验证码（图形、短信、邮箱）、token机制对于系统的安全性已经是老生常谈；

本文将结合spring-security快速实现Google图形验证码、token的安全性校验。

技术储备

1、UserDetailsService接口

/**  * Core interface which loads user-specific data.  * <p>  * It is used throughout the framework as a user DAO and is the strategy used by the  * {@link org.springframework.security.authentication.dao.DaoAuthenticationProvider  * DaoAuthenticationProvider}.  *  * <p>  * The interface requires only one read-only method, which simplifies support for new  * data-access strategies.  *  * @see org.springframework.security.authentication.dao.DaoAuthenticationProvider  * @see UserDetails  *  * @author Ben Alex  */ public interface UserDetailsService { 	 	/** 	 * Locates the user based on the username. In the actual implementation, the search 	 * may possibly be case sensitive, or case insensitive depending on how the 	 * implementation instance is configured. In this case, the <code>UserDetails</code> 	 * object that comes back may have a username that is of a different case than what 	 * was actually requested.. 	 * 	 * @param username the username identifying the user whose data is required. 	 * 	 * @return a fully populated user record (never <code>null</code>) 	 * 	 * @throws UsernameNotFoundException if the user could not be found or the user has no 	 * GrantedAuthority 	 */ 	UserDetails loadUserByUsername(String username) throws UsernameNotFoundException; }

该接口位于org.springframework.security.core.userdetails，

主要作用：加载用户信息的核心接口；被用于DaoAuthenticationProvider的策略

2、AuthenticationFailureHandler、AuthenticationSuccessHandler接口

/**  * Strategy used to handle a failed authentication attempt.  * <p>  * Typical behaviour might be to redirect the user to the authentication page (in the case  * of a form login) to allow them to try again. More sophisticated logic might be  * implemented depending on the type of the exception. For example, a  * {@link CredentialsExpiredException} might cause a redirect to a web controller which  * allowed the user to change their password.  *  * @author Luke Taylor  * @since 3.0  */ public interface AuthenticationFailureHandler { 	/** 	 * Called when an authentication attempt fails. 	 * @param request the request during which the authentication attempt occurred. 	 * @param response the response. 	 * @param exception the exception which was thrown to reject the authentication 	 * request. 	 */ 	void onAuthenticationFailure(HttpServletRequest request, 			HttpServletResponse response, AuthenticationException exception) 			throws IOException, ServletException; }

/**  * Strategy used to handle a successful user authentication.  * <p>  * Implementations can do whatever they want but typical behaviour would be to control the  * navigation to the subsequent destination (using a redirect or a forward). For example,  * after a user has logged in by submitting a login form, the application needs to decide  * where they should be redirected to afterwards (see  * {@link AbstractAuthenticationProcessingFilter} and subclasses). Other logic may also be  * included if required.  *  * @author Luke Taylor  * @since 3.0  */ public interface AuthenticationSuccessHandler { 	/** 	 * Called when a user has been successfully authenticated. 	 * 	 * @param request the request which caused the successful authentication 	 * @param response the response 	 * @param authentication the <tt>Authentication</tt> object which was created during 	 * the authentication process. 	 */ 	void onAuthenticationSuccess(HttpServletRequest request, 			HttpServletResponse response, Authentication authentication) 			throws IOException, ServletException; }

接口位于org.springframework.security.web.authentication；

AuthenticationFailureHandler 用于处理失败的身份验证尝试的策略；

AuthenticationSuccessHandler 当用户成功通过身份验证时调用。

3、WebSecurityConfigurerAdapter 类

@Order(100) public abstract class WebSecurityConfigurerAdapter implements 		WebSecurityConfigurer<WebSecurity> { 	private final Log logger = LogFactory.getLog(WebSecurityConfigurerAdapter.class); 	private ApplicationContext context; 	private ContentNegotiationStrategy contentNegotiationStrategy = new HeaderContentNegotiationStrategy(); 	private ObjectPostProcessor<Object> objectPostProcessor = new ObjectPostProcessor<Object>() { 		public <T> T postProcess(T object) { 			throw new IllegalStateException( 					ObjectPostProcessor.class.getName() 							+ " is a required bean. Ensure you have used @EnableWebSecurity and @Configuration"); 		} 	}; 	private AuthenticationConfiguration authenticationConfiguration; 	private AuthenticationManagerBuilder authenticationBuilder; 	private AuthenticationManagerBuilder localConfigureAuthenticationBldr; 	private boolean disableLocalConfigureAuthenticationBldr; 	private boolean authenticationManagerInitialized; 	private AuthenticationManager authenticationManager; 	private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl(); 	private HttpSecurity http; 	private boolean disableDefaults; 	}

