SpringSecurity介绍

SpringSecurity是一款专为Java应用程序设计的身份验证和授权框架。它提供了声明式的安全访问控制解决方案，使开发者能够轻松实现用户认证（Authentication）、授权（Authorization）、防止常见安全攻击以及会话管理等功能。作为Spring生态系统的一部分，Spring Security无缝集成于Spring MVC、Spring Boot等项目中，极大地简化了安全相关的开发工作，确保应用程序具备坚实的安全防线

SpringSecurity可以轻松实现细致到按钮级别的权限控制，又因为排班系统有系统管理员、门店管理员、普通员工，每种角色的权限不同，因此非常适合使用SpringSecurity

sss-security实现

依赖

<!-- Spring Security依赖 -->
<dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-web</artifactId><scope>provided</scope>
</dependency>
<dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>
<dependency><groupId>org.projectlombok</groupId><artifactId>lombok</artifactId>
</dependency>
<dependency><groupId>com.alibaba</groupId><artifactId>transmittable-thread-local</artifactId><version>2.14.2</version>
</dependency>

工具类

Jwt工具

用来根据用户信息生成令牌(token)，同时可以根据token解析出一些关键信息

package com.dam.utils;import io.jsonwebtoken.*;
import org.springframework.util.StringUtils;import java.util.Date;/*** 生成JSON Web Token的工具类*/
public class JwtUtil {/*** JWT的默认过期时间，单位为毫秒。这里设定为一年（365天）*/private static long tokenExpiration = 365 * 24 * 60 * 60 * 1000;/*** 在实际应用中，应使用随机生成的字符串*/private static String tokenSignKey = "dsahdashoiduasguiewu23114";/*** 从给定的JWT令牌中提取指定参数名对应的值。** @param token     需要解析的JWT令牌字符串* @param paramName 要提取的参数名* @return 参数值（字符串形式），如果令牌为空、解析失败或参数不存在，则返回null*/public static String getParam(String token, String paramName) {try {if (StringUtils.isEmpty(token)) {return null;}// 使用提供的密钥解析并验证JWTJws<Claims> claimsJws = Jwts.parser().setSigningKey(tokenSignKey).parseClaimsJws(token);// 获取JWT的有效载荷（claims），其中包含了所有声明（参数）Claims claims = claimsJws.getBody();// 提取指定参数名对应的值Object param = claims.get(paramName);// 如果参数值为空，则返回null；否则将其转换为字符串并返回return param == null ? null : param.toString();} catch (Exception e) {// 记录解析过程中的任何异常，并返回nulle.printStackTrace();return null;}}/*** 根据用户信息生成一个新的JWT令牌。** @param userId* @param username* @return*/public static String createToken(Long userId, String username, Long enterpriseId, Long storeId, int userType) {
//        System.out.println("createToken userType:" + userType);// 使用Jwts.builder()构建JWTString token = Jwts.builder()// 设置JWT的主题（subject），此处为常量"AUTH-USER".setSubject("AUTH-USER")// 设置过期时间，当前时间加上预设的过期时间（tokenExpiration）.setExpiration(new Date(System.currentTimeMillis() + tokenExpiration))// 有效载荷.claim("userId", userId).claim("username", username).claim("enterpriseId", enterpriseId).claim("storeId", storeId).claim("userType", userType)// 使用HS512算法和指定密钥对JWT进行加密.signWith(SignatureAlgorithm.HS512, tokenSignKey)// 使用GZIP压缩算法压缩JWT字符串，将字符串变成一行来显示.compressWith(CompressionCodecs.GZIP)// 完成构建并生成紧凑格式的JWT字符串.compact();return token;}public static String getUserId(String token) {return getParam(token, "userId");}public static String getUsername(String token) {return getParam(token, "username");}public static String getEnterpriseId(String token) {return getParam(token, "enterpriseId");}public static String getStoreId(String token) {return getParam(token, "storeId");}public static String getUserType(String token) {return getParam(token, "userType");}}

JSON响应工具

ResponseUtil 的作用是为 Spring MVC 应用程序提供一种便捷的方式来构建和发送 JSON 格式的 HTTP 响应

package com.dam.utils;import com.alibaba.fastjson.JSON;
import com.dam.model.result.R;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;import javax.servlet.http.HttpServletResponse;
import java.io.IOException;public class ResponseUtil {public static void out(HttpServletResponse response, R r) {ObjectMapper mapper = new ObjectMapper();response.setStatus(HttpStatus.OK.value());response.setContentType(MediaType.APPLICATION_JSON_UTF8_VALUE);try {System.out.println("ResponseUtil r:"+ JSON.toJSONString(r));mapper.writeValue(response.getWriter(), r);} catch (IOException e) {e.printStackTrace();}}
}

