spring security4 添加验证码的示例代码

2023-09-16 23:54:05 60

springsecurity是一个很大的模块，本文中只涉及到了自定义参数的认证。springsecurity默认的验证参数只有username和password，一般来说都是不够用的。由于时间过太久，有些忘，可能有少许遗漏。好了，不废话。
spring以及springsecurity配置采用javaConfig，版本依次为4.2.5，4.0.4
总体思路：自定义EntryPoint，添加自定义参数扩展AuthenticationToken以及AuthenticationProvider进行验证。

首先定义EntryPoint：

importorg.springframework.security.core.AuthenticationException;
importorg.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;
importjavax.servlet.ServletException;
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpServletResponse;
importjava.io.IOException;
publicclassMyAuthenticationEntryPointextendsLoginUrlAuthenticationEntryPoint{
publicMyAuthenticationEntryPoint(StringloginFormUrl){
super(loginFormUrl);
}
@Override
publicvoidcommence(HttpServletRequestrequest,HttpServletResponseresponse,AuthenticationExceptionauthException)throwsIOException,ServletException{
super.commence(request,response,authException);
}
}

接下来是token，validCode是验证码参数:

importorg.springframework.security.authentication.UsernamePasswordAuthenticationToken;
publicclassMyUsernamePasswordAuthenticationTokenextendsUsernamePasswordAuthenticationToken{
privateStringvalidCode;
publicMyUsernamePasswordAuthenticationToken(Stringprincipal,Stringcredentials,StringvalidCode){
super(principal,credentials);
this.validCode=validCode;
}
publicStringgetValidCode(){
returnvalidCode;
}
publicvoidsetValidCode(StringvalidCode){
this.validCode=validCode;
}
}

继续ProcessingFilter，

importcom.core.shared.ValidateCodeHandle;
importorg.springframework.security.core.Authentication;
importorg.springframework.security.core.AuthenticationException;
importorg.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
importorg.springframework.security.web.util.matcher.AntPathRequestMatcher;
importjavax.servlet.ServletException;
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpServletResponse;
importjavax.servlet.http.HttpSession;
importjava.io.IOException;
publicclassMyValidCodeProcessingFilterextendsAbstractAuthenticationProcessingFilter{
privateStringusernameParam="username";
privateStringpasswordParam="password";
privateStringvalidCodeParam="validateCode";
publicMyValidCodeProcessingFilter(){
super(newAntPathRequestMatcher("/user/login","POST"));
}

@Override
publicAuthenticationattemptAuthentication(HttpServletRequestrequest,HttpServletResponseresponse)throwsAuthenticationException,IOException,ServletException{
Stringusername=request.getParameter(usernameParam);
Stringpassword=request.getParameter(passwordParam);
StringvalidCode=request.getParameter(validCodeParam);
valid(validCode,request.getSession());
MyUsernamePasswordAuthenticationTokentoken=newMyUsernamePasswordAuthenticationToken(username,password,validCode);
returnthis.getAuthenticationManager().authenticate(token);
}

publicvoidvalid(StringvalidCode,HttpSessionsession){
if(validCode==null){
thrownewValidCodeErrorException("验证码为空!");
}
if(!ValidateCodeHandle.matchCode(session.getId(),validCode)){
thrownewValidCodeErrorException("验证码错误!");
}
}
}

分别定义三个参数，用于接收login表单过来的参数，构造方法给出了login的url以及需要post方式

接下来就是认证了，此处还没到认证用户名和密码的时候，只是认证了验证码

下面是ValidateCodeHandle一个工具类以及ValidCodeErrorException:

importjava.util.concurrent.ConcurrentHashMap;
publicclassValidateCodeHandle{
privatestaticConcurrentHashMapvalidateCode=newConcurrentHashMap<>();
publicstaticConcurrentHashMapgetCode(){
returnvalidateCode;
}

publicstaticvoidsave(StringsessionId,Stringcode){
validateCode.put(sessionId,code);
}

publicstaticStringgetValidateCode(StringsessionId){
Objectobj=validateCode.get(sessionId);
if(obj!=null){
returnString.valueOf(obj);
}
returnnull;
}

publicstaticbooleanmatchCode(StringsessionId,StringinputCode){
StringsaveCode=getValidateCode(sessionId);
if(saveCode.equals(inputCode)){
returntrue;
}
returnfalse;
}
}

