验证码（图形、短信、邮箱）、token机制对于系统的安全性已经是老生常谈；

本文将结合spring-security快速实现Google图形验证码、token的安全性校验。

技术储备

1、UserDetailsService接口

/**
 * Core interface which loads user-specific data.
 * <p>
 * It is used throughout the framework as a user DAO and is the strategy used by the
 * {@link org.springframework.security.authentication.dao.DaoAuthenticationProvider
 * DaoAuthenticationProvider}.
 *
 * <p>
 * The interface requires only one read-only method, which simplifies support for new
 * data-access strategies.
 *
 * @see org.springframework.security.authentication.dao.DaoAuthenticationProvider
 * @see UserDetails
 *
 * @author Ben Alex
 */
public interface UserDetailsService {
	
	/**
	 * Locates the user based on the username. In the actual implementation, the search
	 * may possibly be case sensitive, or case insensitive depending on how the
	 * implementation instance is configured. In this case, the <code>UserDetails</code>
	 * object that comes back may have a username that is of a different case than what
	 * was actually requested..
	 *
	 * @param username the username identifying the user whose data is required.
	 *
	 * @return a fully populated user record (never <code>null</code>)
	 *
	 * @throws UsernameNotFoundException if the user could not be found or the user has no
	 * GrantedAuthority
	 */
	UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;
}

该接口位于org.springframework.security.core.userdetails，

主要作用：加载用户信息的核心接口；被用于DaoAuthenticationProvider的策略

2、AuthenticationFailureHandler、AuthenticationSuccessHandler接口

/**
 * Strategy used to handle a failed authentication attempt.
 * <p>
 * Typical behaviour might be to redirect the user to the authentication page (in the case
 * of a form login) to allow them to try again. More sophisticated logic might be
 * implemented depending on the type of the exception. For example, a
 * {@link CredentialsExpiredException} might cause a redirect to a web controller which
 * allowed the user to change their password.
 *
 * @author Luke Taylor
 * @since 3.0
 */
public interface AuthenticationFailureHandler {
	/**
	 * Called when an authentication attempt fails.
	 * @param request the request during which the authentication attempt occurred.
	 * @param response the response.
	 * @param exception the exception which was thrown to reject the authentication
	 * request.
	 */
	void onAuthenticationFailure(HttpServletRequest request,
			HttpServletResponse response, AuthenticationException exception)
			throws IOException, ServletException;
}

/**
 * Strategy used to handle a successful user authentication.
 * <p>
 * Implementations can do whatever they want but typical behaviour would be to control the
 * navigation to the subsequent destination (using a redirect or a forward). For example,
 * after a user has logged in by submitting a login form, the application needs to decide
 * where they should be redirected to afterwards (see
 * {@link AbstractAuthenticationProcessingFilter} and subclasses). Other logic may also be
 * included if required.
 *
 * @author Luke Taylor
 * @since 3.0
 */
public interface AuthenticationSuccessHandler {
	/**
	 * Called when a user has been successfully authenticated.
	 *
	 * @param request the request which caused the successful authentication
	 * @param response the response
	 * @param authentication the <tt>Authentication</tt> object which was created during
	 * the authentication process.
	 */
	void onAuthenticationSuccess(HttpServletRequest request,
			HttpServletResponse response, Authentication authentication)
			throws IOException, ServletException;
}

接口位于org.springframework.security.web.authentication；

AuthenticationFailureHandler 用于处理失败的身份验证尝试的策略；

AuthenticationSuccessHandler 当用户成功通过身份验证时调用。

3、WebSecurityConfigurerAdapter 类

@Order(100)
public abstract class WebSecurityConfigurerAdapter implements
		WebSecurityConfigurer<WebSecurity> {
	private final Log logger = LogFactory.getLog(WebSecurityConfigurerAdapter.class);
	private ApplicationContext context;
	private ContentNegotiationStrategy contentNegotiationStrategy = new HeaderContentNegotiationStrategy();
	private ObjectPostProcessor<Object> objectPostProcessor = new ObjectPostProcessor<Object>() {
		public <T> T postProcess(T object) {
			throw new IllegalStateException(
					ObjectPostProcessor.class.getName()
							+ " is a required bean. Ensure you have used @EnableWebSecurity and @Configuration");
		}
	};
	private AuthenticationConfiguration authenticationConfiguration;
	private AuthenticationManagerBuilder authenticationBuilder;
	private AuthenticationManagerBuilder localConfigureAuthenticationBldr;
	private boolean disableLocalConfigureAuthenticationBldr;
	private boolean authenticationManagerInitialized;
	private AuthenticationManager authenticationManager;
	private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
	private HttpSecurity http;
	private boolean disableDefaults;
	}

该类位于org.springframework.security.config.annotation.web.configuration；

作用：为权限配置类，该类还实现了WebSecurityConfigurer接口；用户必须创建一个新类来继承AbstractHttpConfigurer。

我们将会用到的方法有：

1、protected void configure(AuthenticationManagerBuilder auth)

