtTokenStore() {
  13.     return new JwtTokenStore(accessTokenConverter());
  14. }
  17. @Override
  18. public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
  19.     TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain();
  20.     List<TokenEnhancer> enhancers = new ArrayList<>(2);
  21.     enhancers.add(jwtTokenEnhancer);
  22.     enhancers.add(accessTokenConverter());
  23.     tokenEnhancerChain.setTokenEnhancers(enhancers);
  24.     endpoints.tokenStore(jwtTokenStore())
  25.             .tokenEnhancer(tokenEnhancerChain)
  26.             .authenticationManager(authenticationManager)
  27.             .accessTokenConverter(accessTokenConverter())
  28.             .userDetailsService(userDetailsService)
  29.             .allowedTokenEndpointRequestMethods(HttpMethod.GET, HttpMethod.POST);

// .exceptionTranslator(loggingExceptionTranslator());

  1. }
  4. @Override
  5. public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
  6.     oauthServer.tokenKeyAccess("permitAll()")
  7.             .checkTokenAccess("permitAll()")
  8.             .allowFormAuthenticationForClients();
  9. }
  11. @Override
  12. public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
  13.     clients.withClientDetails(clientDetailsService);
  14. }

}

  1. **WebSecurityConfig, web安全配置**
  3. 1. PasswordEncoder这个bean**一定要定义**
  4. 1. AuthenticationManager这个bean**一定要定义**
  5. ```java
  6. package top.xinzhang0618.oa.config;
  8. import org.springframework.context.annotation.Bean;
  9. import org.springframework.context.annotation.Configuration;
  10. import org.springframework.security.authentication.AuthenticationManager;
  11. import org.springframework.security.config.BeanIds;
  12. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  13. import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  14. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  15. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  16. import org.springframework.security.crypto.password.NoOpPasswordEncoder;
  17. import org.springframework.security.crypto.password.PasswordEncoder;
  19. /**
  20.  * @author xinzhang
  21.  * @date 2020/11/16 18:13
  22.  */
  23. @Configuration
  24. public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  26.     @Bean
  27.     public PasswordEncoder passwordEncoder() {
  28.         return new BCryptPasswordEncoder();
  29.     }
  31.     @Bean
  32.     @Override
  33.     protected AuthenticationManager authenticationManager() throws Exception {
  34.         return super.authenticationManager();
  35.     }
  37.     @Override
  38.     protected void configure(HttpSecurity http) throws Exception {
  39.         http.authorizeRequests()
  40.                 .antMatchers("/auth/oauth/**").permitAll()
  41.                 .and()
  42.                 .csrf().disable();
  43.     }
  44. }

上面俩爹已经搞定了, 剩余的配置基本就贴代码了, 比较简单, 不多说
CustomClientDetailsService, 注意客户端密码加密

  1. package top.xinzhang0618.oa.config;
  3. import java.util.Arrays;
  4. import java.util.Collections;
  6. import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
  7. import org.springframework.beans.factory.annotation.Autowired;
  8. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  9. import org.springframework.security.oauth2.provider.ClientDetails;
  10. import org.springframework.security.oauth2.provider.ClientDetailsService;
  11. import org.springframework.security.oauth2.provider.ClientRegistrationException;
  12. import org.springframework.security.oauth2.provider.client.BaseClientDetails;
  13. import org.springframework.stereotype.Service;
  14. import top.xinzhang0618.oa.domain.base.Client;
  15. import top.xinzhang0618.oa.service.base.ClientService;
  17. /**
  18.  * @author xinzhang
  19.  * @date 2020/11/16 18:05
  20.  */
  21. @Service
  22. public class CustomClientDetailsService implements ClientDetailsService {
  23.     @Autowired
  24.     private ClientService clientService;
  26.     @Override
  27.     public ClientDetails loadClientByClientId(String appKey) throws ClientRegistrationException {
  28.         Client client = clientService.getOne(new LambdaQueryWrapper<Client>().eq(Client::getAppKey, appKey));
  29.         BaseClientDetails clientDetails = new BaseClientDetails();
  30.         clientDetails.setClientId(appKey);
  31.         clientDetails.setClientSecret( new BCryptPasswordEncoder().encode(client.getAppSecret()));
  32.         clientDetails.setAuthorizedGrantTypes(Arrays.asList(client.getGrantType().split(",")));
  33.         clientDetails.setScope(Collections.singletonList("all"));
  34.         clientDetails.setAccessTokenValiditySeconds(client.getTokenValidityHours() * 60 * 60);
  35.         clientDetails.setRefreshTokenValiditySeconds(client.getRefreshTokenValidityHours() * 60 * 60);
  36.         return clientDetails;
  37.     }
  38. }

客户端表结构设计

  1. CREATE TABLE `oa_client` (
  2.   `client_id` bigint(20) unsigned NOT NULL COMMENT '客户端id',
  3.   `created_time` datetime NOT NULL COMMENT '创建时间',
  4.   `modified_time` datetime NOT NULL COMMENT '更新时间',
  5.   `tenant_id` bigint(20) unsigned NOT NULL COMMENT '租户id',
  6.   `is_deleted` tinyint(1) NOT NULL DEFAULT '0' COMMENT '是否删除',
  7.   `app_key` varchar(50) NOT NULL COMMENT '应用key',
  8.   `app_secret` varchar(100) NOT NULL COMMENT '应用密码',
  9.   `grant_type` varchar(200) NOT NULL COMMENT '授权类型',
  10.   `token_validity_hours` int(11) NOT NULL COMMENT 'token有效期',
  11.   `refresh_token_validity_hours` int(11) NOT NULL COMMENT 'refreshToken有效期',
  12.   PRIMARY KEY (`client_id`)
  13. ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='客户端';

