添加验证码拦截url可配置，验证码生成参数可增量开发

2017-12-08 22:02:36 +08:00
parent f581a8727e
commit 01a65148b5
11 changed files with 126 additions and 15 deletions
@@ -3,4 +3,6 @@
 ##相关配置参数说明
 - `ms.security.browser.html` 自定义登录页面的地址
 - `ms.security.browser.loginType` 身份认证后响应类型`REDIRECT`页面形式响应
-`JSON` json形式的响应
+`JSON` json形式的响应
+- 定义自己的根据用户名获取密码的bean,定义自己的bean的名字为`userServiceImpl`即可
+- `/authentication/require`处理身份认证跳转的接口地址
@@ -60,6 +60,8 @@ public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter {
        //创建自定义的验证码过滤器，填入身份认证失败处理对象
        ValidateCodeFilter validateCodeFilter = new ValidateCodeFilter();
        validateCodeFilter.setAuthenticationFailureHandler(msAuthenticationFailureHandler);
+        validateCodeFilter.setSecurityProperties(securityProperties);
+        validateCodeFilter.afterPropertiesSet();
        http
            .addFilterBefore(validateCodeFilter, UsernamePasswordAuthenticationFilter.class)//添加自定义的验证码处理器，在用户密码校验过滤器之前
            .formLogin()//使用表单登录
@@ -3,8 +3,12 @@
 ##本项目的参数配置说明
 本项目说明中的配置参数是boot-starter-security-browser和boot-starter-security-app
 项目的交集
+- 用户登录接口url`/user/login`
+- 验证码获取接口url`/code/image`
 - `ms.security.code.image.width` 图片验证码宽度，默认值是`67` 可以在请求中使用`width`参数设置
 - `ms.security.code.image.height`图片验证码高度，默认值是`23` 可以在请求中使用`height`参数设置
 - `ms.security.code.image.length`图片验证码的code长度，默认是`4` 不能在请求中设置
 - `ms.security.code.image.expireIn` 图片验证码的有效时间`60`秒 不能在请求中设置
+- `ms.security.code.image.url` 需要进行验证码校验的地址，默认值是`/user/login` 可以是`/user/*`这种格式，多个适用,号分割 不能在请求中设置
+-  本着增量开发的原则，可以实现`ValicateCodeUtil`生成验证码的方法，并定义名称为`validateCodeUtil`的bean便可替换原有的验证码的生成逻辑

@@ -0,0 +1,31 @@
+package com.micro.fast.security.core.config;
+
+import com.micro.fast.security.core.config.param.SecurityProperties;
+import com.micro.fast.security.core.util.ImageCodeUtil;
+import com.micro.fast.security.core.util.ValidateCodeUtil;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+/**
+ * 验证码实现类的配置
+ */
+@Configuration
+public class ValidateCodeUtilBean {
+
+    @Autowired
+    private SecurityProperties securityProperties;
+
+    /**
+     * 增量开发，在保持原有代码逻辑不变的基础之上添加新的方法进行替换
+     * @return
+     */
+    @Bean
+    @ConditionalOnMissingBean(name = "validateCodeUtil")
+    public ValidateCodeUtil validateCodeUtil(){
+        ImageCodeUtil imageCodeUtil = new ImageCodeUtil();
+        imageCodeUtil.setSecurityProperties(securityProperties);
+        return  imageCodeUtil;
+    }
+}
@@ -21,6 +21,11 @@ public class ImageCodeProperties {
     */
    private int expireIn = 60;

+    /**
+     * 需要进行验证码校验的url
+     */
+    private String url = "/user/login";
+
    public int getWidth() {
        return width;
    }
@@ -52,4 +57,12 @@ public class ImageCodeProperties {
    public void setExpireIn(int expireIn) {
        this.expireIn = expireIn;
    }
+
+    public String getUrl() {
+        return url;
+    }
+
+    public void setUrl(String url) {
+        this.url = url;
+    }
 }
@@ -2,9 +2,9 @@ package com.micro.fast.security.core.controller;

 import com.micro.fast.security.core.config.param.SecurityProperties;
 import com.micro.fast.security.core.constant.ValidateCodeConst;
-import com.micro.fast.security.core.pojo.ValidateCode;
-import com.micro.fast.security.core.util.ImageCodeUtil;
 import com.micro.fast.security.core.pojo.ImageCode;
+import com.micro.fast.security.core.pojo.ValidateCode;
+import com.micro.fast.security.core.util.ValidateCodeUtil;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.social.connect.web.HttpSessionSessionStrategy;
 import org.springframework.social.connect.web.SessionStrategy;
@@ -26,14 +26,14 @@ public class ValidateCodeController {
    @Autowired
    private SecurityProperties securityProperties;

+    @Autowired
+    private ValidateCodeUtil validateCodeUtil;
+
    private SessionStrategy sessionStrategy = new HttpSessionSessionStrategy();

    @GetMapping("/code/image")
    public void createCode(HttpServletResponse response, HttpServletRequest request) throws IOException {
-        //创建图片验证码
-        ImageCodeUtil imageCodeUtil = new ImageCodeUtil();
-        imageCodeUtil.setSecurityProperties(securityProperties);
-        ImageCode imageCode = imageCodeUtil.createImageCode(new ServletWebRequest(request));
+        ImageCode imageCode = validateCodeUtil.createImageCode(new ServletWebRequest(request));
        ValidateCode validateCode = new ValidateCode(imageCode.getCode(),imageCode.getExpireTime());
        //将验证码对象写入session中
        sessionStrategy.setAttribute(new ServletWebRequest(request), ValidateCodeConst.SESSION_KEY_IMAGE_CODE,validateCode);
@@ -1,15 +1,18 @@
 package com.micro.fast.security.core.filter;