加密工具类

本文使用盐值加密来对用户密码进行加密，盐值加密是一种增强密码安全性的技术，主要用于防止密码被轻易破解，特别是在密码数据库遭到泄露的情况下。其核心思想是在密码哈希过程中引入一个额外的、随机生成的值——称为“盐值”，以此来增加密码的唯一性和复杂度，添加盐值有如下作用：

• 防止彩虹表攻击：彩虹表是一种预先计算好的哈希值与明文密码的映射表，用于快速破解已知哈希算法（如MD5、SHA-1等）生成的密码。通过添加盐值，即使两个用户使用相同的密码，由于盐值不同，其哈希结果也会大相径庭，从而大大削弱彩虹表的有效性。

• 抵御字典攻击和暴力破解：盐值使得每个用户密码的哈希值都独一无二，即使是最常用的密码，加上随机盐值后，也需要针对特定盐值进行单独破解，显著增加了攻击者的计算成本。

盐值加密的实现直接使用SpringSecurity自带的工具即可

package com.dam.utils;import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;/*** 加密工具*/
public class EncryptionUtil {private static BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();/*** 盐值MD5加密** @param strSrc* @return*/public static String saltMd5Encrypt(String strSrc) {return passwordEncoder.encode(strSrc);}/*** 判断原密码和加密之后的密码是否相符** @param originalPassword* @param encryptPassword* @return*/public static boolean isSaltMd5Match(String originalPassword, String encryptPassword) {return passwordEncoder.matches(originalPassword, encryptPassword);}public static void main(String[] args) {System.out.println(EncryptionUtil.saltMd5Encrypt("123456"));}
}

用户上下文

用户上下文主要用来记录用户的关键信息，以便同线程共享，无需每次从token中解析，提高效率。使用阿里巴巴的TransmittableThreadLocal库替代标准的java.lang.ThreadLocal，目的是确保在使用线程池或Fork/Join框架等场景下，线程间可以正确地传递（或“传播”）ThreadLocal变量的值。这对于处理跨越多个线程的任务（如异步操作、任务调度等）时保持用户上下文的连续性非常重要。

用户信息实体类

package com.dam.context;import lombok.AllArgsConstructor;
import lombok.Builder;
import lombok.Data;
import lombok.NoArgsConstructor;/*** @Author dam* @create 2024/4/2 16:11*/
@Data
@Builder
@AllArgsConstructor
@NoArgsConstructor
public class UserInfoDTO {private String userId;private String userName;
}

用户上下文

package com.dam.context;import com.alibaba.ttl.TransmittableThreadLocal;import java.util.Optional;/*** @Author dam* @create 2024/4/2 16:12*/
public class UserContext {/*** 定义一个私有的、静态的ThreadLocal变量，类型为UserInfoDTO，用于存储当前线程关联的用户信息*/private static final ThreadLocal<UserInfoDTO> USER_THREAD_LOCAL = new TransmittableThreadLocal<>();/*** 设置用户至上下文** @param user 用户详情信息*/public static void setUser(UserInfoDTO user) {USER_THREAD_LOCAL.set(user);}/*** 获取上下文中用户 ID** @return 用户 ID*/public static String getUserId() {UserInfoDTO userInfoDTO = USER_THREAD_LOCAL.get();// 使用Optional进行空值安全处理：如果userInfoDTO不为空，则提取其userId属性并返回；否则返回nullreturn Optional.ofNullable(userInfoDTO).map(UserInfoDTO::getUserId).orElse(null);}/*** 获取上下文中用户名称** @return 用户名称*/public static String getUsername() {UserInfoDTO userInfoDTO = USER_THREAD_LOCAL.get();return Optional.ofNullable(userInfoDTO).map(UserInfoDTO::getUserName).orElse(null);}/*** 清理用户上下文*/public static void removeUser() {// 从ThreadLocal变量中移除当前线程关联的用户信息，释放资源USER_THREAD_LOCAL.remove();}
}

自定义重写

自定义无权限的报错

package com.dam.custom;import com.dam.model.result.R;
import com.dam.utils.ResponseUtil;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.web.access.AccessDeniedHandler;
import org.springframework.stereotype.Component;import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;/*** 自定义没有权限的报错信息，默认是报403*/
@Component//交给spring管理
public class CustomAccessDeniedHandler implements AccessDeniedHandler {@Overridepublic void handle(HttpServletRequest request, HttpServletResponse response,AccessDeniedException accessDeniedException) {// 获取请求的URIString uri = request.getRequestURI();// 获取请求的方法String method = request.getMethod();// 获取当前用户的用户名
//        String username = request.getRemoteUser();// 获取用户的IP地址
//        String ip = request.getRemoteAddr();// 获取用户的浏览器类型
//        String userAgent = request.getHeader("User-Agent");// 构造错误信息String errorMsg = "没有权限访问当前资源：" + uri + " (" + method + ")";ResponseUtil.out(response, R.error(403, errorMsg));}}

自定义密码加密

package com.dam.custom;import com.dam.utils.EncryptionUtil;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Component;/*** 自定义密码组件*/
@Component//交给spring管理
public class CustomMd5PasswordEncoder implements PasswordEncoder {/*** 指定密码的加密方式** @param rawPassword* @return*/@Overridepublic String encode(CharSequence rawPassword) {return EncryptionUtil.saltMd5Encrypt(rawPassword.toString());}/*** 判断用户所输入的密码和加密之后的密码是否相同** @param rawPassword* @param encodedPassword* @return*/@Overridepublic boolean matches(CharSequence rawPassword, String encodedPassword) {boolean equals = EncryptionUtil.isSaltMd5Match(rawPassword.toString(), encodedPassword);if (equals == true) {return true;} else {System.out.println("登录密码验证不通过，密码错误");
//            System.out.println("原密码，rawPassword：" + rawPassword);
//            System.out.println("原密码加密：" + encrypt);
//            System.out.println("数据库中已加密的密码，encodedPassword：" + encodedPassword);return false;}}
}

自定义用户类

继承security的User，增加一些自己的信息方便后续使用，security的User主要用来存储用户名、密码、权限信息

package com.dam.custom;import com.dam.model.entity.system.UserEntity;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.User;import java.util.Collection;/*** 自定义用户对象*/
public class CustomUser extends User {/*** 我们自己的用户实体对象，要调取用户信息时直接获取这个实体对象*/private UserEntity sysUser;public CustomUser(UserEntity sysUser, Collection<? extends GrantedAuthority> authorities) {super(sysUser.getUsername(), sysUser.getPassword(), authorities);this.sysUser = sysUser;}public UserEntity getSysUser() {return sysUser;}public void setSysUser(UserEntity sysUser) {this.sysUser = sysUser;}}

