From 01a65148b57958bdc7deba44e68c012e8c34b9d1 Mon Sep 17 00:00:00 2001 From: lsy <18332763730@163.com> Date: Fri, 8 Dec 2017 22:02:36 +0800 Subject: [PATCH] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=E9=AA=8C=E8=AF=81=E7=A0=81?= =?UTF-8?q?=E6=8B=A6=E6=88=AAurl=E5=8F=AF=E9=85=8D=E7=BD=AE=EF=BC=8C?= =?UTF-8?q?=E9=AA=8C=E8=AF=81=E7=A0=81=E7=94=9F=E6=88=90=E5=8F=82=E6=95=B0?= =?UTF-8?q?=E5=8F=AF=E5=A2=9E=E9=87=8F=E5=BC=80=E5=8F=91?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../boot-starter-security-browser/README.md | 4 +- .../browser/config/BrowserSecurityConfig.java | 2 + .../boot-starter-security-core/README.md | 4 ++ .../core/config/ValidateCodeUtilBean.java | 31 ++++++++++ .../config/param/ImageCodeProperties.java | 13 +++++ .../controller/ValidateCodeController.java | 12 ++-- .../core/filter/ValidateCodeFilter.java | 58 +++++++++++++++++-- .../security/core/util/ImageCodeUtil.java | 4 +- .../security/core/util/ValidateCodeUtil.java | 11 ++++ .../src/main/resources/application.properties | 0 .../src/main/resources/application.yml | 2 +- 11 files changed, 126 insertions(+), 15 deletions(-) create mode 100644 boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/ValidateCodeUtilBean.java create mode 100644 boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/util/ValidateCodeUtil.java delete mode 100644 boot-starter/boot-starter-security/boot-starter-security-core/src/main/resources/application.properties diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/README.md b/boot-starter/boot-starter-security/boot-starter-security-browser/README.md index ddf8b6a..a0e3e7b 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-browser/README.md +++ b/boot-starter/boot-starter-security/boot-starter-security-browser/README.md @@ -3,4 +3,6 @@ ##相关配置参数说明 - `ms.security.browser.html` 自定义登录页面的地址 - `ms.security.browser.loginType` 身份认证后响应类型`REDIRECT`页面形式响应 -`JSON` json形式的响应 \ No newline at end of file +`JSON` json形式的响应 +- 定义自己的根据用户名获取密码的bean,定义自己的bean的名字为`userServiceImpl`即可 +- `/authentication/require`处理身份认证跳转的接口地址 \ No newline at end of file diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java index 7b23bf6..6bca44e 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java +++ b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java @@ -60,6 +60,8 @@ public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter { //创建自定义的验证码过滤器，填入身份认证失败处理对象 ValidateCodeFilter validateCodeFilter = new ValidateCodeFilter(); validateCodeFilter.setAuthenticationFailureHandler(msAuthenticationFailureHandler); + validateCodeFilter.setSecurityProperties(securityProperties); + validateCodeFilter.afterPropertiesSet(); http .addFilterBefore(validateCodeFilter, UsernamePasswordAuthenticationFilter.class)//添加自定义的验证码处理器，在用户密码校验过滤器之前 .formLogin()//使用表单登录 diff --git a/boot-starter/boot-starter-security/boot-starter-security-core/README.md b/boot-starter/boot-starter-security/boot-starter-security-core/README.md index 93fde99..3806ab4 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-core/README.md +++ b/boot-starter/boot-starter-security/boot-starter-security-core/README.md @@ -3,8 +3,12 @@ ##本项目的参数配置说明 本项目说明中的配置参数是boot-starter-security-browser和boot-starter-security-app 项目的交集 +- 用户登录接口url`/user/login` +- 验证码获取接口url`/code/image` - `ms.security.code.image.width` 图片验证码宽度，默认值是`67` 可以在请求中使用`width`参数设置 - `ms.security.code.image.height`图片验证码高度，默认值是`23` 可以在请求中使用`height`参数设置 - `ms.security.code.image.length`图片验证码的code长度，默认是`4` 不能在请求中设置 - `ms.security.code.image.expireIn` 图片验证码的有效时间`60`秒 不能在请求中设置 +- `ms.security.code.image.url` 需要进行验证码校验的地址，默认值是`/user/login` 可以是`/user/*`这种格式，多个适用,号分割 不能在请求中设置 +- 本着增量开发的原则，可以实现`ValicateCodeUtil`生成验证码的方法，并定义名称为`validateCodeUtil`的bean便可替换原有的验证码的生成逻辑 diff --git a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/ValidateCodeUtilBean.java b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/ValidateCodeUtilBean.java new file mode 100644 index 0000000..0773e60 --- /dev/null +++ b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/ValidateCodeUtilBean.java @@ -0,0 +1,31 @@ +package com.micro.fast.security.core.config; + +import com.micro.fast.security.core.config.param.SecurityProperties; +import com.micro.fast.security.core.util.ImageCodeUtil; +import com.micro.fast.security.core.util.ValidateCodeUtil; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; + +/** + * 验证码实现类的配置 + */ +@Configuration +public class ValidateCodeUtilBean { + + @Autowired + private SecurityProperties securityProperties; + + /** + * 增量开发，在保持原有代码逻辑不变的基础之上添加新的方法进行替换 + * @return + */ + @Bean + @ConditionalOnMissingBean(name = "validateCodeUtil") + public ValidateCodeUtil validateCodeUtil(){ + ImageCodeUtil imageCodeUtil = new ImageCodeUtil(); + imageCodeUtil.setSecurityProperties(securityProperties); + return imageCodeUtil; + } +} diff --git a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/ImageCodeProperties.java b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/ImageCodeProperties.java index 901b141..f77b020 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/ImageCodeProperties.java +++ b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/ImageCodeProperties.java @@ -21,6 +21,11 @@ public class ImageCodeProperties { */ private int expireIn = 60; + /** + * 需要进行验证码校验的url + */ + private String url = "/user/login"; + public int getWidth() { return width; } @@ -52,4 +57,12 @@ public class ImageCodeProperties { public void setExpireIn(int expireIn) { this.expireIn = expireIn; } + + public String getUrl() { + return url; + } + + public void setUrl(String url) { + this.url = url; + } } diff --git a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/controller/ValidateCodeController.java b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/controller/ValidateCodeController.java index bf6ac3c..d37f554 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/controller/ValidateCodeController.java +++ b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/controller/ValidateCodeController.java @@ -2,9 +2,9 @@ package com.micro.fast.security.core.controller; import com.micro.fast.security.core.config.param.SecurityProperties; import com.micro.fast.security.core.constant.ValidateCodeConst; -import com.micro.fast.security.core.pojo.ValidateCode; -import com.micro.fast.security.core.util.ImageCodeUtil; import com.micro.fast.security.core.pojo.ImageCode; +import com.micro.fast.security.core.pojo.ValidateCode; +import com.micro.fast.security.core.util.ValidateCodeUtil; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.social.connect.web.HttpSessionSessionStrategy; import org.springframework.social.connect.web.SessionStrategy; @@ -26,14 +26,14 @@ public class ValidateCodeController { @Autowired private SecurityProperties securityProperties; + @Autowired + private ValidateCodeUtil validateCodeUtil; + private SessionStrategy sessionStrategy = new HttpSessionSessionStrategy(); @GetMapping("/code/image") public void createCode(HttpServletResponse response, HttpServletRequest request) throws IOException { - //创建图片验证码 - ImageCodeUtil imageCodeUtil = new ImageCodeUtil(); - imageCodeUtil.setSecurityProperties(securityProperties); - ImageCode imageCode = imageCodeUtil.createImageCode(new ServletWebRequest(request)); + ImageCode imageCode = validateCodeUtil.createImageCode(new ServletWebRequest(request)); ValidateCode validateCode = new ValidateCode(imageCode.getCode(),imageCode.getExpireTime()); //将验证码对象写入session中 sessionStrategy.setAttribute(new ServletWebRequest(request), ValidateCodeConst.SESSION_KEY_IMAGE_CODE,validateCode); diff --git a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/filter/ValidateCodeFilter.java b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/filter/ValidateCodeFilter.java index 238daf3..4529175 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/filter/ValidateCodeFilter.java +++ b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/filter/ValidateCodeFilter.java @@ -1,15 +1,18 @@ package com.micro.fast.security.core.filter; +import com.micro.fast.security.core.config.param.SecurityProperties; import