security 认证流程

分为两个部分，认证和鉴权
当一个请求到来时，我们需要观察其是否是已经认证的用户，主要是查看浏览器的cookie和remerber me 数据库。如果不是认证用户转到登录，这时候我们就进入了登录的逻辑里。
如果是认证用户，我们就进入鉴权的逻辑。
具体的逻辑我们可以看下图
image.png
说起JWT，我们应该来谈一谈基于token的认证和传统的session认证的区别。

什么是 JWT — JSON WEB TOKEN

传统的session认证

我们知道，http协议本身是一种无状态的协议，而这就意味着如果用户向我们的应用提供了用户名和密码来进行用户认证，那么下一次请求时，用户还要再一次进行用户认证才行，因为根据http协议，我们并不能知道是哪个用户发出的请求，所以为了让我们的应用能识别是哪个用户发出的请求，我们只能在服务器存储一份用户登录的信息，这份登录信息会在响应时传递给浏览器，告诉其保存为cookie,以便下次请求时发送给我们的应用，这样我们的应用就能识别请求来自哪个用户了,这就是传统的基于session认证。
但是这种基于session的认证使应用本身很难得到扩展，随着不同客户端用户的增加，独立的服务器已无法承载更多的用户，而这时候基于session认证应用的问题就会暴露出来.

基于token的鉴权机制

基于token的鉴权机制类似于http协议也是无状态的，它不需要在服务端去保留用户的认证信息或者会话信息。这就意味着基于token认证机制的应用不需要去考虑用户在哪一台服务器登录了，这就为应用的扩展提供了便利。
流程上是这样的：

  • 用户使用用户名密码来请求服务器
  • 服务器进行验证用户的信息
  • 服务器通过验证发送给用户一个token
  • 客户端存储token，并在每次请求时附送上这个token值
  • 服务端验证token值，并返回数据

这个token必须要在每次请求时传递给服务端，它应该保存在请求头里， 另外，服务端要支持CORS(跨来源资源共享)策略，一般我们在服务端这么做就可以了Access-Control-Allow-Origin: *。

实现

因为secrity他的默认是基于session和cooki只上的，所以我们需要对其的一些逻辑进行更改。

  1. 取消csrf的防护（crsf是基于cookie的攻击，所以可以关掉防护）

    1. .csrf().disable()

  2. 关掉session

.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)

  1.     @Override
  2.     protected void configure(HttpSecurity http) throws Exception {
  3.         /*AccessDecisionManager accessDecisionManager = (AccessDecisionManager) ioc.getBean("dynamicAccessDecisionManager");*/
  4.         http.authorizeRequests()
  5.                 .antMatchers(excludeUrls).permitAll()
  6.                 .antMatchers("/admin/**").hasRole("admin")
  7.                 .antMatchers("/user/**").hasRole("user")
  8.                 .anyRequest().authenticated()
  9.                 .and()
  10.                 .csrf().disable()                      // 禁用 Spring Security 自带的跨域处理
  11.                 .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
  12.                 .and()
  13.                 .addFilterAfter(new JwtFilter(authenticationManager()), UsernamePasswordAuthenticationFilter.class);
  14.         // 定制我们自己的 session 策略：调整为让 Spring Security 不创建和使用 session;
  15.                 //.accessDecisionManager(accessDecisionManager)  //根据voter配置动态权限
  16.     }

具体更改流程

jwt只需要对其认证原理进行更改,每一次带token的链接，我们都需要为其加上一个认证的authentication,并且验证这个authentication。

得到authenication

通过过滤器从token中得到authenication对象

验证authenication

重新配置authenicationProvider

代码

pom

  1. <dependency>
  2.             <groupId>com.auth0</groupId>
  3.             <artifactId>java-jwt</artifactId>
  4.             <version>3.4.0</version>
  5.         </dependency>
  7.         <!-->序列化<-->
  8.         <dependency>
  9.             <groupId>com.alibaba</groupId>
  10.             <artifactId>fastjson</artifactId>
  11.             <version>1.2.79</version>
  12.         </dependency>
  13.         <dependency>
  14.             <groupId>org.springframework.security</groupId>
  15.             <artifactId>spring-security-test</artifactId>
  16.             <scope>test</scope>
  17.         </dependency>