过滤器

登录过滤器

package com.dam.filter;import com.alibaba.fastjson.JSON;
import com.dam.constant.RedisConstant;
import com.dam.custom.CustomUser;
import com.dam.model.entity.system.UserEntity;
import com.dam.model.enums.ResultCodeEnum;
import com.dam.model.result.R;
import com.dam.model.vo.system.LoginVo;
import com.dam.service.RecordLoginLogService;
import com.dam.utils.JwtUtil;
import com.dam.utils.ResponseUtil;
import com.dam.utils.ip.IpUtil;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.data.redis.core.StringRedisTemplate;
import org.springframework.security.authentication.*;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;
import java.util.concurrent.TimeUnit;/*** 登录过滤器，继承UsernamePasswordAuthenticationFilter，对用户名密码进行登录校验*/
public class TokenLoginFilter extends UsernamePasswordAuthenticationFilter {private StringRedisTemplate redisTemplate;/*** 登录日志服务，用于记录用户的登录情况* 方便对系统的用户活跃情况进行统计*/private RecordLoginLogService loginLogService;/*** 构造方法** @param authenticationManager 认证管理器，负责实际的用户身份验证*/public TokenLoginFilter(AuthenticationManager authenticationManager, StringRedisTemplate redisTemplate, RecordLoginLogService sysLoginLogService) {
//        System.out.println("登录验证过滤");this.setAuthenticationManager(authenticationManager);this.redisTemplate = redisTemplate;this.loginLogService = sysLoginLogService;// 不只是可以postthis.setPostOnly(false);// 指定登录接口及提交方式，可以指定任意路径（我们默认的登陆路径）this.setRequiresAuthenticationRequestMatcher(new AntPathRequestMatcher("/system/login/login", "POST"));}/*** 登录认证，覆盖父类实现** @param req HTTP请求对象* @param res HTTP响应对象* @return 认证后的Authentication对象* @throws AuthenticationException 认证过程中抛出的异常*/@Overridepublic Authentication attemptAuthentication(HttpServletRequest req, HttpServletResponse res)throws AuthenticationException {System.out.println("进行登录认证-----------------------------------------------------------------------------------------");try {// 使用Jackson ObjectMapper从请求流中反序列化登录信息对象LoginVo loginVo = new ObjectMapper().readValue(req.getInputStream(), LoginVo.class);System.out.println("loginVo:" + JSON.toJSONString(loginVo));// 判断登录验证码是否正确String redisKey = RedisConstant.Verification_Code + loginVo.getUuid();String verificationCode = redisTemplate.opsForValue().get(redisKey);if (verificationCode == null) {throw new AuthenticationServiceException("验证码已经失效，请刷新之后再重新登录");}if (!verificationCode.toLowerCase().equals(loginVo.getVerificationCode().toLowerCase())) {throw new AuthenticationServiceException("验证码输入不正确");}// 创建UsernamePasswordAuthenticationToken，封装登录信息Authentication authenticationToken = new UsernamePasswordAuthenticationToken(loginVo.getUsername(), loginVo.getPassword());
//            System.out.println("authenticationToken:" + authenticationToken.toString());// 调用父类的authenticate方法，通过认证管理器进行实际的身份验证，会判定登陆密码和数据库密码是否一致Authentication authenticate = this.getAuthenticationManager().authenticate(authenticationToken);System.out.println("登录验证成功");return authenticate;} catch (IOException e) {System.out.println("登录验证失败");throw new RuntimeException(e);}}/*** 登录成功后的处理方法，覆盖父类实现** @param request* @param response* @param chain* @param auth     当前验证对象* @throws IOException* @throws ServletException*/@Overrideprotected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,Authentication auth) {System.out.println("登录成功，生成token------------------------------------------------------------------------------------------");// 获取当前用户信息CustomUser customUser = (CustomUser) auth.getPrincipal();// 保存权限数据到redisString redisKey = RedisConstant.AUTHORITY_PERMISSION + customUser.getUsername();System.out.println("保存用户权限到redis中，redisKey：" + redisKey);//设置缓存过期时间是十五天redisTemplate.opsForValue().set(redisKey,JSON.toJSONString(customUser.getAuthorities()),15,TimeUnit.DAYS);// 生成tokenUserEntity sysUser = customUser.getSysUser();String token = JwtUtil.createToken(sysUser.getId(), sysUser.getUsername(), sysUser.getEnterpriseId(), sysUser.getStoreId(), sysUser.getType());System.out.println("token:" + token);// 记录登录日志loginLogService.recordLoginLog(customUser.getUsername(), 0, IpUtil.getIpAddress(request), "登录成功", sysUser.getEnterpriseId(), sysUser.getStoreId());// 将token返回给前端Map<String, Object> map = new HashMap<>();map.put("token", token);ResponseUtil.out(response, R.ok().addData("data", map));}/*** 登录失败后的处理方法，覆盖父类实现** @param request  HTTP请求对象* @param response HTTP响应对象* @param e        认证失败异常*/@Overrideprotected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response,AuthenticationException e) {System.out.println("登录失败------------------------------------------------------------------------------------------");System.out.println("失败原因：" + e.getMessage());// 分析具体失败原因并提供对应的错误信息String errorMessage;if (e instanceof BadCredentialsException) {errorMessage = "用户名或密码错误";} else if (e instanceof DisabledException) {errorMessage = "账户已被禁用，请联系管理员";} else if (e instanceof LockedException) {errorMessage = "账户已被锁定，请联系管理员";} else if (e instanceof AuthenticationServiceException) {errorMessage = "认证服务异常，请稍后重试";} else {errorMessage = "登录失败";}ResponseUtil.out(response, R.error(ResultCodeEnum.DATA_ERROR.getCode(), errorMessage));}
}