CustomUserDetailsService, 注意用户名密码加密, 以及此处权限的处理

  1. package top.xinzhang0618.oa.config;
  3. import java.util.List;
  4. import java.util.Set;
  5. import java.util.stream.Collectors;
  7. import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
  8. import org.springframework.beans.factory.annotation.Autowired;
  9. import org.springframework.security.core.authority.SimpleGrantedAuthority;
  10. import org.springframework.security.core.userdetails.UserDetails;
  11. import org.springframework.security.core.userdetails.UserDetailsService;
  12. import org.springframework.security.core.userdetails.UsernameNotFoundException;
  13. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  14. import org.springframework.security.crypto.password.PasswordEncoder;
  15. import org.springframework.stereotype.Service;
  16. import top.xinzhang0618.oa.Assert;
  17. import top.xinzhang0618.oa.domain.base.User;
  18. import top.xinzhang0618.oa.service.base.PrivilegeService;
  19. import top.xinzhang0618.oa.service.base.UserService;
  21. import javax.annotation.Resource;
  23. /**
  24.  * @author xinzhang
  25.  * @date 2020/11/16 17:53
  26.  */
  27. @Service
  28. public class CustomUserDetailsService implements UserDetailsService {
  29.     @Autowired
  30.     private UserService userService;
  31.     @Autowired
  32.     private PrivilegeService privilegeService;
  34.     @Override
  35.     public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {
  36.         User user = userService.getOne(new LambdaQueryWrapper<User>()
  37.                         .eq(User::getUserName, userName)
  38.                         .eq(User::isEnable, true));
  39.         if (Assert.isNull(user)) {
  40.             throw new UsernameNotFoundException("用户不存在");
  41.         }
  42. //        String encode = new BCryptPasswordEncoder().encode(user.getPassword());
  43.         user.setPassword( new BCryptPasswordEncoder().encode(user.getPassword()));
  44.         List<Long> privileges = privilegeService.listUserPrivileges(user.getUserId());
  45.         Set<SimpleGrantedAuthority> authorities =
  46.                 privileges.stream().map(p -> new SimpleGrantedAuthority(String.valueOf(privileges))).collect(Collectors.toSet());
  47.      return new UserBO(user,authorities);
  48.     }
  49. }

UserBO

  1. package top.xinzhang0618.oa.config;
  3. import org.springframework.security.core.GrantedAuthority;
  4. import org.springframework.security.core.userdetails.UserDetails;
  5. import top.xinzhang0618.oa.domain.base.User;
  7. import java.util.Collection;
  8. import java.util.Set;
  10. /**
  11.  * @author xinzhang
  12.  * @date 2020/11/17 19:28
  13.  */
  14. public class UserBO implements UserDetails {
  15.     public UserBO(User user, Collection<? extends GrantedAuthority> authorities) {
  16.         this.userId = user.getUserId();
  17.         this.userName = user.getUserName();
  18.         this.password = user.getPassword();
  19.     }
  21.     private Long userId;
  22.     private String userName;
  23.     private String password;
  24.     private String tenantId;
  25.     private Collection<? extends GrantedAuthority> authorities;
  27.     @Override
  28.     public Collection<? extends GrantedAuthority> getAuthorities() {
  29.         return this.authorities;
  30.     }
  32.     @Override
  33.     public String getPassword() {
  34.         return this.password;
  35.     }
  37.     @Override
  38.     public String getUsername() {
  39.         return this.userName;
  40.     }
  42.     @Override
  43.     public boolean isAccountNonExpired() {
  44.         return true;
  45.     }
  47.     @Override
  48.     public boolean isAccountNonLocked() {
  49.         return true;
  50.     }
  52.     @Override
  53.     public boolean isCredentialsNonExpired() {
  54.         return true;
  55.     }
  57.     @Override
  58.     public boolean isEnabled() {
  59.         return true;
  60.     }
  62.     public Long getUserId() {
  63.         return userId;
  64.     }
  66.     public void setUserId(Long userId) {
  67.         this.userId = userId;
  68.     }
  70.     public String getUserName() {
  71.         return userName;
  72.     }
  74.     public void setUserName(String userName) {
  75.         this.userName = userName;
  76.     }
  78.     public void setPassword(String password) {
  79.         this.password = password;
  80.     }
  82.     public void setAuthorities(Collection<? extends GrantedAuthority> authorities) {
  83.         this.authorities = authorities;
  84.     }
  86.     public String getTenantId() {
  87.         return tenantId;
  88.     }
  90.     public void setTenantId(String tenantId) {
  91.         this.tenantId = tenantId;
  92.     }
  93. }