token util

  1. package com.example.springbootsecurityjwtdemo.security;
  3. import com.alibaba.fastjson.JSON;
  4. import com.auth0.jwt.JWT;
  5. import com.auth0.jwt.JWTVerifier;
  6. import com.auth0.jwt.algorithms.Algorithm;
  7. import com.auth0.jwt.interfaces.Claim;
  8. import com.auth0.jwt.interfaces.DecodedJWT;
  9. import org.springframework.security.core.GrantedAuthority;
  10. import org.springframework.stereotype.Component;
  12. import java.util.Date;
  13. import java.util.HashMap;
  14. import java.util.List;
  15. import java.util.Map;
  17. public class TokenUtil {
  19.     // 过期时间是七天
  20.     private static final long EXPIRE_TIME= 60*60*24*7;
  21.     private static final String ISSER = "auth0";
  22.     private static final String TOKEN_SECRET="token123";  //密钥盐
  23.     public final static JWTVerifier VERIFIER = JWT.require(Algorithm.HMAC256(TOKEN_SECRET)).withIssuer(ISSER).build();
  24.     /**
  25.      * 签名生成
  26.      * @return
  27.      */
  28.     public static String sign(String name, List<String> roles){
  30.         String token = null;
  31.         try {
  32.             Date expiresAt = new Date(System.currentTimeMillis() + EXPIRE_TIME);
  33.             token = JWT.create()
  34.                     .withIssuer(ISSER)
  35.                     .withClaim("username", name)
  36.                     .withClaim("roles", JSON.toJSONString(roles))
  37.                     .withExpiresAt(expiresAt)
  38.                     // 使用了HMAC256加密算法。
  39.                     .sign(Algorithm.HMAC256(TOKEN_SECRET));
  40.         } catch (Exception e){
  41.             e.printStackTrace();
  42.         }
  43.         return token;
  45.     }
  46.     /**
  47.      * 签名验证
  48.      * @param token
  49.      * @return
  50.      */
  51.     public static boolean verify(String token){
  52.         try {
  53.             VERIFIER.verify(token);
  54.             return true;
  55.         } catch (Exception e){
  56.             return false;
  57.         }
  58.     }
  60.     /**
  61.      * 得到token存的值
  62.      * @param token
  63.      * @return
  64.      */
  65.     public static Map<String,Claim> getClaimsFromToken(String token){
  66.         try {
  67.             DecodedJWT jwt = VERIFIER.verify(token);
  68.             return jwt.getClaims();
  69.         } catch (Exception e){
  70.             return null;
  71.         }
  72.     }
  73. }

过滤器

  1. import com.alibaba.fastjson.JSON;
  2. import com.auth0.jwt.interfaces.Claim;
  3. import com.example.springbootsecurityjwtdemo.exception.BusinessException;
  4. import com.example.springbootsecurityjwtdemo.result.ResponseMag;
  5. import org.springframework.security.access.SecurityConfig;
  6. import org.springframework.security.authentication.AuthenticationManager;
  7. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  8. import org.springframework.security.core.GrantedAuthority;
  9. import org.springframework.security.core.authority.SimpleGrantedAuthority;
  10. import org.springframework.security.core.context.SecurityContextHolder;
  11. import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
  13. import javax.servlet.*;
  14. import javax.servlet.http.HttpServletRequest;
  15. import javax.servlet.http.HttpServletResponse;
  16. import java.io.IOException;
  17. import java.util.ArrayList;
  18. import java.util.List;
  19. import java.util.Map;
  21. public class JwtFilter extends BasicAuthenticationFilter {
  22.     public JwtFilter(AuthenticationManager authenticationManager) {
  23.         super(authenticationManager);
  24.     }
  26.     @Override
  27.     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
  28.         String token = request.getHeader("token");
  29.         System.out.println(token);
  30.         if(token==null|| "".equals(token)){
  31.             chain.doFilter(request, response);
  32.             return;
  33.         }
  34.         Map<String, Claim> claimMap = TokenUtil.getClaimsFromToken(token);
  35.         if(claimMap==null){
  36.             changeToExectionController(request,response, new BusinessException(ResponseMag.TokenError));
  37.         }
  38.         String username = claimMap.get("username").asString();
  39.         List<String> roles =  JSON.parseArray(claimMap.get("roles").asString(),String.class);
  40.         List<GrantedAuthority> authorities = new ArrayList<>();
  41.         for(String s:roles){
  42.             authorities.add(()->s);
  43.         }
  44.         System.out.println(claimMap.get("roles").asString());
  45.         UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(username,null,authorities);
  46.         SecurityContextHolder.getContext().setAuthentication(authentication);
  47.         getAuthenticationManager().authenticate(authentication);
  48.         chain.doFilter(request, response);
  49.     }
  50.     private void changeToExectionController(HttpServletRequest request, HttpServletResponse response,Exception e) throws ServletException, IOException {
  51.         // 异常捕获、发送到UnsupportedJwtException
  52.         request.setAttribute("Exception", e);
  53.         // 将异常分发到UnsupportedJwtException控制器
  54.         request.getRequestDispatcher("/Exception").forward(request, response);
  55.     }
  56. }