该类位于org.springframework.security.config.annotation.web.configuration；

作用：为权限配置类，该类还实现了WebSecurityConfigurer接口；用户必须创建一个新类来继承AbstractHttpConfigurer。

我们将会用到的方法有：

1、protected void configure(AuthenticationManagerBuilder auth)

用户自定义注册权限，我们将使用我们自己的用户体系来重写。即，使用用户名+密码方式

auth.userDetailsService(customerUserDetailService).passwordEncoder(passwordEncoder());

2、protected void configure(HttpSecurity http)

配置Http权限，其中有`http.authorizeRequests().anyRequest().authenticated().and().formLogin().and().httpBasic()`配置

3、配置上面的权限认证成功、失败处理器以及登出处理器

  @Bean   public AuthenticationSuccessHandler authenticationSuccessHandler(){     return new CustomAuthenticationSuccessHandler();   }   @Bean   public AuthenticationFailureHandler authenticationFailureHandler(){     return new CustomAuthenticationFailHandler();   }   @Bean   public LogoutHandler logoutHandler(){     return new CustomLogoutSuccessHandler();   }

技术实现

1、构建用户信息Service，实现userDetailsService

目的是：用系统的用户体系构建权限的控制；即，用户名+密码

@Component public class CustomerUserDetailService implements UserDetailsService {   @Resource   private SysUserMapper sysUserMapper;   @Override   public UserDetails loadUserByUsername(String s){     SysUser sysUser = this.selectByUserName(s);     if(ObjectUtil.isNull(sysUser)){       throw new CustomAuthenticationException("用户不存在");     }     return this.getDetail(sysUser);   }   private UserDetails getDetail(SysUser sysUser){     return new CustomUserDetailsUser(sysUser.getId(), sysUser.getUsername(), sysUser.getPassword(), Lists.newArrayList());   }   public UserDetails loadUserByUserId(Long id){     SysUser sysUser = this.selectById(id);     if(ObjectUtil.isNull(sysUser)){       throw new CustomAuthenticationException("用户不存在");     }     return this.getDetail(sysUser);   } }

2、分别构建权限认证成功处理器、失败处理器、登出处理器

用户名+密码匹配成功，我们将会登陆的用户信息进行token处理，下次客户端只需要透传token即可，不需要任何的登陆用户信息，信息更安全，可靠。

@Slf4j @Component public class CustomAuthenticationSuccessHandler implements AuthenticationSuccessHandler {   @Resource   private StringRedisTemplate stringRedisTemplate;   private ObjectMapper objectMapper = new ObjectMapper();   @SneakyThrows   @Override   public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {     String token;     Long userId = 0L;     if (authentication.getPrincipal() instanceof CustomUserDetailsUser) {       CustomUserDetailsUser userDetailsUser = (CustomUserDetailsUser) authentication.getPrincipal();       //用户名+时间       token = SecureUtil.md5(userDetailsUser.getUsername() + System.currentTimeMillis());       userId = userDetailsUser.getUserId();     } else {       token = SecureUtil.md5(String.valueOf(System.currentTimeMillis()));     }     stringRedisTemplate.opsForValue().set(Constants.AUTHENTICATION_TOKEN + token, token, Constants.TOKEN_EXPIRE, TimeUnit.SECONDS);     //返回前端的Token，V为用户的ID     stringRedisTemplate.opsForValue().set(token, Long.toString(userId), Constants.TOKEN_EXPIRE, TimeUnit.SECONDS);     response.setCharacterEncoding(CharsetUtil.UTF_8);     response.setContentType(MediaType.APPLICATION_JSON_UTF8_VALUE);     PrintWriter printWriter = response.getWriter();     Map<String, Object> dataMap = Maps.newLinkedHashMap();     dataMap.put(Constants.TOKEN, token);     printWriter.append(objectMapper.writeValueAsString(ResultVo.success(dataMap)));   } }

权限认证失败处理器

@Slf4j @Component public class CustomAuthenticationFailHandler implements AuthenticationFailureHandler {   private ObjectMapper objectMapper = new ObjectMapper();   @SneakyThrows   @Override   public void onAuthenticationFailure(HttpServletRequest request,HttpServletResponse response, AuthenticationException exception){     response.setCharacterEncoding(CharsetUtil.UTF_8);     response.setContentType(MediaType.APPLICATION_JSON_UTF8_VALUE);     PrintWriter printWriter = response.getWriter();     printWriter.append(objectMapper.writeValueAsString(ResultVo.fail(exception.getMessage())));   } }