其余
AuthController

  1. package top.xinzhang0618.oa;
  3. import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
  4. import org.springframework.beans.factory.annotation.Autowired;
  5. import org.springframework.data.redis.core.RedisTemplate;
  6. import org.springframework.security.oauth2.common.OAuth2AccessToken;
  7. import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
  8. import org.springframework.security.oauth2.provider.token.store.JwtTokenStore;
  9. import org.springframework.web.bind.annotation.*;
  10. import top.xinzhang0618.oa.bo.auth.AuthInfoBO;
  11. import top.xinzhang0618.oa.constant.AuthConstant;
  12. import top.xinzhang0618.oa.domain.base.Client;
  13. import top.xinzhang0618.oa.domain.base.User;
  14. import top.xinzhang0618.oa.service.base.ClientService;
  15. import top.xinzhang0618.oa.service.base.UserService;
  17. import java.time.LocalDateTime;
  18. import java.util.concurrent.TimeUnit;
  20. /**
  21.  * @author xinzhang
  22.  * @date 2020/11/19 14:19
  23.  */
  24. @RestController
  25. public class AuthController {
  26.     @Autowired
  27.     private UserService userService;
  28.     @Autowired
  29.     private ClientService clientService;
  30.     @Autowired
  31.     private RedisTemplate<String, Object> redisTemplate;
  32.     @Autowired
  33.     private JwtAccessTokenConverter accessTokenConverter;
  35.     @GetMapping("/info/{appKey}/{userId}")
  36.     public AuthInfoBO getAuthInfo(@PathVariable("appKey") String appKey, @PathVariable("userId") Long userId) {
  37.         User user = userService.getById(userId);
  38.         Client client = clientService.getOne(new LambdaQueryWrapper<Client>().eq(Client::getAppKey, appKey));
  39.         AuthInfoBO authInfoBO = new AuthInfoBO();
  40.         authInfoBO.setUserName(user.getUserName());
  41.         authInfoBO.setPassword(user.getPassword());
  42.         authInfoBO.setAppKey(client.getAppKey());
  43.         authInfoBO.setAppSecret(client.getAppSecret());
  44.         return authInfoBO;
  45.     }
  47.     @PostMapping("/exit")
  48.     public void logout(@RequestHeader("Authorization") String authorization) {
  49.         String token = authorization.replace(AuthConstant.TOKEN_PREFIX, "");
  50.         OAuth2AccessToken oAuth2AccessToken = new JwtTokenStore(accessTokenConverter).readAccessToken(token);
  51.         String key = AuthConstant.TOKEN_BLACK_LIST_PREFIX + authorization;
  52.         redisTemplate.opsForValue().set(key, LocalDateTime.now().toString());
  53.         redisTemplate.expire(key, oAuth2AccessToken.getExpiresIn(), TimeUnit.SECONDS);
  54.     }
  55. }

.jks的配置

  1. encrypt:
  2.   key-store:
  3.     location: classpath:config/oa.jks
  4.     secret: xxx
  5.     alias: xx
  6.     password: xxx

获取token的路径示例
注意其中客户端以及密码均采用密文

  1. http://localhost:40002/auth/oauth/token?grant_type=password&client_id=test&client_secret=$2a$10$ATXY1ablVzcML1aNFkZrbuD3oVvddBw62JXfOSZ4zQgrJAOqOfOM2&username=test&password=$2a$10$ATXY1ablVzcML1aNFkZrbuD3oVvddBw62JXfOSZ4zQgrJAOqOfOM2

image.png

网关

  1.  <!--webflux-->
  2.         <dependency>
  3.             <groupId>org.springframework.boot</groupId>
  4.             <artifactId>spring-boot-starter-webflux</artifactId>
  5.         </dependency>
  6.         <!--gateway-->
  7.         <dependency>
  8.             <groupId>org.springframework.cloud</groupId>
  9.             <artifactId>spring-cloud-starter-gateway</artifactId>
  10.         </dependency>
  11.          <!--oauth2-->
  12.         <dependency>
  13.             <groupId>org.springframework.cloud</groupId>
  14.             <artifactId>spring-cloud-starter-oauth2</artifactId>
  15.         </dependency>
  16.         <dependency>
  17.             <groupId>org.springframework.security</groupId>
  18.             <artifactId>spring-security-oauth2-resource-server</artifactId>
  19.         </dependency>
  1. spring:
  2.   cloud:
  3.     gateway:
  4.       routes:
  5.         # web服务路由
  6.         - id: web-router
  7.           uri: lb://WEB
  8.           predicates:
  9.           - Path=/api/**
  10.         # auth服务路由
  11.         - id: auth-router
  12.           uri: lb://AUTH
  13.           predicates:
  14.           - Path=/auth/**
  15.   redis:
  16.     host: 39.106.55.179
  17.     port: 6379
  18.     database: 0
  19.     password: xxx
  20. hystrix:
  21.   command:
  22.     default:
  23.       execution:
  24.         isolation:
  25.           thread:
  26.             timeoutInMilliseconds: 5000

以下的几个核心配置类相当僵硬, 稍有改动可能会导致Bean加载顺序出问题而报错, 但仍有优化空间
ResourceServerConfig, oauth2资源服务器配置

  1. 配置全局跨域
  2. gateway存放pubkey.txt(auth服务存放.jks文件), 配置token转换器方便解析token
  3. 注册权限验证器ReactiveAuthenticationManager和认证验证器ReactiveAuthorizationManager ```java package top.xinzhang0618.oa.config;

import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.data.redis.core.RedisTemplate; import org.springframework.http.HttpHeaders; import org.springframework.http.HttpMethod; import org.springframework.http.HttpStatus; import org.springframework.http.server.reactive.ServerHttpRequest; import org.springframework.http.server.reactive.ServerHttpResponse; import org.springframework.security.authentication.ReactiveAuthenticationManager; import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity; import org.springframework.security.config.web.server.SecurityWebFiltersOrder; import org.springframework.security.config.web.server.ServerHttpSecurity; import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter; import org.springframework.security.oauth2.provider.token.store.JwtTokenStore; import org.springframework.security.oauth2.server.resource.web.server.ServerBearerTokenAuthenticationConverter; import org.springframework.security.web.server.SecurityWebFilterChain; import org.springframework.security.web.server.authentication.AuthenticationWebFilter; import org.springframework.web.cors.reactive.CorsUtils; import org.springframework.web.server.ServerWebExchange; import org.springframework.web.server.WebFilter; import org.springframework.web.server.WebFilterChain; import reactor.core.publisher.Mono; import top.xinzhang0618.oa.util.FileUtils;