provider

  1. package com.example.springbootsecurityjwtdemo.security;
  3. import java.util.ArrayList;
  4. import org.springframework.security.authentication.AuthenticationProvider;
  5. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  6. import org.springframework.security.core.Authentication;
  7. import org.springframework.security.core.AuthenticationException;
  9. public class CustomAuthenticationProvider implements AuthenticationProvider {
  12.     @Override
  13.     public Authentication authenticate(Authentication authentication) throws AuthenticationException {
  14.         System.out.println("hello");
  15.         return authentication;
  16.     }
  18.     @Override
  19.     public boolean supports(Class<?> aClass) {
  20.         return true;
  21.     }
  22. }

配置类

  1. package com.example.springbootsecurityjwtdemo.security;
  3. import com.example.springbootsecurityjwtdemo.mapper.RolePermissionMapper;
  4. import org.springframework.beans.factory.annotation.Autowired;
  5. import org.springframework.context.ApplicationContext;
  6. import org.springframework.context.annotation.Bean;
  7. import org.springframework.context.annotation.Configuration;
  8. import org.springframework.security.access.AccessDecisionManager;
  9. import org.springframework.security.access.AccessDecisionVoter;
  10. import org.springframework.security.access.ConfigAttribute;
  11. import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
  12. import org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl;
  13. import org.springframework.security.authentication.AuthenticationManager;
  14. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  15. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  16. import org.springframework.security.config.annotation.web.builders.WebSecurity;
  17. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  18. import org.springframework.security.config.http.SessionCreationPolicy;
  19. import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
  20. import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
  21. import org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl;
  22. import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository;
  24. import javax.sql.DataSource;
  26. @Configuration
  27. public class MySecurityConfig extends WebSecurityConfigurerAdapter {
  28.     @Autowired
  29.     UserServiceImpl userServiceImpl;
  30.     @Override
  31.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  32.         auth.authenticationProvider(new CustomAuthenticationProvider());
  33.     }
  34.     @Autowired
  35.     ApplicationContext ioc;
  37.     public final String[] excludeUrls = {"/Exception","/login","/register","/doLogin","/test/hello","/swagger**/**","/webjars/**","/v3/**"};
  39.     @Override
  40.     public void configure(WebSecurity web) throws Exception {
  41.         web.ignoring().antMatchers("/js/**", "/css/**","/images/**");
  42.         web.securityInterceptor((FilterSecurityInterceptor) ioc.getBean("filterSecurityInterceptor"));
  43.     }
  45.     @Override
  46.     @Bean
  47.     public AuthenticationManager authenticationManagerBean() throws Exception {
  48.         return super.authenticationManagerBean();
  49.     }
  51.     @Override
  52.     protected void configure(HttpSecurity http) throws Exception {
  53.         /*AccessDecisionManager accessDecisionManager = (AccessDecisionManager) ioc.getBean("dynamicAccessDecisionManager");*/
  54.         http.authorizeRequests()
  55.                 .antMatchers(excludeUrls).permitAll()
  56.                 .antMatchers("/admin/**").hasRole("admin")
  57.                 .antMatchers("/user/**").hasRole("user")
  58.                 .anyRequest().authenticated()
  59.                 .and()
  60.                 .csrf().disable()                      // 禁用 Spring Security 自带的跨域处理
  61.                 .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
  62.                 .and()
  63.                 .addFilterAfter(new JwtFilter(authenticationManager()), UsernamePasswordAuthenticationFilter.class);
  64.         // 定制我们自己的 session 策略：调整为让 Spring Security 不创建和使用 session;
  65.                 //.accessDecisionManager(accessDecisionManager)  //根据voter配置动态权限
  66.     }
  68.     @Bean
  69.     RoleHierarchy roleHierarchy() {
  70.         RoleHierarchyImpl hierarchy = new RoleHierarchyImpl();
  71.         hierarchy.setHierarchy("ROLE_admin > ROLE_user");
  72.         return hierarchy;
  73.     }
  77. }

gitee

https://gitee.com/jefferyeven/jwt_security_demo.git