+import com.micro.fast.security.core.config.param.SecurityProperties;
 import com.micro.fast.security.core.constant.ValidateCodeConst;
 import com.micro.fast.security.core.exception.ValidateCodeException;
 import com.micro.fast.security.core.pojo.ImageCode;
 import com.micro.fast.security.core.pojo.ValidateCode;
 import org.apache.commons.lang3.StringUtils;
+import org.springframework.beans.factory.InitializingBean;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.social.connect.web.HttpSessionSessionStrategy;
 import org.springframework.social.connect.web.SessionStrategy;
 import org.springframework.stereotype.Component;
+import org.springframework.util.AntPathMatcher;
 import org.springframework.web.context.request.ServletWebRequest;
 import org.springframework.web.filter.OncePerRequestFilter;

@@ -18,11 +21,14 @@ import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.Set;

 /**
 * 图片验证码校验过滤器
 */
-public class ValidateCodeFilter  extends OncePerRequestFilter{
+public class ValidateCodeFilter  extends OncePerRequestFilter implements InitializingBean{


    private AuthenticationFailureHandler authenticationFailureHandler;
@@ -31,15 +37,44 @@ public class ValidateCodeFilter  extends OncePerRequestFilter{
     */
    private SessionStrategy sessionStrategy = new HttpSessionSessionStrategy();

+    private SecurityProperties securityProperties;
+
+    private Set<String> filterUrl = new HashSet<String>();
+
+    /**
+     * 初始化filter url
+     * @throws ServletException
+     */
+    @Override
+    public void afterPropertiesSet() throws ServletException {
+        super.afterPropertiesSet();
+        String url = securityProperties.getCode().getImage().getUrl();
+        String[] urls = url.split(",");
+        for (String s : urls) {
+            filterUrl.add(s);
+        }
+        filterUrl.add("/user/login");
+    }
+
    @Override
    protected void doFilterInternal(
            HttpServletRequest httpServletRequest
            , HttpServletResponse httpServletResponse
            , FilterChain filterChain)
            throws ServletException, IOException {
+
+        //判断是否需要验证码校验
+        boolean filter = false;
+        AntPathMatcher antPathMatcher = new AntPathMatcher();
+        Iterator<String> iterator = filterUrl.iterator();
+        while (iterator.hasNext()){
+            if (antPathMatcher.match(iterator.next(),httpServletRequest.getRequestURI())){
+                filter = true;
+                break;
+            }
+        }
        //在登录post请求的时候对验证码进行校验
-        if (StringUtils.equals("/user/login",httpServletRequest.getRequestURI())
-                && StringUtils.endsWithIgnoreCase(httpServletRequest.getMethod(),"post")){
+        if (filter && StringUtils.endsWithIgnoreCase(httpServletRequest.getMethod(),"post")){
           try{
               //校验验证码是否正确
              validate(new ServletWebRequest(httpServletRequest));
@@ -58,7 +93,6 @@ public class ValidateCodeFilter  extends OncePerRequestFilter{
     * 验证码校验
     * @param servletWebRequest
     */
-    //todo 实现验证码校验的逻辑
    private void  validate(ServletWebRequest servletWebRequest) {
        ValidateCode validateCode = (ValidateCode)(sessionStrategy.getAttribute(servletWebRequest, ValidateCodeConst.SESSION_KEY_IMAGE_CODE));
        String code = servletWebRequest.getParameter("imageCode");
@@ -84,4 +118,20 @@ public class ValidateCodeFilter  extends OncePerRequestFilter{
    public void setAuthenticationFailureHandler(AuthenticationFailureHandler authenticationFailureHandler) {
        this.authenticationFailureHandler = authenticationFailureHandler;
    }
+
+    public Set<String> getFilterUrl() {
+        return filterUrl;
+    }
+
+    public void setFilterUrl(Set<String> filterUrl) {
+        this.filterUrl = filterUrl;
+    }
+
+    public SecurityProperties getSecurityProperties() {
+        return securityProperties;
+    }
+
+    public void setSecurityProperties(SecurityProperties securityProperties) {
+        this.securityProperties = securityProperties;
+    }
 }
@@ -3,8 +3,6 @@ package com.micro.fast.security.core.util;
 import com.micro.fast.security.core.config.param.ImageCodeProperties;
 import com.micro.fast.security.core.config.param.SecurityProperties;
 import com.micro.fast.security.core.pojo.ImageCode;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.stereotype.Component;
 import org.springframework.web.bind.ServletRequestUtils;
 import org.springframework.web.context.request.ServletWebRequest;

@@ -15,7 +13,7 @@ import java.util.Random;
 /**
 * 验证码工具类
 */
-public class ImageCodeUtil {
+public class ImageCodeUtil implements ValidateCodeUtil{

    private SecurityProperties securityProperties;

@@ -0,0 +1,11 @@
+package com.micro.fast.security.core.util;
+
+import com.micro.fast.security.core.pojo.ImageCode;
+import org.springframework.web.context.request.ServletWebRequest;
+
+/**
+ * 验证码生成的接口
+ */
+public interface ValidateCodeUtil {
+    ImageCode createImageCode(ServletWebRequest request);
+}
@@ -19,5 +19,5 @@ ms:
   loginType: JSON
  code:
    image:
-     length: 6
+     length: 4