Security - 源码与流程

package cn.kbt.util;

import cn.kbt.security.JwtAuthenticatioToken;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;

import javax.servlet.http.HttpServletRequest;
import java.io.Serializable;
import java.util.*;

/**
 * @author Young Kbt
 * @date 2021/12/24 15:49
 * @description JWT 工具类
 */
public class JwtTokenUtils implements Serializable {

    private static final long serialVersionUID = 1L;

    /**
     * 用户名称，可自定义，或者获取官方提供
     */
    private static final String USERNAME = Claims.SUBJECT;
    /**
     * 创建时间
     */
    private static final String CREATED = "created";
    /**
     * 权限列表
     */
    private static final String AUTHORITIES = "authorities";
    /**
     * 密钥，自定义，根据密钥生成 token，或还原 token
     */
    private static final String SECRET = "abcdefgh";
    /**
     * 有效期 12 小时
     */
    private static final long EXPIRE_TIME = 12 * 60 * 60 * 1000;

    /**
     * 生成令牌
     * @param authentication 认证信息
     * @return 令牌
     */
    public static String generateToken(Authentication authentication) {
        Map<String, Object> claims = new HashMap<>(3);
        claims.put(USERNAME, SecurityUtils.getUsername(authentication));
        claims.put(CREATED, new Date());
        claims.put(AUTHORITIES, authentication.getAuthorities());
        return generateToken(claims);
    }

    /**
     * 从数据声明生成令牌
     * @param claims 数据声明
     * @return 令牌
     */
    private static String generateToken(Map<String, Object> claims) {
        Date expirationDate = new Date(System.currentTimeMillis() + EXPIRE_TIME);
        return Jwts.builder().setClaims(claims).setExpiration(expirationDate).signWith(SignatureAlgorithm.HS512, SECRET).compact();
    }

    /**
     * 从令牌中获取用户名
     * @param token 令牌
     * @return 用户名
     */
    public static String getUsernameFromToken(String token) {
        String username;
        try {
            Claims claims = getClaimsFromToken(token);
            username = claims.getSubject();
        } catch (Exception e) {
            username = null;
        }
        return username;
    }

    /**
     * 根据请求令牌获取登录认证信息
     * @param request 客户端的请求
     * @return 用户名
     */
    public static Authentication getAuthenticationeFromToken(HttpServletRequest request) {
        Authentication authentication = null;
        // 获取请求携带的令牌
        String token = JwtTokenUtils.getToken(request);
        // 如果请求令牌不为空
        if (token != null) {
            // 如果在 Security 上下文检测没有登录过
            if (SecurityUtils.getAuthentication() == null) {
                // 根据 token 获取曾经登录的数据证明
                Claims claims = getClaimsFromToken(token);
                if (claims == null) {
                    return null;
                }
                String username = claims.getSubject();
                if (username == null) {
                    return null;
                }
                // 如果 token 过期
                if (isTokenExpired(token)) {
                    return null;
                }
                // 获取用户的权限列表
                Object authors = claims.get(AUTHORITIES);
                List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
                // 如果用户权限是集合，则存入新的集合里
                if (authors != null && authors instanceof List) {
                    for (Object object : (List) authors) {
                        authorities.add(new SimpleGrantedAuthority((String) ((Map) object).get("authority")));
                    }
                }
                authentication = new JwtAuthenticatioToken(username, null, authorities, token);
            } else {
                // 如果上下文有用户登录过，则检查是否是当前用户
                if (validateToken(token, SecurityUtils.getUsername())) {
                    // 如果上下文中 Authentication 非空，且请求令牌合法，直接返回当前登录认证信息
                    authentication = SecurityUtils.getAuthentication();
                }
            }
        }
        return authentication;
    }

    /**
     * 从令牌中获取数据声明
     * @param token 令牌
     * @return 数据声明
     */
    private static Claims getClaimsFromToken(String token) {
        Claims claims;
        try {
            claims = Jwts.parser().setSigningKey(SECRET).parseClaimsJws(token).getBody();
        } catch (Exception e) {
            claims = null;
        }
        return claims;
    }

    /**
     * 验证令牌
     * @param token 令牌
     * @param username 用户名
     * @return 令牌是否正确
     */
    public static Boolean validateToken(String token, String username) {
        String userName = getUsernameFromToken(token);
        return (userName.equals(username) && !isTokenExpired(token));
    }

    /**
     * 刷新令牌
     * @param token 令牌
     * @return 新的令牌
     */
    public static String refreshToken(String token) {
        String refreshedToken;
        try {
            Claims claims = getClaimsFromToken(token);
            claims.put(CREATED, new Date());
            refreshedToken = generateToken(claims);
        } catch (Exception e) {
            refreshedToken = null;
        }
        return refreshedToken;
    }

    /**
     * 判断令牌是否过期
     * @param token 令牌
     * @return 是否过期
     */
    public static Boolean isTokenExpired(String token) {
        try {
            Claims claims = getClaimsFromToken(token);
            Date expiration = claims.getExpiration();
            return expiration.before(new Date());
        } catch (Exception e) {
            return false;
        }
    }