/**

  • @author xinzhang

  • @date 2020/11/17 19:43 */ @Configuration @EnableWebFluxSecurity public class ResourceServerConfig {

    private static final String MAX_AGE = “18000L”;

    @Autowired private AccessManager accessManager; @Autowired private RedisTemplate redisTemplate;

    /**

    • 跨域配置 */ public WebFilter corsFilter() { return (ServerWebExchange ctx, WebFilterChain chain) -> {

      1.  ServerHttpRequest request = ctx.getRequest();
      2.  if (CorsUtils.isCorsRequest(request)) {
      3.      HttpHeaders requestHeaders = request.getHeaders();
      4.      ServerHttpResponse response = ctx.getResponse();
      5.      HttpMethod requestMethod = requestHeaders.getAccessControlRequestMethod();
      6.      HttpHeaders headers = response.getHeaders();
      7.      headers.add(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, requestHeaders.getOrigin());
      8.      headers.addAll(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS,
      9.              requestHeaders.getAccessControlRequestHeaders());
      10.      if (requestMethod != null) {
      11.          headers.add(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, requestMethod.name());
      12.      }
      13.      headers.add(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
      14.      headers.add(HttpHeaders.ACCESS_CONTROL_EXPOSE_HEADERS, "*");
      15.      headers.add(HttpHeaders.ACCESS_CONTROL_MAX_AGE, MAX_AGE);
      16.      if (request.getMethod() == HttpMethod.OPTIONS) {
      17.          response.setStatusCode(HttpStatus.OK);
      18.          return Mono.empty();
      19.      }
      20.  }
      21.  return chain.filter(ctx);

      }; }

      @Bean public JwtAccessTokenConverter accessTokenConverter() { JwtAccessTokenConverter converter = new JwtAccessTokenConverter(); converter.setVerifierKey(FileUtils.read(“config/pubkey.txt”)); return converter; }

      @Bean SecurityWebFilterChain webFluxSecurityFilterChain(ServerHttpSecurity http) { //token管理器-jwt实现类 ReactiveAuthenticationManager tokenAuthenticationManager =

      1.      new JwtAuthenticationManager(new JwtTokenStore(accessTokenConverter()),redisTemplate);

      //认证过滤器 AuthenticationWebFilter authenticationWebFilter = new AuthenticationWebFilter(tokenAuthenticationManager); authenticationWebFilter.setServerAuthenticationConverter(new ServerBearerTokenAuthenticationConverter());

      http.httpBasic().disable()

      1.      .csrf().disable()
      2.      .authorizeExchange()
      3.      .pathMatchers(HttpMethod.OPTIONS).permitAll()
      4.      .anyExchange().access(accessManager)
      5.      .and()
      6.      .addFilterAt(corsFilter(), SecurityWebFiltersOrder.CORS)
      7.      .addFilterAt(authenticationWebFilter, SecurityWebFiltersOrder.AUTHENTICATION);

      return http.build(); } }

  1. **AccessManager, 实现ReactiveAuthorizationManager<AuthorizationContext>接口做鉴权**<br />这里可以设定放开的静态资源路径, 对客户端做路径的权限控制, 利用正则对用户请求路径做权限控制等, <br />对于分布式后端做鉴权, 两种方案:
  3. 1. 使用restFul风格的url, 那只能使用正则表达式以实现对资源路径的校验;
  4. 1. 全部使用POST作为请求方式, 同样数据库维护url的资源权限;
  6. 不论哪种, 维护都较为繁琐, 且使用正则性能低, 目前个人没发现好的解决方案, 因此示例项目这部分没做, 仅由前端控制权限
  7. ```java
  8. package top.xinzhang0618.oa.config;
  10. import org.springframework.security.authorization.AuthorizationDecision;
  11. import org.springframework.security.authorization.ReactiveAuthorizationManager;
  12. import org.springframework.security.core.Authentication;
  13. import org.springframework.security.oauth2.provider.OAuth2Authentication;
  14. import org.springframework.security.web.server.authorization.AuthorizationContext;
  15. import org.springframework.stereotype.Component;
  16. import org.springframework.util.AntPathMatcher;
  17. import org.springframework.web.server.ServerWebExchange;
  18. import reactor.core.publisher.Mono;
  20. import java.util.HashSet;
  21. import java.util.Set;
  23. /**
  24.  * @author xinzhang
  25.  * @date 2020/11/18 17:40
  26.  */
  27. @Component
  28. public class AccessManager implements ReactiveAuthorizationManager<AuthorizationContext> {
  30.     private final Set<String> permitAll = new HashSet<>();
  32.     private static final AntPathMatcher antPathMatcher = new AntPathMatcher();
  34.     public AccessManager() {
  35.         permitAll.add("/");
  36.         permitAll.add("/auth/oauth/**");
  37.     }
  39.     @Override
  40.     public Mono<AuthorizationDecision> check(Mono<Authentication> mono, AuthorizationContext authorizationContext) {
  41.         ServerWebExchange exchange = authorizationContext.getExchange();
  42.         String requestPath = exchange.getRequest().getURI().getPath();
  43.         if (permitAll(requestPath)) {
  44.             return Mono.just(new AuthorizationDecision(true));
  45.         }
  46.         return mono.map(auth -> new AuthorizationDecision(checkAuthorities(auth, requestPath)))
  47.                 .defaultIfEmpty(new AuthorizationDecision(false));
  48.     }
  50.     /**
  51.      * 校验是否属于静态资源
  52.      *
  53.      * @param requestPath 请求路径
  54.      * @return
  55.      */
  56.     private boolean permitAll(String requestPath) {
  57.         return permitAll.stream().anyMatch(r -> antPathMatcher.match(r, requestPath));
  58.     }
  60.     /**
  61.      * 权限校验
  62.      *
  63.      * @param auth        Authentication
  64.      * @param requestPath 请求路径
  65.      * @return
  66.      */
  67.     private boolean checkAuthorities(Authentication auth, String requestPath) {
  68.         if (auth instanceof OAuth2Authentication) {
  69.             OAuth2Authentication oAuth2Authentication = (OAuth2Authentication) auth;
  70.             String clientId = oAuth2Authentication.getOAuth2Request().getClientId();
  71.             // 权限校验
  72.         }
  73.         return true;
  74.     }
  75. }