这里需要继承AuthenticationException以表明它是security的认证失败,这样才会走后续的失败流程

importorg.springframework.security.core.AuthenticationException;
publicclassValidCodeErrorExceptionextendsAuthenticationException{

publicValidCodeErrorException(Stringmsg){
super(msg);
}
publicValidCodeErrorException(Stringmsg,Throwablet){
super(msg,t);
}
}

接下来是Provider：

importorg.springframework.security.authentication.BadCredentialsException;
importorg.springframework.security.authentication.UsernamePasswordAuthenticationToken;
importorg.springframework.security.authentication.dao.DaoAuthenticationProvider;
importorg.springframework.security.core.AuthenticationException;
importorg.springframework.security.core.userdetails.UserDetails;
publicclassMyAuthenticationProviderextendsDaoAuthenticationProvider{
@Override
publicbooleansupports(Classauthentication){
returnMyUsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication);
}

@Override
protectedvoidadditionalAuthenticationChecks(UserDetailsuserDetails,UsernamePasswordAuthenticationTokenauthentication)throwsAuthenticationException{
Objectsalt=null;
if(getSaltSource()!=null){
salt=getSaltSource().getSalt(userDetails);
}
if(authentication.getCredentials()==null){
logger.debug("Authenticationfailed:nocredentialsprovided");
thrownewBadCredentialsException("用户名或密码错误!");
}
StringpresentedPassword=authentication.getCredentials().toString();
if(!this.getPasswordEncoder().isPasswordValid(userDetails.getPassword(),presentedPassword,salt)){
logger.debug("Authenticationfailed:passworddoesnotmatchstoredvalue");

thrownewBadCredentialsException("用户名或密码错误!");
}

}
}

其中supports方法指定使用自定义的token，additionalAuthenticationChecks方法和父类的逻辑一模一样，我只是更改了异常返回的信息。

接下来是处理认证成功和认证失败的handler

importorg.springframework.security.core.Authentication;
importorg.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;
importjavax.servlet.ServletException;
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpServletResponse;
importjava.io.IOException;
publicclassFrontAuthenticationSuccessHandlerextendsSimpleUrlAuthenticationSuccessHandler{
publicFrontAuthenticationSuccessHandler(StringdefaultTargetUrl){
super(defaultTargetUrl);
}

@Override
publicvoidonAuthenticationSuccess(HttpServletRequestrequest,HttpServletResponseresponse,Authenticationauthentication)throwsIOException,ServletException{
super.onAuthenticationSuccess(request,response,authentication);
}
}

importorg.springframework.security.core.AuthenticationException;
importorg.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
importjavax.servlet.ServletException;
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpServletResponse;
importjava.io.IOException;
publicclassFrontAuthenticationFailureHandlerextendsSimpleUrlAuthenticationFailureHandler{
publicFrontAuthenticationFailureHandler(StringdefaultFailureUrl){
super(defaultFailureUrl);
}

@Override
publicvoidonAuthenticationFailure(HttpServletRequestrequest,HttpServletResponseresponse,AuthenticationExceptionexception)throwsIOException,ServletException{
super.onAuthenticationFailure(request,response,exception);
}
}

最后就是最重要的securityconfig了：

importcom.service.user.CustomerService;
importcom.web.filter.SiteMeshFilter;
importcom.web.mySecurity.*;
importorg.springframework.beans.factory.annotation.Autowired;
importorg.springframework.context.annotation.Bean;
importorg.springframework.context.annotation.Configuration;
importorg.springframework.core.annotation.Order;
importorg.springframework.security.authentication.AuthenticationManager;
importorg.springframework.security.authentication.AuthenticationProvider;
importorg.springframework.security.authentication.ProviderManager;
importorg.springframework.security.config.annotation.web.builders.HttpSecurity;
importorg.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
importorg.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
importorg.springframework.security.crypto.password.PasswordEncoder;
importorg.springframework.security.crypto.password.StandardPasswordEncoder;
importorg.springframework.security.web.access.ExceptionTranslationFilter;
importorg.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
importorg.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;
importorg.springframework.web.filter.CharacterEncodingFilter;
importjavax.servlet.DispatcherType;
importjavax.servlet.FilterRegistration;
importjavax.servlet.ServletContext;
importjava.util.ArrayList;
importjava.util.EnumSet;
importjava.util.List;

