Spring Security学习记录(四) -- JSON Web Token实践(下)

public class TokenUserDTO {
  private Long id;
  private String username;
  private String email;
  private String avatar;
  private List<String> roles;
  //省略get set
}

/**
   * 从用户中创建一个jwt Token
   * @param userDTO 用户
   * @return token
   */
  public String create(TokenUserDTO userDTO) {
    return Jwts.builder()
        .setExpiration(new Date(System.currentTimeMillis() + VALIDITY_TIME_MS))
        .setSubject(userDTO.getUsername())
        .claim("id", userDTO.getId())
        .claim("avatar", userDTO.getAvatar())
        .claim("email", userDTO.getEmail())
        .claim("roles", userDTO.getRoles())
        .signWith(SignatureAlgorithm.HS256, secret)
        .compact();
  }

  /**
   * 从token中取出用户
   */
  public TokenUserDTO parse(String token) {
    Claims claims = Jwts.parser()
        .setSigningKey(secret)
        .parseClaimsJws(token)
        .getBody();
    TokenUserDTO userDTO = new TokenUserDTO();
    userDTO.setId(NumberUtils.toLong(claims.getId()));
    userDTO.setAvatar(claims.get("avatar",String.class));
    userDTO.setUsername(claims.get("username",String.class));
    userDTO.setEmail(claims.get("email",String.class));
    userDTO.setRoles((List<String>) claims.get("roles"));
    return userDTO;
  }

/**
 * Spring Security中存放的认证用户
 * @author Niu Li
 * @since 2017/6/28
 */
public class TokenUserAuthentication implements Authentication {

  private static final long serialVersionUID = 3730332217518791533L;

  private TokenUserDTO userDTO;

  private Boolean authentication = false;

  public TokenUserAuthentication(TokenUserDTO userDTO, Boolean authentication) {
    this.userDTO = userDTO;
    this.authentication = authentication;
  }
    //这里的权限是FilterSecurityInterceptor做权限验证使用
  @Override
  public Collection<? extends GrantedAuthority> getAuthorities() {
    return userDTO.getRoles().stream()
        .map(SimpleGrantedAuthority::new).collect(Collectors.toList());
  }

  @Override
  public Object getCredentials() {
    return "";
  }

  @Override
  public Object getDetails() {
    return userDTO;
  }

  @Override
  public Object getPrincipal() {
    return userDTO.getUsername();
  }

  @Override
  public boolean isAuthenticated() {
    return authentication;
  }

  @Override
  public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
    this.authentication = isAuthenticated;
  }

  @Override
  public String getName() {
    return userDTO.getUsername();
  }
}

/**
 * 验签
 */
public Optional<Authentication> verifyToken(HttpServletRequest request) {
  final String token = request.getHeader(AUTH_HEADER_NAME);
  if (token != null && !token.isEmpty()){
    final TokenUserDTO user = parse(token.trim());
    if (user != null) {
      return Optional.of(new TokenUserAuthentication(user, true));
    }
  }
  return Optional.empty();
}

/**
 *  jwt token验证类,验证成功后设置进去SecurityContext中
 * @author Niu Li
 * @since 2017/6/28
 */
@Slf4j
public class VerifyTokenFilter extends OncePerRequestFilter {

  private JwtTokenUtil jwtTokenUtil;

  public VerifyTokenFilter(JwtTokenUtil jwtTokenUtil) {
    this.jwtTokenUtil = jwtTokenUtil;
  }

  @Override
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
    try {
      Optional<Authentication> authentication = jwtTokenUtil.verifyToken(request);
      log.debug("VerifyTokenFilter result: {}",authentication.orElse(null));
      SecurityContextHolder.getContext().setAuthentication(authentication.orElse(null));
      filterChain.doFilter(request,response);
    } catch (JwtException e) {
      response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
      //可以在这里指定重定向还是返回错误接口示例
    }
  }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
  @Resource
  private JwtTokenUtil jwtTokenUtil;
  /**
   * 在此配置不过滤的请求
   */
  @Override
  public void configure(WebSecurity web) throws Exception {
    //每一个请求对应一个空的filter链,这里一般不要配置过多,
    // 因为查找处是一个for循环,过多就导致每个请求都需要循环一遍直到找到
    web.ignoring().antMatchers("/","/login","/favicon.ico");
  }
  /**
   * 在此配置过滤链
   */
  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
        //角色定义,Spring Security会在其前面自动加上ROLE_,因此存储权限的时候也要加上ROLE_ADMIN
        .antMatchers("/detail").access("hasRole('ADMIN')")
        .anyRequest().permitAll().and()
        //异常处理,可以再此使用entrypoint来定义错误输出
        .exceptionHandling().and()
        //不需要session来控制,所以这里可以去掉
        .securityContext().securityContextRepository(new NullSecurityContextRepository()).and()
        //开启匿名访问
        .anonymous().and()
        //退出登录自己来控制
        .logout().disable()
        //因为没用到cookies,所以关闭cookies
        .csrf().disable()
        //验证token
        .addFilterBefore(new VerifyTokenFilter(jwtTokenUtil),
            UsernamePasswordAuthenticationFilter.class);
  }
}

/**
 * 该链接尝试获取登录用户,返回该认证用户的信息,请求该链接需要在header中放入x-authorization: token
 */
@GetMapping("/detail")
public TokenUserDTO userDetail() {
  Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
  if (Objects.isNull(authentication)) {
    return null;
  }
  return (TokenUserDTO) authentication.getDetails();
}

...
.antMatchers("/detail").access("hasRole('ADMIN')")
...