用户自定义注册权限，我们将使用我们自己的用户体系来重写。即，使用用户名+密码方式

auth.userDetailsService(customerUserDetailService).passwordEncoder(passwordEncoder());

2、protected void configure(HttpSecurity http)

配置Http权限，其中有`http.authorizeRequests().anyRequest().authenticated().and().formLogin().and().httpBasic()`配置

3、配置上面的权限认证成功、失败处理器以及登出处理器

  @Bean
  public AuthenticationSuccessHandler authenticationSuccessHandler(){
    return new CustomAuthenticationSuccessHandler();
  }
  @Bean
  public AuthenticationFailureHandler authenticationFailureHandler(){
    return new CustomAuthenticationFailHandler();
  }
  @Bean
  public LogoutHandler logoutHandler(){
    return new CustomLogoutSuccessHandler();
  }

技术实现

1、构建用户信息Service，实现userDetailsService

目的是：用系统的用户体系构建权限的控制；即，用户名+密码

@Component
public class CustomerUserDetailService implements UserDetailsService {
  @Resource
  private SysUserMapper sysUserMapper;
  @Override
  public UserDetails loadUserByUsername(String s){
    SysUser sysUser = this.selectByUserName(s);
    if(ObjectUtil.isNull(sysUser)){
      throw new CustomAuthenticationException("用户不存在");
    }
    return this.getDetail(sysUser);
  }
  private UserDetails getDetail(SysUser sysUser){
    return new CustomUserDetailsUser(sysUser.getId(), sysUser.getUsername(), sysUser.getPassword(), Lists.newArrayList());
  }
  public UserDetails loadUserByUserId(Long id){
    SysUser sysUser = this.selectById(id);
    if(ObjectUtil.isNull(sysUser)){
      throw new CustomAuthenticationException("用户不存在");
    }
    return this.getDetail(sysUser);
  }
}

2、分别构建权限认证成功处理器、失败处理器、登出处理器

用户名+密码匹配成功，我们将会登陆的用户信息进行token处理，下次客户端只需要透传token即可，不需要任何的登陆用户信息，信息更安全，可靠。

@Slf4j
@Component
public class CustomAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
  @Resource
  private StringRedisTemplate stringRedisTemplate;
  private ObjectMapper objectMapper = new ObjectMapper();
  @SneakyThrows
  @Override
  public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {
    String token;
    Long userId = 0L;
    if (authentication.getPrincipal() instanceof CustomUserDetailsUser) {
      CustomUserDetailsUser userDetailsUser = (CustomUserDetailsUser) authentication.getPrincipal();
      //用户名+时间
      token = SecureUtil.md5(userDetailsUser.getUsername() + System.currentTimeMillis());
      userId = userDetailsUser.getUserId();
    } else {
      token = SecureUtil.md5(String.valueOf(System.currentTimeMillis()));
    }
    stringRedisTemplate.opsForValue().set(Constants.AUTHENTICATION_TOKEN + token, token, Constants.TOKEN_EXPIRE, TimeUnit.SECONDS);
    //返回前端的Token，V为用户的ID
    stringRedisTemplate.opsForValue().set(token, Long.toString(userId), Constants.TOKEN_EXPIRE, TimeUnit.SECONDS);
    response.setCharacterEncoding(CharsetUtil.UTF_8);
    response.setContentType(MediaType.APPLICATION_JSON_UTF8_VALUE);
    PrintWriter printWriter = response.getWriter();
    Map<String, Object> dataMap = Maps.newLinkedHashMap();
    dataMap.put(Constants.TOKEN, token);
    printWriter.append(objectMapper.writeValueAsString(ResultVo.success(dataMap)));
  }
}

权限认证失败处理器

@Slf4j
@Component
public class CustomAuthenticationFailHandler implements AuthenticationFailureHandler {
  private ObjectMapper objectMapper = new ObjectMapper();
  @SneakyThrows
  @Override
  public void onAuthenticationFailure(HttpServletRequest request,HttpServletResponse response, AuthenticationException exception){
    response.setCharacterEncoding(CharsetUtil.UTF_8);
    response.setContentType(MediaType.APPLICATION_JSON_UTF8_VALUE);
    PrintWriter printWriter = response.getWriter();
    printWriter.append(objectMapper.writeValueAsString(ResultVo.fail(exception.getMessage())));
  }
}