@Configuration
@EnableWebSecurity
publicclassSecurityConfigextendsAbstractSecurityWebApplicationInitializer{

@Bean
publicPasswordEncoderpasswordEncoder(){
returnnewStandardPasswordEncoder("MD5");
}

@Autowired
privateCustomerServicecustomerService;

@Configuration
@Order(1)
publicstaticclassFrontendWebSecurityConfigureAdapterextendsWebSecurityConfigurerAdapter{

@Autowired
privateMyValidCodeProcessingFiltermyValidCodeProcessingFilter;

@Override
protectedvoidconfigure(HttpSecurityhttp)throwsException{
http.csrf().disable()
.authorizeRequests()
.antMatchers("/user/login","/user/logout").permitAll()
.anyRequest().authenticated()
.and()
.addFilterBefore(myValidCodeProcessingFilter,UsernamePasswordAuthenticationFilter.class)
.formLogin()
.loginPage("/user/login")
.and()
.logout()
.logoutUrl("/user/logout")
.logoutSuccessUrl("/user/login");
}

}

@Bean(name="frontAuthenticationProvider")
publicMyAuthenticationProviderfrontAuthenticationProvider(){
MyAuthenticationProvidermyAuthenticationProvider=newMyAuthenticationProvider();
myAuthenticationProvider.setUserDetailsService(customerService);
myAuthenticationProvider.setPasswordEncoder(passwordEncoder());
returnmyAuthenticationProvider;
}

@Bean
publicAuthenticationManagerauthenticationManager(){
Listlist=newArrayList<>();
list.add(frontAuthenticationProvider());
AuthenticationManagerauthenticationManager=newProviderManager(list);
returnauthenticationManager;
}

@Bean
publicMyValidCodeProcessingFiltermyValidCodeProcessingFilter(AuthenticationManagerauthenticationManager){
MyValidCodeProcessingFilterfilter=newMyValidCodeProcessingFilter();
filter.setAuthenticationManager(authenticationManager);
filter.setAuthenticationSuccessHandler(frontAuthenticationSuccessHandler());
filter.setAuthenticationFailureHandler(frontAuthenticationFailureHandler());
returnfilter;
}

@Bean
publicFrontAuthenticationFailureHandlerfrontAuthenticationFailureHandler(){
returnnewFrontAuthenticationFailureHandler("/user/login");
}

@Bean
publicFrontAuthenticationSuccessHandlerfrontAuthenticationSuccessHandler(){
returnnewFrontAuthenticationSuccessHandler("/front/test");
}

@Bean
publicMyAuthenticationEntryPointmyAuthenticationEntryPoint(){
returnnewMyAuthenticationEntryPoint("/user/login");
}
}

首先是一个加密类的bean，customerService是一个简单的查询用户

@Service("customerService")
publicclassCustomerServiceImplimplementsCustomerService{

@Autowired
privateUserDaouserDao;

@Override
publicUserDetailsloadUserByUsername(Stringusername)throwsUsernameNotFoundException{
returnuserDao.findCustomerByUsername(username);
}
}

下来就是FrontendWebSecurityConfigureAdapter了，重写了configure方法，先禁用csrf，开启授权请求authorizeRequests()，其中”/user/login”,“/user/logout”放过权限验证，其他请求需要进行登录认证，然后是addFilterBefore()，把我自定义的myValidCodeProcessingFilter添加到security默认的UsernamePasswordAuthenticationFilter之前，也就是先进行我的自定义参数认证，然后是formLogin()，配置登录url以及登出url，登录登出url都需要进行controller映射，也就是要自己写controller。
接下来就是AuthenticationProvider，AuthenticationManager，ProcessingFilter，AuthenticationFailureHandler，AuthenticationSuccessHandler，EntryPoint的bean显示声明。

下面是login.jsp





${SPRING_SECURITY_LAST_EXCEPTION.message}

username:

password:

validateCode:
${validate_code}


记住我

验证码验证失败的时候抛出的是ValidCodeErrorException，由于它继承AuthenticationException，security在验证的时候遇到AuthenticationException就会触发AuthenticationFailureHandler，上面的bean中声明了认证失败跳转到登录url，所以login.jsp里面有${SPRING_SECURITY_LAST_EXCEPTION.message}获取我认证时抛出异常信息，能友好的提示用户。

整个自定义security验证流程就走完了

以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持毛票票。

spring security4 添加验证码的示例代码

热门推荐

随机推荐