3、分别构建图形验证码、token的过滤器

图形验证码过滤器

统一过滤请求的URL，如果登陆API，需要校验图形验证码。验证码校验失败，将无权限操作，交给权限认证失败处理器处理。

@Slf4j public class AuthenticationTokenFilter extends BasicAuthenticationFilter {   private StringRedisTemplate stringRedisTemplate;   private CustomerUserDetailService customerUserDetailService;   private ObjectMapper objectMapper = new ObjectMapper();   public AuthenticationTokenFilter(AuthenticationManager authenticationManager, StringRedisTemplate template, CustomerUserDetailService customUserDetailsService) {     super(authenticationManager);     this.stringRedisTemplate = template;     this.customerUserDetailService = customUserDetailsService;   }   @Override   protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {     String token = request.getHeader(Constants.TOKEN);     //如果存在Token、对Token进行校验-这个Token对应用户信息     if (!Strings.isNullOrEmpty(token)) {       String userId = stringRedisTemplate.opsForValue().get(token);       if (ObjectUtil.isNull(userId)) {         writer(response, "无效token");         return;       }       UserDetails userDetails = customerUserDetailService.loadUserByUserId(Long.valueOf(userId));       UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());       authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));       SecurityContextHolder.getContext().setAuthentication(authentication);     }     chain.doFilter(request, response);   }   @SneakyThrows   public void writer(HttpServletResponse response, String msg) {     response.setContentType("application/json;charset=UTF-8");     response.setStatus(HttpServletResponse.SC_OK);     response.getWriter()         .write(objectMapper.writeValueAsString(ResultVo.fail(HttpServletResponse.SC_UNAUTHORIZED, msg)));   }

token过滤器

将需要对token进行有效性的验证

@Configuration public class KaptchaConfig {   @Bean   public DefaultKaptcha producer() {     Properties properties = new Properties();     properties.put("kaptcha.border", "no");     properties.put("kaptcha.textproducer.font.color", "black");     properties.put("kaptcha.textproducer.char.space", "5");     Config config = new Config(properties);     DefaultKaptcha defaultKaptcha = new DefaultKaptcha();     defaultKaptcha.setConfig(config);     return defaultKaptcha;   } }

4、Google图形验证码配置类

加载图形验证码的bean

@Configuration public class KaptchaConfig {   @Bean   public DefaultKaptcha producer() {     Properties properties = new Properties();     properties.put("kaptcha.border", "no");     properties.put("kaptcha.textproducer.font.color", "black");     properties.put("kaptcha.textproducer.char.space", "5");     Config config = new Config(properties);     DefaultKaptcha defaultKaptcha = new DefaultKaptcha();     defaultKaptcha.setConfig(config);     return defaultKaptcha;   } }

5、案例实现

新建登陆API、验证码获取API

注入图形验证码的bean,写图片验证码

登陆接口无需任何操作，已经在权限认证成功的时候，生成了对应的token

@RestController @Slf4j public class LoginController {   @Resource   private Producer producer;   @Resource   private StringRedisTemplate stringRedisTemplate;      @SneakyThrows   @RequestMapping("/sys/code/{randomStr}")   public void captcha(@PathVariable("randomStr") String randomStr, HttpServletResponse response) {     response.setHeader("Cache-Control", "no-store, no-cache");     response.setContentType("image/jpeg");     String text = producer.createText();     log.info("【验证码生成成功】randomStr:{},captcha:{}", randomStr, text);     BufferedImage image = producer.createImage(text);     String redisKey = Constants.IMG_NUMBER_CODE_KEY + randomStr;     stringRedisTemplate.opsForValue().set(redisKey, text, Constants.TOKEN_EXPIRE, TimeUnit.SECONDS);     ServletOutputStream out = response.getOutputStream();     ImageIO.write(image, "jpg", out);     IOUtils.closeQuietly(out);   }      @PostMapping("/token/login")   @OperationLog(value = "用户登陆",type = LogOperationEnum.OTHER)   public ResultVo<?> login() {     return ResultVo.success();   } }

用户管理API

如果没有AuthIgnore方法注解，则都需要开启token验证。

@RestController @RequestMapping("/user") public class UserController {   @Resource   private SysUserService sysUserService;      @AuthIgnore   @OperationLog(value = "新增用户",type = LogOperationEnum.ADD)   @PostMapping("/add")   public ResultVo<Integer> register(@RequestBody SysUser vo){     return ResultVo.success(sysUserService.add(vo));   }    @GetMapping("/info")   @SysLog(value = "用户基本信息")   public ResultVo<SysUser> info(){     return ResultVo.success(sysUserService.info());   } }

完。