3、分别构建图形验证码、token的过滤器

图形验证码过滤器

统一过滤请求的URL，如果登陆API，需要校验图形验证码。验证码校验失败，将无权限操作，交给权限认证失败处理器处理。

@Slf4j
public class AuthenticationTokenFilter extends BasicAuthenticationFilter {
  private StringRedisTemplate stringRedisTemplate;
  private CustomerUserDetailService customerUserDetailService;
  private ObjectMapper objectMapper = new ObjectMapper();
  public AuthenticationTokenFilter(AuthenticationManager authenticationManager, StringRedisTemplate template, CustomerUserDetailService customUserDetailsService) {
    super(authenticationManager);
    this.stringRedisTemplate = template;
    this.customerUserDetailService = customUserDetailsService;
  }
  @Override
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
    String token = request.getHeader(Constants.TOKEN);
    //如果存在Token、对Token进行校验-这个Token对应用户信息
    if (!Strings.isNullOrEmpty(token)) {
      String userId = stringRedisTemplate.opsForValue().get(token);
      if (ObjectUtil.isNull(userId)) {
        writer(response, "无效token");
        return;
      }
      UserDetails userDetails = customerUserDetailService.loadUserByUserId(Long.valueOf(userId));
      UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
      authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
      SecurityContextHolder.getContext().setAuthentication(authentication);
    }
    chain.doFilter(request, response);
  }
  @SneakyThrows
  public void writer(HttpServletResponse response, String msg) {
    response.setContentType("application/json;charset=UTF-8");
    response.setStatus(HttpServletResponse.SC_OK);
    response.getWriter()
        .write(objectMapper.writeValueAsString(ResultVo.fail(HttpServletResponse.SC_UNAUTHORIZED, msg)));
  }

token过滤器

将需要对token进行有效性的验证

@Slf4j
public class AuthenticationTokenFilter extends BasicAuthenticationFilter {

  private StringRedisTemplate stringRedisTemplate;

  private CustomerUserDetailService customerUserDetailService;

  private ObjectMapper objectMapper = new ObjectMapper();

  public AuthenticationTokenFilter(AuthenticationManager authenticationManager, StringRedisTemplate template, CustomerUserDetailService customUserDetailsService) {
    super(authenticationManager);
    this.stringRedisTemplate = template;
    this.customerUserDetailService = customUserDetailsService;
  }

  @Override
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
    String token = request.getHeader(Constants.TOKEN);
    //如果存在Token、对Token进行校验-这个Token对应用户信息
    if (!Strings.isNullOrEmpty(token)) {
      String userId = stringRedisTemplate.opsForValue().get(token);
      if (ObjectUtil.isNull(userId)) {
        writer(response, "无效token");
        return;
      }
      UserDetails userDetails = customerUserDetailService.loadUserByUserId(Long.valueOf(userId));
      UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
      authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
      SecurityContextHolder.getContext().setAuthentication(authentication);
    }
    chain.doFilter(request, response);
  }


  @SneakyThrows
  public void writer(HttpServletResponse response, String msg) {
    response.setContentType("application/json;charset=UTF-8");
    response.setStatus(HttpServletResponse.SC_OK);
    response.getWriter()
        .write(objectMapper.writeValueAsString(ResultVo.fail(HttpServletResponse.SC_UNAUTHORIZED, msg)));
  }

4、Google图形验证码配置类

加载图形验证码的bean

@Configuration
public class KaptchaConfig {
  @Bean
  public DefaultKaptcha producer() {
    Properties properties = new Properties();
    properties.put("kaptcha.border", "no");
    properties.put("kaptcha.textproducer.font.color", "black");
    properties.put("kaptcha.textproducer.char.space", "5");
    Config config = new Config(properties);
    DefaultKaptcha defaultKaptcha = new DefaultKaptcha();
    defaultKaptcha.setConfig(config);
    return defaultKaptcha;
  }
}

5、案例实现

新建登陆API、验证码获取API

注入图形验证码的bean,写图片验证码

登陆接口无需任何操作，已经在权限认证成功的时候，生成了对应的token

@RestController
@Slf4j
public class LoginController {
  @Resource
  private Producer producer;
  @Resource
  private StringRedisTemplate stringRedisTemplate;
  
  @SneakyThrows
  @RequestMapping("/sys/code/{randomStr}")
  public void captcha(@PathVariable("randomStr") String randomStr, HttpServletResponse response) {
    response.setHeader("Cache-Control", "no-store, no-cache");
    response.setContentType("image/jpeg");
    String text = producer.createText();
    log.info("【验证码生成成功】randomStr:{},captcha:{}", randomStr, text);
    BufferedImage image = producer.createImage(text);
    String redisKey = Constants.IMG_NUMBER_CODE_KEY + randomStr;
    stringRedisTemplate.opsForValue().set(redisKey, text, Constants.TOKEN_EXPIRE, TimeUnit.SECONDS);
    ServletOutputStream out = response.getOutputStream();
    ImageIO.write(image, "jpg", out);
    IOUtils.closeQuietly(out);
  }
  
  @PostMapping("/token/login")
  @OperationLog(value = "用户登陆",type = LogOperationEnum.OTHER)
  public ResultVo<?> login() {
    return ResultVo.success();
  }
}

用户管理API

如果没有AuthIgnore方法注解，则都需要开启token验证。

@RestController
@RequestMapping("/user")
public class UserController {
  @Resource
  private SysUserService sysUserService;
  
  @AuthIgnore
  @OperationLog(value = "新增用户",type = LogOperationEnum.ADD)
  @PostMapping("/add")
  public ResultVo<Integer> register(@RequestBody SysUser vo){
    return ResultVo.success(sysUserService.add(vo));
  }

  @GetMapping("/info")
  @SysLog(value = "用户基本信息")
  public ResultVo<SysUser> info(){
    return ResultVo.success(sysUserService.info());
  }
}

完。