权限过滤器

这段代码定义了一个名为TokenAuthenticationFilter的类，它继承自Spring Security的OncePerRequestFilter，用于处理每个HTTP请求，解析并验证请求头中的Token，以及将认证信息放入Spring Security的上下文中。

package com.dam.filter;import com.alibaba.fastjson.JSON;
import com.dam.constant.RedisConstant;
import com.dam.context.UserContext;
import com.dam.context.UserInfoDTO;
import com.dam.model.enums.ResultCodeEnum;
import com.dam.model.result.R;
import com.dam.utils.JwtUtil;
import com.dam.utils.ResponseUtil;
import org.springframework.data.redis.core.StringRedisTemplate;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.util.StringUtils;
import org.springframework.web.filter.OncePerRequestFilter;import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;/*** 认证解析token过滤器* OncePerRequestFilter：每次请求都要过滤*/
public class TokenAuthenticationFilter extends OncePerRequestFilter {private StringRedisTemplate redisTemplate;public TokenAuthenticationFilter(StringRedisTemplate redisTemplate) {this.redisTemplate = redisTemplate;}/*** 重写OncePerRequestFilter的doFilterInternal方法，处理每个请求* @param request* @param response* @param chain* @throws IOException* @throws ServletException*/@Overrideprotected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)throws IOException, ServletException {System.out.println("权限验证过滤");//        logger.info("uri:" + request.getRequestURI());
//        System.out.println("request.getRequestURI():"+request.getRequestURI());//如果是登录接口，直接放行if ("/system/login/login".equals(request.getRequestURI())) {chain.doFilter(request, response);return;}// 调用getAuthentication方法尝试从请求中获取有效的Token并解析出认证信息UsernamePasswordAuthenticationToken authentication = getAuthentication(request);if (null != authentication) {// --if--如果获取到有效的认证信息
//            System.out.println("request:" + request.toString());
//            System.out.println("response:" + response.toString());
//            System.out.println("authentication:" + authentication.toString());// 将认证信息放入Spring Security的SecurityContextHolder中，以便后续请求链中使用SecurityContextHolder.getContext().setAuthentication(authentication);// 继续执行过滤链中的其他过滤器和目标处理器chain.doFilter(request, response);} else {// 如果未能获取到有效的认证信息，返回失败响应ResponseUtil.out(response, R.ok().addData("data", ResultCodeEnum.PERMISSION));}}/*** 看看是否有token，根据token是否可以获取到用户，获取不到再进行账号密码登录** @param request* @return*/private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request) {System.out.println("获取权限信息------------------------------------------------------------------------------------------");// token置于header里String token = request.getHeader("token");
//        logger.info("token:" + token);if (!StringUtils.isEmpty(token)) {String username = JwtUtil.getUsername(token);
//            logger.info("username:" + username);if (!StringUtils.isEmpty(username)) {// 获取授权信息String redisKey = RedisConstant.AUTHORITY_PERMISSION + username;// 权限字符串String authoritiesString = redisTemplate.opsForValue().get(redisKey);if (authoritiesString == null) {return null;}// 解析权限字符串为具体的权限集合List<Map> mapList = JSON.parseArray(authoritiesString, Map.class);List<SimpleGrantedAuthority> authorities = new ArrayList<>();for (Map map : mapList) {authorities.add(new SimpleGrantedAuthority((String) map.get("authority")));}// 存储用户上下文信息String userId = JwtUtil.getUserId(token);UserContext.setUser(UserInfoDTO.builder().userId(userId).userName(username).build());// 构建并返回UsernamePasswordAuthenticationToken对象，包含用户名、空密码（此处无需密码，因为已通过Token验证）和权限列表return new UsernamePasswordAuthenticationToken(username, null, authorities);}}// 如果未能成功解析Token或获取权限信息，返回nullreturn null;}
}

Service

登录Service

package com.dam.service;import com.dam.model.entity.system.LoginLogEntity;public interface RecordLoginLogService {/*** 记录登录信息** @param username 用户名* @param status   状态* @param ipaddr   ip* @param message  消息内容* @return*/void recordLoginLog(String username, Integer status, String ipaddr, String message,Long enterpriseId,Long storeId);LoginLogEntity getById(Long id);}