JwtAuthenticationManager实现ReactiveAuthenticationManager接口做认证
认证就一个authenticate方法较为简单, 注意实现的逻辑有:

  1. 先过滤redis黑名单
  2. jwt的解析
  3. token的过期校验
  4. token鉴权 ```java package top.xinzhang0618.oa.config;

import org.springframework.data.redis.core.RedisTemplate; import org.springframework.security.authentication.ReactiveAuthenticationManager; import org.springframework.security.core.Authentication; import org.springframework.security.oauth2.common.OAuth2AccessToken; import org.springframework.security.oauth2.common.exceptions.InvalidTokenException; import org.springframework.security.oauth2.provider.OAuth2Authentication; import org.springframework.security.oauth2.provider.token.TokenStore; import org.springframework.security.oauth2.server.resource.BearerTokenAuthenticationToken; import reactor.core.publisher.Mono;

/**

  • @author xinzhang

  • @date 2020/11/17 19:53 */ public class JwtAuthenticationManager implements ReactiveAuthenticationManager {

    private RedisTemplate redisTemplate; private TokenStore tokenStore;

    public JwtAuthenticationManager(TokenStore tokenStore, RedisTemplate redisTemplate) {

    1.  this.tokenStore = tokenStore;
    2.  this.redisTemplate = redisTemplate;

    }

    @Override public Mono authenticate(Authentication authentication) {

    1.  return Mono.justOrEmpty(authentication)
    2.          .filter(a -> a instanceof BearerTokenAuthenticationToken)
    3.          .cast(BearerTokenAuthenticationToken.class)
    4.          .map(BearerTokenAuthenticationToken::getToken)
    5.          .flatMap((accessToken -> {
    6.              // redis黑名单
    7.              if (redisTemplate.opsForValue().get("TOKEN_BLACK_LIST:Bearer " + accessToken) != null) {
    8.                  return Mono.error(new InvalidTokenException("请重新登录"));
    9.              }
    11.              OAuth2AccessToken oAuth2AccessToken;
    12.              try {
    13.                  oAuth2AccessToken = this.tokenStore.readAccessToken(accessToken);
    14.              } catch (Exception e) {
    15.                  return Mono.error(new InvalidTokenException("token无效, 请重新登录"));
    16.              }
    17.              if (oAuth2AccessToken == null) {
    18.                  return Mono.error(new InvalidTokenException("请先登录"));
    19.              } else if (oAuth2AccessToken.isExpired()) {
    20.                  return Mono.error(new InvalidTokenException("登录已过期, 请重新登录"));
    21.              }
    22.              OAuth2Authentication oAuth2Authentication = this.tokenStore.readAuthentication(accessToken);
    23.              if (oAuth2Authentication == null) {
    24.                  return Mono.error(new InvalidTokenException("登录无效, 请重新登录"));
    25.              } else {
    26.                  return Mono.just(oAuth2Authentication);
    27.              }
    28.          })).cast(Authentication.class);

