Spring Security 系列(1)

<!--Spring Security 包引入-->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<!--Spring Boot Web 包引入-->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>
<!--Spring Boot 测试包引入-->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-test</artifactId>
    <scope>test</scope>
</dependency>
<!--Spring Security 测试包引入-->
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-test</artifactId>
    <scope>test</scope>
</dependency>

server:
  port: 8088 # 服务器端口

// Step1: 创建自己的 WebSecurityConfigurerAdapter
@Configuration
public class MyWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
    // Step2: 重写 configure 方法
    @Override
    public void configure(HttpSecurity http){
       
    }
}

// 注入密码加密器
@Bean
PasswordEncoder passwordEncoder(){
    // return new BCryptPasswordEncoder();
    // return new Argon2PasswordEncoder();
    // return new SCryptPasswordEncoder();
    return new Pbkdf2PasswordEncoder();
}

String password = "RawPassword";
String pwdCrypt = passwordEncoder.encode(password);
passwordEncoder.matches(password,pwdCrypt);

    @Override
    public void configure(HttpSecurity http){
        try {
            http.formLogin()
                    .usernameParameter("usr")// 设定登陆时用户名的参数名，默认为 username
                    .passwordParameter("pwd")// 设定登陆时密码的参数名,默认为 password
                    .loginPage("login.html") // 设定登陆页面
                    .loginProcessingUrl("/login") // 处理登陆的 url
                    .successForwardUrl("/loginSuccess") // 登陆成功后跳转的 url
                    .successHandler(new AuthenticationSuccessHandler() { // 登陆成功的处理器
                        @Override
                        public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
                        }
                    }).failureForwardUrl("/loginFailure") // 失败跳转的 url
                    .failureHandler(new AuthenticationFailureHandler() { // 失败的请求处理器
                        @Override
                        public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
                        }
                    });
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    @Override
    public void configure(HttpSecurity http){
        try {
            http.authorizeRequests()
                    .antMatchers(HttpMethod.POST,"/login").permitAll()
                    .antMatchers(HttpMethod.OPTIONS).permitAll()
                    .antMatchers("/status").permitAll() // 允许所有请求通过访问
                    .regexMatchers("*.png").permitAll() // 通过正则表达式进行匹配
                    .antMatchers("/userResource").hasAuthority("USER") // 具有某个权限后方可访问
                    .antMatchers("/userResource1").hasAnyAuthority("SYS","USER") // 具有任意一个权限后方可访问
                    .antMatchers("/roleResource").hasRole("role1") // 具有某个角色后方可访问，角色的权限名称为 “ROLE_” 前缀加上角色名称
                    .antMatchers("/roleResource1").hasAnyRole("role1","role2")// 具有任意一个角色后方可访问
                    .antMatchers("/accessAuthority").access("hasAnyAuthority(SYS,USER)")// 具有任意一个权限后方可访问
                    .antMatchers("/accessRoles").access("hasAnyRole(role1,role2)")// 具有任意一个角色后方可访问
                    .anyRequest().authenticated(); // 其余任何请求都需要经过访问
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    @Override
    public void configure(HttpSecurity http){
        try {
            http.rememberMe().rememberMeParameter("remeberme")
                    .tokenRepository(new InMemoryTokenRepositoryImpl()) // 设置 Token 仓库，用于存储，更新，和获得 Token
                    .userDetailsService(username -> // 配置验证时的 UserDetailService
                            new User(username,"pwd", AuthorityUtils.commaSeparatedStringToAuthorityList("sys")))
                    .tokenValiditySeconds(1800);//token 有效时间
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

@Service
public class MyUserDetailsService implements UserDetailsService{
    @Autowired
    private PasswordEncoder passwordEncoder;
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        String password = "pwd";
        String pwdCrypt = passwordEncoder.encode(password);// 模拟从数据中取出密码
        List<SimpleGrantedAuthority> authorityList = new ArrayList<>();
        authorityList.add(new SimpleGrantedAuthority("ROLE_user"));
        // 这里只是模拟，实际可以与数据库进行交互获得用户权限
        UserDetails user = new User(username,pwdCrypt,authorityList);
        return user;
    }
}

    // 注入创建的 UserService
    @Bean
    public MyUserDetailsService myUserDetailsService(){
        return new MyUserDetailsService();
    }
    
    // 重写 Configure 方法，使配置生效
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(myUserDetailsService()) // 注入 UserDetailsService
                .passwordEncoder(passwordEncoder());
    }
    // 将代理 AuthenticationManager 注册成 Bean，供直接使用
    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

@Component
public class MyAuthenticationEntryPoint implements AuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
        response.sendError(HttpStatus.UNAUTHORIZED.value(), HttpStatus.UNAUTHORIZED.getReasonPhrase()); // 自定义处理返回信息
    }
}

    @Autowired
    MyAuthenticationEntryPoint authenticationEntryPoint; // 注入自己实现的 EntryPoint
    // Step2: 重写 configure 方法
    @Override
    public void configure(HttpSecurity http){
        try {
            http.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }