①自定义登录接口

注意配置passwordEncoder为BCryptPasswordEncoder

准备工作

clazz;static{ParserConfig.getGlobalInstance().setAutoTypeSupport(true);}public

byte[]

SerializerFeature.WriteClassName).getBytes(DEFAULT_CHARSET);}Overridepublic

deserialize(byte[]

TypeFactory.defaultInstance().constructType(clazz);}

RedisConfig

redisTemplate(RedisConnectionFactory

connectionFactory){RedisTemplateObject,

Object

RedisTemplate();template.setConnectionFactory(connectionFactory);FastJsonRedisSerializer

serializer

FastJsonRedisSerializer(Object.class);//

使用StringRedisSerializer来序列化和反序列化redis的key值template.setKeySerializer(new

StringRedisSerializer());template.setValueSerializer(serializer);//

Hash的key也采用StringRedisSerializer的序列化方式template.setHashKeySerializer(new

StringRedisSerializer());template.setHashValueSerializer(serializer);template.afterPropertiesSet();return

template;}

设置允许跨域的路径.allowedOriginPatterns(*)

设置允许跨域请求的域名.allowCredentials(true)

POST,

跨域允许时间}Bean//使用Bean注入fastJsonHttpMessageConvertpublic

HttpMessageConverter

fastJsonHttpMessageConverters()

{//1.需要定义一个Convert转换消息的对象FastJsonHttpMessageConverter

fastConverter

newFastJsonHttpMessageConverter();FastJsonConfig

fastJsonConfig

FastJsonConfig();fastJsonConfig.setSerializerFeatures(SerializerFeature.PrettyFormat);fastJsonConfig.setDateFormat(yyyy-MM-dd

HH:mm:ss);//

SerializeConfig.globalInstance.put(Long.class,

ToStringSerializer.instance);fastJsonConfig.setSerializeConfig(SerializeConfig.globalInstance);fastConverter.setFastJsonConfig(fastJsonConfig);HttpMessageConverter?

converter

configureMessageConverters(ListHttpMessageConverter?

converters)

{converters.add(fastJsonHttpMessageConverters());}}

WebUtils

renderString(HttpServletResponse

response,

{try{response.setStatus(200);response.setContentType(application/json);response.setCharacterEncoding(utf-8);response.getWriter().print(string);}catch

(IOException

e){e.printStackTrace();}}public

static

context.getMimeType(filename);//获取文件的mime类型response.setHeader(content-type,mimeType);String

fname

URLEncoder.encode(filename,UTF-8);response.setHeader(Content-disposition,attachment;

filenamefname);//

response.setContentType(application/vnd.openxmlformats-officedocument.spreadsheetml.sheet);

response.setCharacterEncoding(utf-8);}

RedisCache

value){redisTemplate.opsForValue().set(key,

value);}/***

timeUnit){redisTemplate.opsForValue().set(key,

value,

redisTemplate.opsForValue();return

删除单个对象**

redisTemplate.delete(key);}/***

删除集合对象**

redisTemplate.delete(collection);}/***

缓存List数据**

redisTemplate.opsForList().rightPushAll(key,

dataList);return

redisTemplate.opsForList().range(key,

-1);}/***

dataSet){BoundSetOperationsString,

setOperation

redisTemplate.boundSetOps(key);IteratorT

(it.hasNext()){setOperation.add(it.next());}return

setOperation;}/***

redisTemplate.opsForSet().members(key);}/***

缓存Map**

{redisTemplate.opsForHash().putAll(key,

dataMap);}}/***

redisTemplate.opsForHash().entries(key);}/***

往Hash中存入数据**

value){redisTemplate.opsForHash().put(key,

hKey,

redisTemplate.opsForHash();return

opsForHash.get(key,

redisTemplate.opsForHash();hashOperations.delete(key,

hkey);}/***

redisTemplate.opsForHash().multiGet(key,

hKeys);}/***

UUID.randomUUID().toString().replaceAll(-,

);return

SignatureAlgorithm.HS256;SecretKey

secretKey

System.currentTimeMillis();Date

now

Date(nowMillis);if(ttlMillisnull){ttlMillisJwtUtil.JWT_TTL;}long

expMillis

签发时间.signWith(signatureAlgorithm,

secretKey)