    } }

  1. **AuthGlobalFilter实现GlobalFilter, 作为校验通过后的过滤器**
  3. 1. 注意这里有个骚操作是"往SecurityContext中塞入token, 方便restTemplate取出并携带", 是为了后续访问auth服务重新获取token所必须的, oauth2+webflux下的的SecurityContext中啥都没有
  4. 1. 判断token有效期, 只剩5分钟时, 重新获取token, 并在请求头添加token刷新的事件
  5. 1. 解析jwt内容塞入上下文
  6. ```java
  7. package top.xinzhang0618.oa.config;
  9. import org.springframework.beans.factory.annotation.Autowired;
  10. import org.springframework.cloud.gateway.filter.GatewayFilterChain;
  11. import org.springframework.cloud.gateway.filter.GlobalFilter;
  12. import org.springframework.core.Ordered;
  13. import org.springframework.http.HttpHeaders;
  14. import org.springframework.security.core.context.SecurityContext;
  15. import org.springframework.security.core.context.SecurityContextHolder;
  16. import org.springframework.security.oauth2.common.OAuth2AccessToken;
  17. import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
  18. import org.springframework.security.oauth2.provider.token.store.JwtTokenStore;
  19. import org.springframework.security.oauth2.server.resource.BearerTokenAuthenticationToken;
  20. import org.springframework.stereotype.Component;
  21. import org.springframework.web.server.ServerWebExchange;
  22. import reactor.core.publisher.Mono;
  23. import top.xinzhang0618.oa.BizContext;
  24. import top.xinzhang0618.oa.constant.GatewayConstant;
  25. import top.xinzhang0618.oa.util.StringUtils;
  26. import top.xinzhang0618.oa.util.TokenUtil;
  28. import java.util.Map;
  30. /**
  31.  * @author xinzhang
  32.  * @date 2020/11/17 19:55
  33.  */
  34. @Component
  35. public class AuthGlobalFilter implements GlobalFilter, Ordered {
  37.     @Autowired
  38.     private JwtAccessTokenConverter accessTokenConverter;
  39.     @Autowired
  40.     private TokenUtil tokenUtil;
  42.     @Override
  43.     public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
  44.         String token = exchange.getRequest().getHeaders().getFirst(GatewayConstant.AUTHORIZATION);
  45.         if (StringUtils.isEmpty(token)) {
  46.             return chain.filter(exchange);
  47.         }
  48.         // 往SecurityContext中塞入token, 方便restTemplate取出并携带
  49.         SecurityContext context = SecurityContextHolder.getContext();
  50.         context.setAuthentication(new BearerTokenAuthenticationToken(token));
  52.         OAuth2AccessToken oAuth2AccessToken = new JwtTokenStore(accessTokenConverter).readAccessToken(token.replace(
  53.                 GatewayConstant.TOKEN_PREFIX, ""));
  54.         Map<String, Object> map = oAuth2AccessToken.getAdditionalInformation();
  55.         String userId = (String) map.get(GatewayConstant.USER_ID);
  56.         String appKey = (String) map.get(GatewayConstant.APP_KEY);
  58.         // token有效期只剩5分钟时刷新token
  59.         if (oAuth2AccessToken.getExpiresIn() < GatewayConstant.TOKEN_REFRESH_TIME_LIMIT) {
  60.             String newToken = tokenUtil.generateToken((String) map.get(GatewayConstant.USER_ID), (String) map.get(GatewayConstant.APP_KEY));
  61.             HttpHeaders headers = exchange.getResponse().getHeaders();
  62.             headers.add(GatewayConstant.ACCESS_TOKEN, newToken);
  63.             headers.add(GatewayConstant.EVENT, GatewayConstant.TOKEN_REFRESHED);
  64.         }
  66.         // 设置上下文
  67.         BizContext.setUserId((Long) map.get(GatewayConstant.USER_ID));
  68.         BizContext.setUserName((String) map.get(GatewayConstant.USER_NAME));
  69.         BizContext.setTenantId((Long) map.get(GatewayConstant.TENANT_ID));
  70.         return chain.filter(exchange);
  71.     }
  73.     @Override
  74.     public int getOrder() {
  75.         return 0;
  76.     }
  77. }