配置类

里面有一些接口当时偷懒没有在数据库里面配置相应的权限，为了开发的时候方便测试，将其放在了忽略接口路径，后续需要修改。

package com.dam.config;import com.dam.configuration.IpFlowControlConfiguration;
import com.dam.custom.CustomAccessDeniedHandler;
import com.dam.custom.CustomMd5PasswordEncoder;
import com.dam.filter.IpFlowLimitFilter;
import com.dam.filter.TokenAuthenticationFilter;
import com.dam.filter.TokenLoginFilter;
import com.dam.service.RecordLoginLogService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.data.redis.core.StringRedisTemplate;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;@Configuration
@EnableWebSecurity //开启SpringSecurity的默认行为
@EnableGlobalMethodSecurity(prePostEnabled = true) // 开启方法级别的安全注解（如@PreAuthorize, @PostAuthorize）
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {@Autowired
//    @Qualifier("systemUserDetailsServiceImpl") // 指定实现类private UserDetailsService userDetailsService;@Autowiredprivate CustomMd5PasswordEncoder customMd5PasswordEncoder;@Autowiredprivate StringRedisTemplate redisTemplate;@Autowired
//    @Qualifier("systemRecordLoginLogServiceImpl") // 指定实现类private RecordLoginLogService loginLogService;@Autowiredprivate CustomAccessDeniedHandler customAccessDeniedHandler;@Autowiredprivate IpFlowControlConfiguration ipFlowControlConfiguration;/*** 创建并返回一个AuthenticationManager实例，此方法由父类WebSecurityConfigurerAdapter提供** @return* @throws Exception*/@Bean@Overrideprotected AuthenticationManager authenticationManager() throws Exception {return super.authenticationManager();}@Overrideprotected void configure(HttpSecurity http) throws Exception {// 这是配置的关键，决定哪些接口开启防护，哪些接口绕过防护http// 自定义没有权限时的报错信息.exceptionHandling().accessDeniedHandler(customAccessDeniedHandler)// 关闭CSRF（跨站请求伪造）防护.and().csrf().disable()// 开启跨域以便前端调用接口（网关已经做了全局跨域）//.cors().and()// 设置访问控制规则.authorizeRequests()// 指定某些接口不需要通过验证即可访问。登陆接口肯定是不需要认证的（在下面统一配置了）//.antMatchers("/system/login/login").permitAll()// 这里意思是其它所有接口需要认证才能访问.anyRequest().authenticated()// 添加自定义过滤器，按照顺序依次执行.and()// TokenAuthenticationFilter放到UsernamePasswordAuthenticationFilter的前面，这样做就是为了除了登录的时候去查询数据库外，其他时候都用token进行认证。.addFilterBefore(new TokenAuthenticationFilter(redisTemplate), UsernamePasswordAuthenticationFilter.class)// IpFlowLimitFilter：在TokenAuthenticationFilter之前，进行IP流量限制.addFilterBefore(new IpFlowLimitFilter(redisTemplate, ipFlowControlConfiguration), TokenAuthenticationFilter.class)// TokenLoginFilter：处理登录请求，使用AuthenticationManager进行认证，并记录登录日志.addFilter(new TokenLoginFilter(authenticationManager(), redisTemplate, loginLogService));// 禁用session （采用无状态会话管理，适用于基于Token的身份验证）http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);}@Overrideprotected void configure(AuthenticationManagerBuilder auth) throws Exception {// 指定 UserDetailService 和 加密器auth.userDetailsService(userDetailsService).passwordEncoder(customMd5PasswordEncoder);}/*** 配置哪些请求不拦截* 重写configure(WebSecurity)方法* 使用web.ignoring().antMatchers(...)指定一系列接口路径，* 这些路径的请求将不会经过Spring Security的过滤链，即不受安全约束。** @param web* @throws Exception*/@Overridepublic void configure(WebSecurity web) throws Exception {web.ignoring().antMatchers("/favicon.ico","/swagger-resources/**","/webjars/**", "/v2/**","/swagger-ui.html/**","/doc.html","/system/login/sendMailCode","/system/login/usernameCheck/**","/system/login/regist","/system/login/enterpriseRegister","/system/user/getByOpenid","/system/user/getUserEntityByToken","/system/user/bindWechat","/system/login/generateVerificationCode","/api/ucenter/wx/callback","/scheduling/imserver/**",//定时任务需要访问"/scheduling/schedulingdate/judgeOneDateIsRest","/scheduling/shiftuser/listStaffWorkDtoByWorkDate","/system/user/getUserIdAndMailMapByUserIdList","/system/user/listUserEntityByStoreId","/system/menu/storeAuthoritiesToRedis","/thirdParty/oss/policy","/thirdParty/mail/send","/api/ucenter/wx/**","/thirdParty/mail/send");}
}