第二个参数为秘钥.setExpiration(expDate);}/***

创建token*

eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiJjYWM2ZDVhZi1mNjVlLTQ0MDAtYjcxMi0zYWEwOGIyOTIwYjQiLCJzdWIiOiJzZyIsImlzcyI6InNnIiwiaWF0IjoxNjM4MTA2NzEyLCJleHAiOjE2MzgxMTAzMTJ9.JVsSbkP94wuczb4QryQbAke3ysBDIL5ou8fWsbt_ebg;Claims

claims

parseJWT(token);System.out.println(claims);}/***

secretKey*

Base64.getDecoder().decode(JwtUtil.JWT_KEY);SecretKey

key

Jwts.parser().setSigningKey(secretKey).parseClaimsJws(jwt).getBody();}}

代码实现

blogLoginService;PostMapping(/login)public

ResponseResult

blogLoginService.login(user);}}BlogLoginService

public

super.au***nticationManagerBean();}Autowiredprivate

jwtAu***nticationTokenFilter;Overrideprotected

void

{http//关闭csrf.csrf().disable()//不通过Session获取SecurityContext.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and().authorizeRequests()//

对于登录接口

允许匿名访问.antMatchers(/login).anonymous().antMatchers(/link/getAllLink).au***nticated()//

除上面外的所有请求全部不需要认证即可访问.anyRequest().permitAll();http.logout().disable();http.addFilterBefore(jwtAu***nticationTokenFilter,

UsernamePasswordAu***nticationFilter.class);//允许跨域http.cors();}Beanpublic

PasswordEncoder

au***nticationManager;Autowiredprivate

RedisCache

{UsernamePasswordAu***nticationToken

au***nticationToken

UsernamePasswordAu***nticationToken(user.getUserName(),user.getPassword());Au***ntication

au***nticate

au***nticationManager.au***nticate(au***nticationToken);//判断是否认证通过if(Objects.isNull(au***nticate)){throw

new

RuntimeException(用户名或密码错误);}//获取userId

生成tokenLoginUser

au***nticate.getPrincipal();String

userId

loginUser.getUser().getId().toString();String

jwt

JwtUtil.createJWT(userId);//把用户信息存入redisredisCache.setCacheObject(blogLogin:userId,loginUser);//把token和userInfo封装

返回//把User转换UserInfoVOUserInfoVO

userInfoVO

BeanCopyUtils.copyBean(loginUser.getUser(),

UserInfoVO.class);BlogUserLoginVO

new

BlogUserLoginVO(jwt,userInfoVO);return

新建UserDetailServiceImpl实现UserDetailService

在这个实现类中去查询数据库

注意配置passwordEncoder为BCryptPasswordEncoder

Service

{//根据用户名查询用户信息LambdaQueryWrapperUser

queryWrapper

LambdaQueryWrapper();queryWrapper.eq(User::getUserName,username);User

user

userMapper.selectOne(queryWrapper);//判断是否查到用户

如果没查到抛出异常if

RuntimeException(用户不存在);}//返回用户信息//TODO

查询权限信息封装return

user.getPassword();}Overridepublic

String

user.getUserName();}Overridepublic

boolean

doFilterInternal(HttpServletRequest

request,

request.getHeader(token);if(!StringUtils.hasText(token)){//说明该接口不需要登录

直接放行filterChain.doFilter(request,response);return;}//解析获取userIdClaims

claims

token非法//响应告诉前端需要重新登录ResponseResult

result

ResponseResult.errorResult(AppHttpCodeEnum.NEED_LOGIN);WebUtils.renderString(response,

JSON.toJSONString(result));return;}String

userId

claims.getSubject();//从redis中获取用户信息LoginUser

loginUser

redisCache.getCacheObject(blogLogin:

userId);//如果获取不到if(Objects.isNull(loginUser)){//说明登录过期

提示重新登录ResponseResult

ResponseResult.errorResult(AppHttpCodeEnum.NEED_LOGIN);WebUtils.renderString(response,

JSON.toJSONString(result));return;}//存入SecurityContextHolderUsernamePasswordAu***nticationToken

au***nticationToken

UsernamePasswordAu***nticationToken(loginUser,null,null);SecurityContextHolder.getContext().setAu***ntication(au***nticationToken);filterChain.doFilter(request,response);}

SecurityConfig

super.au***nticationManagerBean();}Autowiredprivate

jwtAu***nticationTokenFilter;Overrideprotected

void

{http//关闭csrf.csrf().disable()//不通过Session获取SecurityContext.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and().authorizeRequests()//

对于登录接口

允许匿名访问.antMatchers(/login).anonymous().antMatchers(/link/getAllLink).au***nticated()//