补充:
RestTemplateConfig, 注意下拦截器, 从SecurityContext中取出token并携带

  1. package top.xinzhang0618.oa.config.rest;
  3. import com.alibaba.fastjson.serializer.SerializerFeature;
  4. import com.alibaba.fastjson.support.config.FastJsonConfig;
  5. import com.alibaba.fastjson.support.spring.FastJsonHttpMessageConverter;
  7. import java.nio.charset.StandardCharsets;
  8. import java.util.Arrays;
  9. import java.util.List;
  11. import org.apache.http.client.HttpClient;
  12. import org.apache.http.impl.client.HttpClientBuilder;
  13. import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
  14. import org.slf4j.Logger;
  15. import org.slf4j.LoggerFactory;
  16. import org.springframework.cloud.client.loadbalancer.LoadBalanced;
  17. import org.springframework.context.annotation.Bean;
  18. import org.springframework.context.annotation.Configuration;
  19. import org.springframework.http.HttpHeaders;
  20. import org.springframework.http.MediaType;
  21. import org.springframework.http.client.ClientHttpRequestInterceptor;
  22. import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
  23. import org.springframework.http.converter.HttpMessageConverter;
  24. import org.springframework.http.converter.StringHttpMessageConverter;
  25. import org.springframework.security.core.context.SecurityContextHolder;
  26. import org.springframework.security.oauth2.server.resource.BearerTokenAuthenticationToken;
  27. import org.springframework.web.client.RestTemplate;
  28. import top.xinzhang0618.oa.constant.GatewayConstant;
  30. /**
  31.  * RestTemplate配置类
  32.  *
  33.  * @author gavin
  34.  * @date 2020-07-01
  35.  * 文档: https://docs.spring.io/spring/docs/4.3.9.RELEASE/spring-framework-reference/html/remoting.html#rest-client-access
  36.  * api: https://docs.spring.io/spring-framework/docs/4.3.9
  37.  * .RELEASE/javadoc-api/org/springframework/web/client/RestTemplate.html
  38.  */
  39. @Configuration
  40. public class RestTemplateConfig {
  42.     private static final Logger LOGGER = LoggerFactory.getLogger(RestTemplateConfig.class);
  44.     @Bean
  45.     @LoadBalanced
  46.     public RestTemplate restTemplate() {
  47.         RestTemplate restTemplate = new RestTemplate(clientHttpRequestFactory());
  48.         restTemplate.getInterceptors().add(authorizedRequestInterceptor());
  49.         replaceJackson2FastJson(restTemplate);
  50.         return restTemplate;
  51.     }
  53.     /**
  54.      * 自定义拦截器携带authorization
  55.      */
  56.     @Bean(name = "authorizedRequestInterceptor")
  57.     public ClientHttpRequestInterceptor authorizedRequestInterceptor() {
  58.         return (httpRequest, bytes, clientHttpRequestExecution) -> {
  59.             HttpHeaders headers = httpRequest.getHeaders();
  60.             BearerTokenAuthenticationToken authentication =
  61.                     (BearerTokenAuthenticationToken) SecurityContextHolder.getContext().getAuthentication();
  62.             headers.add(GatewayConstant.AUTHORIZATION, authentication.getToken());
  63.             return clientHttpRequestExecution.execute(httpRequest, bytes);
  64.         };
  65.     }
  67.     /**
  68.      * 替换默认的jackson转换器为fastJson转换器
  69.      */
  70.     private void replaceJackson2FastJson(RestTemplate restTemplate) {
  71.         List<HttpMessageConverter<?>> converters = restTemplate.getMessageConverters();
  72.         //原有的String是ISO-8859-1编码 替换成 UTF-8编码
  73.         converters.removeIf(c -> c instanceof StringHttpMessageConverter);
  74.         converters.add(new StringHttpMessageConverter(StandardCharsets.UTF_8));
  75.         converters.add(0, fastJsonHttpMessageConverter());
  76.     }
  78.     /**
  79.      * 配置fastJson转换器
  80.      */
  81.     @Bean
  82.     public HttpMessageConverter fastJsonHttpMessageConverter() {
  83.         FastJsonConfig fastJsonConfig = new FastJsonConfig();
  84.         fastJsonConfig.setSerializerFeatures(SerializerFeature.WriteMapNullValue, SerializerFeature.QuoteFieldNames,
  85.                 SerializerFeature.WriteNullStringAsEmpty, SerializerFeature.WriteNullListAsEmpty,
  86.                 SerializerFeature.DisableCircularReferenceDetect);
  87.         FastJsonHttpMessageConverter fastJsonHttpMessageConverter = new FastJsonHttpMessageConverter();
  88.         fastJsonHttpMessageConverter.setSupportedMediaTypes(Arrays.asList(MediaType.APPLICATION_JSON_UTF8,
  89.                 MediaType.TEXT_HTML));
  90.         fastJsonHttpMessageConverter.setFastJsonConfig(fastJsonConfig);
  91.         return fastJsonHttpMessageConverter;
  92.     }
  94.     /**
  95.      * 配置clientHttpRequestFactory
  96.      */
  97.     @Bean
  98.     public HttpComponentsClientHttpRequestFactory clientHttpRequestFactory() {
  99.         try {
  100.             HttpClientBuilder httpClientBuilder = HttpClientBuilder.create();
  101.             //设置连接池
  102.             PoolingHttpClientConnectionManager connectionManager = new PoolingHttpClientConnectionManager();
  103.             //最大连接数
  104.             connectionManager.setMaxTotal(20);
  105.             //同路由并发数
  106.             connectionManager.setDefaultMaxPerRoute(10);
  107.             httpClientBuilder.setConnectionManager(connectionManager);
  109.             HttpClient httpClient = httpClientBuilder.build();
  110.             // httpClient连接配置
  111.             HttpComponentsClientHttpRequestFactory requestFactory = new HttpComponentsClientHttpRequestFactory(
  112.                     httpClient);
  113.             //连接超时
  114.             requestFactory.setConnectTimeout(60 * 1000);
  115.             //数据读取超时时间
  116.             requestFactory.setReadTimeout(60 * 1000);
  117.             //连接不够用的等待时间
  118.             requestFactory.setConnectionRequestTimeout(60 * 1000);
  119.             return requestFactory;
  120.         } catch (Exception e) {
  121.             LOGGER.error(String.format("初始化clientHttpRequestFactory失败, 错误信息: %s", e));
  122.         }
  123.         return null;
  124.     }
  125. }