说明

登录验证

使用了SpringSecurity之后，不需要再自己实现登录方法，因为在上面已经完成了验证码校验、密码校验

权限验证

系统的权限控制方式是：将菜单权限绑定到角色中，然后再将角色分配给用户。在登录成功之后，将用户对应的权限标识查询出来并存储到Redis中，当用户访问需要权限的接口时，SpringSecurity会从Redis中获取用户有的权限标识，然后判断用户是否有接口对应权限，没有则报没有权限错误

那么怎么给接口做权限控制呢，实现非常简单，只需要在接口上面添加注解和相应的权限标识，如@PreAuthorize("hasAuthority('bnt.sysMenu.list')")

/*** 列表*/
@RequestMapping("/list")
@PreAuthorize("hasAuthority('bnt.sysMenu.list')")
public R list(@RequestParam Map<String, Object> params) {PageUtils page = menuService.queryPage(params);return R.ok().addData("page", page);
}

IP流量限制

如果看过我的代码的同学，可以还有一些IP流量限制的代码我没有讲解，感兴趣的同学可以查看【智能排班系统】基于Redis的increment命令和lua脚本实现IP限流

sss-system模块实现

Service实现

登录日志实现类

package com.dam.service.impl.security;import com.dam.dao.LoginLogDao;
import com.dam.model.entity.system.LoginLogEntity;
import com.dam.service.RecordLoginLogService;
import com.dam.utils.ServletUtils;
import eu.bitwalker.useragentutils.UserAgent;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;//@Service("systemRecordLoginLogServiceImpl")
@Service
public class RecordLoginLogServiceImpl implements RecordLoginLogService {@Autowiredprivate LoginLogDao loginLogDao;@Overridepublic void recordLoginLog(String username, Integer status, String ipaddr, String message, Long enterpriseId, Long storeId) {LoginLogEntity sysLoginLog = new LoginLogEntity();sysLoginLog.setUsername(username);sysLoginLog.setIpaddr(ipaddr);sysLoginLog.setMsg(message);// 日志状态sysLoginLog.setStatus(status);/// 获取用户的浏览器和操作系统final UserAgent userAgent = UserAgent.parseUserAgentString(ServletUtils.getRequest().getHeader("User-Agent"));// 获取客户端操作系统String os = userAgent.getOperatingSystem().getName();sysLoginLog.setOs(os);// 获取客户端浏览器String browser = userAgent.getBrowser().getName();sysLoginLog.setBrowser(browser);/// 存储用户的企业 门店信息if (enterpriseId != null) {sysLoginLog.setEnterpriseId(enterpriseId);}if (storeId != null) {sysLoginLog.setStoreId(storeId);}loginLogDao.insert(sysLoginLog);}//    @Override
//    public IPage<LoginLogEntity> selectPage(Page<LoginLogEntity> pageParam, LoginLogQueryVo sysLoginLogQueryVo) {
//        //获取条件值
//        String username = sysLoginLogQueryVo.getUsername();
//        String createTimeBegin = sysLoginLogQueryVo.getCreateTimeBegin();
//        String createTimeEnd = sysLoginLogQueryVo.getCreateTimeEnd();
//        //封装条件
//        QueryWrapper<LoginLogEntity> wrapper = new QueryWrapper<>();
//        if (!StringUtils.isEmpty(username)) {
//            wrapper.like("username", username);
//        }
//        if (!StringUtils.isEmpty(createTimeBegin)) {
//            wrapper.ge("create_time", createTimeBegin);
//        }
//        if (!StringUtils.isEmpty(createTimeBegin)) {
//            wrapper.le("create_time", createTimeEnd);
//        }
//        //调用mapper方法
//        IPage<LoginLogEntity> pageModel = loginLogDao.selectPage(pageParam, wrapper);
//        return pageModel;
//    }@Overridepublic LoginLogEntity getById(Long id) {return loginLogDao.selectById(id);}//    @Override
//    public PageUtils queryPage(Map<String, Object> params) {
//        IPage<LoginLogEntity> page = this.page(
//                new Query<LoginLogEntity>().getPage(params),
//                new QueryWrapper<LoginLogEntity>().orderByDesc("create_time")
//        );
//
//        return new PageUtils(page);
//    }
}