    /**
     * 根据请求获取 token
     * @param request 用户请求
     * @return 令牌
     */
    public static String getToken(HttpServletRequest request) {
        String token = request.getHeader("Authorization");
        String tokenHead = "Bearer ";
        if (token == null) {
            token = request.getHeader("token");
        } else if (token.contains(tokenHead)) {
            // 把 Bearer 去掉，只要后面的 token 值
            token = token.substring(tokenHead.length());
        }
        if ("".equals(token)) {
            token = null;
        }
        return token;
    }
}

package cn.kbt.util;

import cn.kbt.security.JwtAuthenticatioToken;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;

import javax.servlet.http.HttpServletRequest;

/**
 * @author Young Kbt
 * @date 2021/12/24 15:50
 * @description
 */
public class SecurityUtils {

    /**
     * 系统登录认证
     * @param request 客户端请求
     * @param username 当前用户名
     * @param password 当前用户密码
     * @param authenticationManager 认证对象
     * @return 认证后的用户信息，内容包括 token
     */
    public static JwtAuthenticatioToken login(HttpServletRequest request, String username, String password, AuthenticationManager authenticationManager) {
        JwtAuthenticatioToken token = new JwtAuthenticatioToken(username, password);
        // token 存入 request 的相关信息
        token.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
        // 执行登录认证过程，获取调用 UserDetailsServiceImpl 的 loadUserByUsername 方法
        Authentication authentication = authenticationManager.authenticate(token);
        // 认证成功存储认证信息到上下文
        SecurityContextHolder.getContext().setAuthentication(authentication);
        // 生成令牌并返回给客户端 
        token.setToken(JwtTokenUtils.generateToken(authentication));
        return token;
    }

    /**
     * 获取令牌进行认证
     * @param request 客户端请求
     */
    public static void checkAuthentication(HttpServletRequest request) {
        // 获取令牌并根据令牌获取登录认证信息
        Authentication authentication = JwtTokenUtils.getAuthenticationeFromToken(request);
        // 设置登录认证信息到上下文
        SecurityContextHolder.getContext().setAuthentication(authentication);
    }

    /**
     * 从上下文获取当前用户名
     * @return 当前用户名
     */
    public static String getUsername() {
        String username = null;
        Authentication authentication = getAuthentication();
        if (authentication != null) {
            Object principal = authentication.getPrincipal();
            if (principal != null && principal instanceof UserDetails) {
                username = ((UserDetails) principal).getUsername();
            } else {
                return String.valueOf(principal);
            }
        }
        return username;
    }

    /**
     * 从传入的认证信息中获取用户名
     * @return 用户名
     */
    public static String getUsername(Authentication authentication) {
        String username = null;
        if (authentication != null) {
            Object principal = authentication.getPrincipal();
            if (principal != null && principal instanceof UserDetails) {
                username = ((UserDetails) principal).getUsername();
            } else {
                return String.valueOf(principal);
            }
        }
        return username;
    }

    /**
     * 从上下文获取当前登录信息
     * @return 当前登录信息
     */
    public static Authentication getAuthentication() {
        if (SecurityContextHolder.getContext() == null) {
            return null;
        }
        return SecurityContextHolder.getContext().getAuthentication();
    }
}

/**
 * @author Kele-Bingtang
 * @date 2022/12/10 23:45
 * @note 登录认证成功处理器类
 */
@Component
public class LoginSuccessHandler implements AuthenticationSuccessHandler {
    private final Logger LOGGER = LoggerFactory.getLogger(this.getClass());

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        // 设置客户端的响应的内容类型
        response.setContentType("application/json;charset=UTF-8");

        // 获取当登录用户信息
        User user = (User) authentication.getPrincipal();

        // 生成 token
        String token = JwtTokenUtils.generateToken(authentication);

        LOGGER.info("用户 {} 登录成功，token 为 {}", user.getUsername(), token);

        // 获取输出流
        response.setCharacterEncoding("UTF-8");
        response.setContentType("application/json");
        PrintWriter writer = response.getWriter();
        writer.println(new ObjectMapper().writeValueAsString(HttpResult.ok(token)));
        writer.flush();
        writer.close();
    }
}

/**
 * @author Kele-Bingtang
 * @date 2022/12/10 23:51
 * @note 用户认证失败处理类
 */
public class LoginFailureHandler implements AuthenticationFailureHandler {
    private final Logger LOGGER = LoggerFactory.getLogger(this.getClass());
    