网关全局异常处理
ExceptionConfig, 主要是定义ErrorWebExceptionHandler的Bean

  1. package top.xinzhang0618.oa.config.exception;
  3. import org.springframework.beans.factory.ObjectProvider;
  4. import org.springframework.boot.autoconfigure.web.ResourceProperties;
  5. import org.springframework.boot.autoconfigure.web.ServerProperties;
  6. import org.springframework.boot.context.properties.EnableConfigurationProperties;
  7. import org.springframework.boot.web.reactive.error.ErrorAttributes;
  8. import org.springframework.boot.web.reactive.error.ErrorWebExceptionHandler;
  9. import org.springframework.context.ApplicationContext;
  10. import org.springframework.context.annotation.Bean;
  11. import org.springframework.context.annotation.Configuration;
  12. import org.springframework.core.Ordered;
  13. import org.springframework.core.annotation.Order;
  14. import org.springframework.http.codec.ServerCodecConfigurer;
  15. import org.springframework.web.reactive.result.view.ViewResolver;
  17. import java.util.Collections;
  18. import java.util.List;
  20. /**
  21.  * @author xinzhang
  22.  * @date 2020/11/20 16:22
  23.  */
  24. @Configuration
  25. @EnableConfigurationProperties({ServerProperties.class, ResourceProperties.class})
  26. public class ExceptionConfig {
  27.     private final ServerProperties serverProperties;
  29.     private final ApplicationContext applicationContext;
  31.     private final ResourceProperties resourceProperties;
  33.     private final List<ViewResolver> viewResolvers;
  35.     private final ServerCodecConfigurer serverCodecConfigurer;
  37.     public ExceptionConfig(ServerProperties serverProperties,
  38.                            ResourceProperties resourceProperties,
  39.                            ObjectProvider<List<ViewResolver>> viewResolversProvider,
  40.                            ServerCodecConfigurer serverCodecConfigurer,
  41.                            ApplicationContext applicationContext) {
  42.         this.serverProperties = serverProperties;
  43.         this.applicationContext = applicationContext;
  44.         this.resourceProperties = resourceProperties;
  45.         this.viewResolvers = viewResolversProvider.getIfAvailable(Collections::emptyList);
  46.         this.serverCodecConfigurer = serverCodecConfigurer;
  47.     }
  49.     @Bean
  50.     @Order(Ordered.HIGHEST_PRECEDENCE)
  51.     public ErrorWebExceptionHandler errorWebExceptionHandler(ErrorAttributes errorAttributes) {
  52.         JsonExceptionHandler exceptionHandler = new JsonExceptionHandler(
  53.                 errorAttributes,
  54.                 this.resourceProperties,
  55.                 this.serverProperties.getError(),
  56.                 this.applicationContext);
  57.         exceptionHandler.setViewResolvers(this.viewResolvers);
  58.         exceptionHandler.setMessageWriters(this.serverCodecConfigurer.getWriters());
  59.         exceptionHandler.setMessageReaders(this.serverCodecConfigurer.getReaders());
  60.         return exceptionHandler;
  61.     }
  62. }

JsonExceptionHandler, 实现默认的DefaultErrorWebExceptionHandler异常处理器, 重写方法
此处的status可能有线程安全问题, 待优化, 这个status是请求返回的http状态码, 但项目中我自定义的异常码都是10000-10003这种, 在getErrorAttributes方法又覆盖了原有的返回值, 因此会导致getHttpStatus方法报错, 暂时存放一个类变量以保存原有的status码

  1. package top.xinzhang0618.oa.config.exception;
  3. import com.alibaba.fastjson.JSON;
  4. import org.springframework.boot.autoconfigure.web.ErrorProperties;
  5. import org.springframework.boot.autoconfigure.web.ResourceProperties;
  6. import org.springframework.boot.autoconfigure.web.reactive.error.DefaultErrorWebExceptionHandler;
  7. import org.springframework.boot.web.reactive.error.ErrorAttributes;
  8. import org.springframework.context.ApplicationContext;
  9. import org.springframework.http.HttpStatus;
  10. import org.springframework.web.reactive.function.server.*;
  11. import top.xinzhang0618.oa.constant.GatewayConstant;
  12. import top.xinzhang0618.oa.rest.response.ErrorCode;
  13. import top.xinzhang0618.oa.rest.response.RestResponse;
  15. import java.util.Map;
  17. /**
  18.  * 自定义异常处理器
  19.  * 参考: https://cloud.tencent.com/developer/article/1650123
  20.  * 参考: https://blog.csdn.net/github_38924695/article/details/104374037
  21.  *
  22.  * @author xinzhang
  23.  * @date 2020/11/20 16:02
  24.  */
  25. public class JsonExceptionHandler extends DefaultErrorWebExceptionHandler {
  26.     /**
  27.      * 原ErrorAttributes中状态码
  28.      */
  29.     private int status;
  31.     public JsonExceptionHandler(ErrorAttributes errorAttributes, ResourceProperties resourceProperties,
  32.                                 ErrorProperties errorProperties, ApplicationContext applicationContext) {
  33.         super(errorAttributes, resourceProperties, errorProperties, applicationContext);
  34.     }
  36.     /**
  37.      * 获取异常属性
  38.      */
  39.     @Override
  40.     protected Map<String, Object> getErrorAttributes(ServerRequest request, boolean includeStackTrace) {
  41.         Throwable error = super.getError(request);
  42.         this.status= (int) super.getErrorAttributes(request, includeStackTrace).get(GatewayConstant.STATUS);
  43.         return JSON.parseObject(JSON.toJSONString(RestResponse.failure(ErrorCode.UNKNOWN_ERROR.getValue(),
  44.                 error.getMessage())));
  45.     }
  47.     /**
  48.      * 指定响应处理方法为JSON处理的方法
  49.      *
  50.      * @param errorAttributes
  51.      */
  52.     @Override
  53.     protected RouterFunction<ServerResponse> getRoutingFunction(ErrorAttributes errorAttributes) {
  54.         return RouterFunctions.route(RequestPredicates.all(), this::renderErrorResponse);
  55.     }
  57.     /**
  58.      * 根据code获取对应的HttpStatus
  59.      *
  60.      * @param errorAttributes
  61.      */
  62.     @Override
  63.     protected HttpStatus getHttpStatus(Map<String, Object> errorAttributes) {
  64.         return HttpStatus.valueOf(status);
  65.     }
  67. }

日志处理
网关可以添加拦截器, 记录请求的参数以及返回值, 个人觉得不太好, 增加了响应时间, 日志应该在各服务业务处理的地方做记录比较合适
断路器
hystrix是一定要配置的, 详见上面配置
限流
暂不配置, 略