这段代码定义了一个名为UserDetailsServiceImpl的类，实现了Spring Security的UserDetailsService接口，用于根据用户名加载用户详细信息，包括用户权限

package com.dam.service.impl.security;import com.dam.custom.CustomUser;
import com.dam.model.entity.system.UserEntity;
import com.dam.model.enums.system.UserCodeEnum;
import com.dam.service.MenuService;
import com.dam.service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Component;
import org.springframework.stereotype.Service;import java.util.ArrayList;
import java.util.List;@Service
public class UserDetailsServiceImpl implements UserDetailsService {@Autowiredprivate UserService sysUserService;@Autowiredprivate MenuService menuService;@Overridepublic UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {System.out.println("根据用户名查询用户授权信息----------------------------------------------------------------------------");// 通过UserService根据用户名查询用户信息UserEntity sysUser = sysUserService.getUserInfoByUsername(username);// 用户信息不存在时抛出异常if (null == sysUser) {throw new UsernameNotFoundException("用户名不存在，请检查输入是否错误");}// 判断用户状态，如被禁用则抛出异常if (sysUser.getStatus().intValue() == UserCodeEnum.STATUS_BAN.getCode().intValue()) {throw new RuntimeException("账号已被禁用，请咨询管理员");}// 根据userId查询操作权限List<String> userPermsList = menuService.getUserButtonList(sysUser.getId());System.out.println("用户可操作按钮，userPermsList:" + userPermsList);// 转化成security要求的格式数据List<SimpleGrantedAuthority> authorities = new ArrayList<>();for (String perm : userPermsList) {authorities.add(new SimpleGrantedAuthority(perm.trim()));}return new CustomUser(sysUser, authorities);}}

UserDetailsService实现类

package com.dam.service.impl.security;import com.dam.custom.CustomUser;
import com.dam.model.entity.system.UserEntity;
import com.dam.model.enums.system.UserCodeEnum;
import com.dam.service.MenuService;
import com.dam.service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;import java.util.ArrayList;
import java.util.List;@Service
public class UserDetailsServiceImpl implements UserDetailsService {@Autowiredprivate UserService sysUserService;@Autowiredprivate MenuService menuService;@Overridepublic UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {System.out.println("根据用户名查询用户授权信息----------------------------------------------------------------------------");// 通过UserService根据用户名查询用户信息UserEntity sysUser = sysUserService.getUserInfoByUsername(username);// 用户信息不存在时抛出异常if (null == sysUser) {throw new UsernameNotFoundException("用户名不存在，请检查输入是否错误");}// 判断用户状态，如被禁用则抛出异常if (sysUser.getStatus().intValue() == UserCodeEnum.STATUS_BAN.getCode().intValue()) {throw new RuntimeException("账号已被禁用，请咨询管理员");}// 根据userId查询操作权限List<String> userPermsList = menuService.getUserButtonList(sysUser.getId());System.out.println("用户可操作按钮，userPermsList:" + userPermsList);// 转化成security要求的格式数据List<SimpleGrantedAuthority> authorities = new ArrayList<>();for (String perm : userPermsList) {authorities.add(new SimpleGrantedAuthority(perm.trim()));}return new CustomUser(sysUser, authorities);}}

测试

读者们可能看到上面的代码，整个人是一脸懵逼，这么多类，这么多方法，究竟是怎么执行的，下面我通过测试给出了调用链路，大家可以跟着顺序来理解上面的代码

登录失败测试

模拟密码错误，代码的执行顺序如下：

>>>>> 调用 TokenAuthenticationFilter 的 doFilterInternal
>>>>> 调用 TokenLoginFilter 的 attemptAuthentication
>>>>> 调用 UserDetailsServiceImpl 的 loadUserByUsername
>>>>> 调用 CustomMd5PasswordEncoder 的 matches
>>>>> 调用 TokenLoginFilter 的 unsuccessfulAuthentication

登录成功测试

输入正确密码，代码的执行顺序如下：

>>>>> 调用 TokenAuthenticationFilter 的 doFilterInternal
>>>>> 调用 TokenLoginFilter 的 attemptAuthentication
>>>>> 调用 UserDetailsServiceImpl 的 loadUserByUsername
>>>>> 调用 CustomMd5PasswordEncoder 的 matches
>>>>> 调用 TokenLoginFilter 的 successfulAuthentication
>>>>> 调用 RecordLoginLogServiceImpl 的 recordLoginLog

其他请求测试

发起一个除了登录之外的请求，代码的执行顺序如下：

>>>>> 调用 TokenAuthenticationFilter 的 doFilterInternal
>>>>> 调用 TokenAuthenticationFilter 的 getAuthentication

其他建议

如果对用户权限标识存储有什么不理解的地方，可以参考【智能排班系统】数据库设计的菜单表、角色表、用户表、角色菜单中间表、用户角色中间表。