除上面外的所有请求全部不需要认证即可访问.anyRequest().permitAll();http.logout().disable();http.addFilterBefore(jwtAu***nticationTokenFilter,

UsernamePasswordAu***nticationFilter.class);//允许跨域http.cors();}Beanpublic

PasswordEncoder

目前我们的项目在认证出错或者权限不足的时候响应回来的Json是Security的异常处理结果。

但是这个

响应的格式肯定是不符合我们项目的接口规范的。

所以需要自定义异常处理。

认证失败处理器

{e.printStackTrace();//InsufficientAu***nticationException//BadCredentialsExceptionResponseResult

result

BadCredentialsException){result

ResponseResult.errorResult(AppHttpCodeEnum.LOGIN_ERROR.getCode(),e.getMessage());}else

instanceof

InsufficientAu***nticationException){result

ResponseResult.errorResult(AppHttpCodeEnum.NEED_LOGIN);}else

{result

ResponseResult.errorResult(AppHttpCodeEnum.SYSTEM_ERROR.getCode(),认证或授权失败);}//响应给前端WebUtils.renderString(response,

AccessDeniedHandler

{e.printStackTrace();ResponseResult

result

ResponseResult.errorResult(AppHttpCodeEnum.NO_OPERATOR_AUTH);//响应给前端WebUtils.renderString(response,

配置Security异常处理器

super.au***nticationManagerBean();}Autowiredprivate

jwtAu***nticationTokenFilter;AutowiredAu***nticationEntryPoint

au***nticationEntryPoint;AutowiredAccessDeniedHandler

accessDeniedHandler;Overrideprotected

void

{http//关闭csrf.csrf().disable()//不通过Session获取SecurityContext.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and().authorizeRequests()//

对于登录接口

允许匿名访问.antMatchers(/login).anonymous().antMatchers(/link/getAllLink).au***nticated()//

除上面外的所有请求全部不需要认证即可访问.anyRequest().permitAll();//配置异常处理器http.exceptionHandling().au***nticationEntryPoint(au***nticationEntryPoint).accessDeniedHandler(accessDeniedHandler);http.logout().disable();http.addFilterBefore(jwtAu***nticationTokenFilter,

UsernamePasswordAu***nticationFilter.class);//允许跨域http.cors();}Beanpublic

PasswordEncoder

实际我们在开发过程中可能需要做很多的判断校验如果出现了非法情况我们是期望响应对应的提示

的。

但是如果我们每次都自己手动去处理就会非常麻烦。

我们可以选择直接抛出异常的方式然后对异

常进行统一处理。

把异常中的信息封装成ResponseResult响应给前端。

SystemException

SystemException(AppHttpCodeEnum

httpCodeEnum)

{super(httpCodeEnum.getMsg());this.code

httpCodeEnum.getCode();this.msg

RestControllerAdvice

{ExceptionHandler(SystemException.class)public

ResponseResult

systemExceptionHandler(SystemException

e){//打印异常信息log.error(出现了异常{},e);//从异常对象中获取提示信息封装发返回return

ResponseResult.errorResult(e.getCode(),e.getMsg());}ExceptionHandler(Exception.class)public

ResponseResult

e){//打印异常信息log.error(出现了异常{},e);//从异常对象中获取提示信息封装发返回return

ResponseResult.errorResult(AppHttpCodeEnum.SYSTEM_ERROR.getCode(),e.getMessage());}}

退出登录接口

SecurityContextHolder.getContext().getAu***ntication();LoginUser

loginUser

au***ntication.getPrincipal();//获取userIdLong

userId

loginUser.getUser().getId();//删除redis中的用户信息redisCache.deleteObject(blogLogin:userId);return

SecurityConfig

要关闭默认的退出登录功能。

并且要配置我们的退出登录接口需要认证才能访问

Overrideprotected

{http//关闭csrf.csrf().disable()//不通过Session获取SecurityContext.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and().authorizeRequests()//

对于登录接口

允许匿名访问.antMatchers(/login).anonymous().antMatchers(/logout).au***nticated().antMatchers(/link/getAllLink).au***nticated()//

除上面外的所有请求全部不需要认证即可访问.anyRequest().permitAll();//配置异常处理器http.exceptionHandling().au***nticationEntryPoint(au***nticationEntryPoint).accessDeniedHandler(accessDeniedHandler);http.logout().disable();http.addFilterBefore(jwtAu***nticationTokenFilter,

UsernamePasswordAu***nticationFilter.class);//允许跨域http.cors();}