    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
        // 设置客户端响应编码格式
        response.setContentType("application/json;charset=UTF-8");
        // 获取输出流
        PrintWriter writer = response.getWriter();
        // 判断异常类型
        ResponseStatusEnum responseStatusEnum = ResponseStatusEnum.LOGIN_FAIL;
        if (exception instanceof AccountExpiredException) {
            responseStatusEnum = ResponseStatusEnum.USER_ACCOUNT_EXPIRED;
        } else if (exception instanceof BadCredentialsException) {
            responseStatusEnum = ResponseStatusEnum.USERNAME_PASSWORD_ERROR;
        } else if (exception instanceof CredentialsExpiredException) {
            responseStatusEnum = ResponseStatusEnum.USER_PASSWORD_EXPIRED;
        } else if (exception instanceof DisabledException) {
            responseStatusEnum = ResponseStatusEnum.USER_ACCOUNT_DISABLE;
        } else if (exception instanceof LockedException) {
            responseStatusEnum = ResponseStatusEnum.USER_ACCOUNT_LOCKED;
        } else if (exception instanceof InternalAuthenticationServiceException) {
            responseStatusEnum = ResponseStatusEnum.USER_ACCOUNT_NOT_EXIST;
        }
        LOGGER.error("Exception：{}", responseStatusEnum.getMessage());
        // 将错误信息转换成 JSON
        writer.println(new ObjectMapper().writeValueAsString(HttpResult.processResult(null, responseStatusEnum)));
        writer.flush();
        writer.close();
    }
}

/**
 * @author Young Kbt
 * @date 2022/4/30 15:19
 * @note 响应状态枚举类
 */
public enum ResponseStatusEnum {
    SUCCESS(200, "success", "操作成功！"),
    FAIL(600, "fail", "操作失败！"),
    ERROR(700, "error", "操作错误！"),
    VALIDATION_ERROR(1001, "error", "传递的参数不符合要求"),
    CONDITION_SQL_ERROR(1002, "error", "字段不存在"),
    LOGIN_FAIL(1003, "fail", "登录失败"),
    USER_REGISTER_FAILED(1004, "fail", "注册失败"),
    USER_ACCOUNT_EXISTED(1005,"fail", "用户名已存在"),
    USER_ACCOUNT_EXPIRED(1006,"fail","账号过期"),
    USERNAME_PASSWORD_ERROR(1007,"fail","用户名或密码错误"),
    USER_PASSWORD_EXPIRED(1008,"fail","账号过期"),
    USER_ACCOUNT_DISABLE(1009,"fail","账号禁用"),
    USER_ACCOUNT_LOCKED(1010,"fail","账号锁定"),
    USER_ACCOUNT_NOT_EXIST(1011,"fail","账号不存在");

    private Integer code;

    private String status;

    private String message;

    private ResponseStatusEnum(Integer code, String status, String message) {
        this.code = code;
        this.status = status;
        this.message = message;
    }

    // setter getter ...
}

public class TokenLoginFilter extends UsernamePasswordAuthenticationFilter {
 
    private AuthenticationManager authenticationManager;
    private RsaKeyProperties prop;
 
    public TokenLoginFilter(AuthenticationManager authenticationManager, RsaKeyProperties prop) {
        this.authenticationManager = authenticationManager;
        this.prop = prop;
    }
 
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        try {
            UserPojo sysUser = new ObjectMapper().readValue(request.getInputStream(), UserPojo.class);
 
            UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(sysUser.getUsername(), sysUser.getPassword());
            return authenticationManager.authenticate(authRequest);
        }catch (Exception e){
            try {
                response.setContentType("application/json;charset=utf-8");
                response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
                PrintWriter out = response.getWriter();
                Map resultMap = new HashMap();
                resultMap.put("code", HttpServletResponse.SC_UNAUTHORIZED);
                resultMap.put("msg", "用户名或密码错误！");
                out.write(new ObjectMapper().writeValueAsString(resultMap));
                out.flush();
                out.close();
            }catch (Exception outEx){
                outEx.printStackTrace();
            }
            throw new RuntimeException(e);
        }
    }
 
    public void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
        UserPojo user = new UserPojo();
        user.setUsername(authResult.getName());
        user.setRoles((List<RolePojo>)authResult.getAuthorities());
        // 生成 token
        String token = JwtTokenUtils.generateToken(authResult);
        response.addHeader("Authorization", "Bearer " + token);
        try {
            response.setContentType("application/json;charset=utf-8");
            response.setStatus(HttpServletResponse.SC_OK);
            PrintWriter out = response.getWriter();
            Map resultMap = new HashMap();
            resultMap.put("code", HttpServletResponse.SC_OK);
            resultMap.put("msg", "认证通过！");
            out.write(new ObjectMapper().writeValueAsString(resultMap));
            out.flush();
            out.close();
        }catch (Exception outEx){
            outEx.printStackTrace();
        }
    }
}

@RestController
public class JwtAuthController {

    @Autowired
    private AuthenticationManager authenticationManager;
    
    @Autowired
    private UserService userService;
    
    @Autowired
    private BCryptPasswordEncoder bCryptPasswordEncoder;
    
    @PostMapping("/login")
    public HttpResult login(@RequestParam("username") String username, @RequestParam("password") String password, HttpServletRequest request) {
        User user = userService.findByUsername(username);
        // 账号不存在
        if (user == null) {
            return HttpResult.error("账号不存在");
        // 数据库的密码是加密过的
        }else if(!bCryptPasswordEncoder.matches(password,user.getPassword())) {
            return HttpResult.error("密码不正确");
        }
        
        // 该工具类是进行权限认证，将用户存入 Security 里
        JwtAuthenticationToken token = SecurityUtils.login(request, username, password, authenticationManager);
        return HttpResult.ok(token);
    }   
}