com.micro.fast.security.core.constant.ValidateCodeConst; import com.micro.fast.security.core.exception.ValidateCodeException; import com.micro.fast.security.core.pojo.ImageCode; import com.micro.fast.security.core.pojo.ValidateCode; import org.apache.commons.lang3.StringUtils; +import org.springframework.beans.factory.InitializingBean; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.web.authentication.AuthenticationFailureHandler; import org.springframework.social.connect.web.HttpSessionSessionStrategy; import org.springframework.social.connect.web.SessionStrategy; import org.springframework.stereotype.Component; +import org.springframework.util.AntPathMatcher; import org.springframework.web.context.request.ServletWebRequest; import org.springframework.web.filter.OncePerRequestFilter; @@ -18,11 +21,14 @@ import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; +import java.util.HashSet; +import java.util.Iterator; +import java.util.Set; /** * 图片验证码校验过滤器 */ -public class ValidateCodeFilter extends OncePerRequestFilter{ +public class ValidateCodeFilter extends OncePerRequestFilter implements InitializingBean{ private AuthenticationFailureHandler authenticationFailureHandler; @@ -31,15 +37,44 @@ public class ValidateCodeFilter extends OncePerRequestFilter{ */ private SessionStrategy sessionStrategy = new HttpSessionSessionStrategy(); + private SecurityProperties securityProperties; + + private Set filterUrl = new HashSet(); + + /** + * 初始化filter url + * @throws ServletException + */ + @Override + public void afterPropertiesSet() throws ServletException { + super.afterPropertiesSet(); + String url = securityProperties.getCode().getImage().getUrl(); + String[] urls = url.split(","); + for (String s : urls) { + filterUrl.add(s); + } + filterUrl.add("/user/login"); + } + @Override protected void doFilterInternal( HttpServletRequest httpServletRequest , HttpServletResponse httpServletResponse , FilterChain filterChain) throws ServletException, IOException { + + //判断是否需要验证码校验 + boolean filter = false; + AntPathMatcher antPathMatcher = new AntPathMatcher(); + Iterator iterator = filterUrl.iterator(); + while (iterator.hasNext()){ + if (antPathMatcher.match(iterator.next(),httpServletRequest.getRequestURI())){ + filter = true; + break; + } + } //在登录post请求的时候对验证码进行校验 - if (StringUtils.equals("/user/login",httpServletRequest.getRequestURI()) - && StringUtils.endsWithIgnoreCase(httpServletRequest.getMethod(),"post")){ + if (filter && StringUtils.endsWithIgnoreCase(httpServletRequest.getMethod(),"post")){ try{ //校验验证码是否正确 validate(new ServletWebRequest(httpServletRequest)); @@ -58,7 +93,6 @@ public class ValidateCodeFilter extends OncePerRequestFilter{ * 验证码校验 * @param servletWebRequest */ - //todo 实现验证码校验的逻辑 private void validate(ServletWebRequest servletWebRequest) { ValidateCode validateCode = (ValidateCode)(sessionStrategy.getAttribute(servletWebRequest, ValidateCodeConst.SESSION_KEY_IMAGE_CODE)); String code = servletWebRequest.getParameter("imageCode"); @@ -84,4 +118,20 @@ public class ValidateCodeFilter extends OncePerRequestFilter{ public void setAuthenticationFailureHandler(AuthenticationFailureHandler authenticationFailureHandler) { this.authenticationFailureHandler = authenticationFailureHandler; } + + public Set getFilterUrl() { + return filterUrl; + } + + public void setFilterUrl(Set filterUrl) { + this.filterUrl = filterUrl; + } + + public SecurityProperties getSecurityProperties() { + return securityProperties; + } + + public void setSecurityProperties(SecurityProperties securityProperties) { + this.securityProperties = securityProperties; + } } diff --git a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/util/ImageCodeUtil.java b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/util/ImageCodeUtil.java index c4a1f29..21ab718 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/util/ImageCodeUtil.java +++ b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/util/ImageCodeUtil.java @@ -3,8 +3,6 @@ package com.micro.fast.security.core.util; import com.micro.fast.security.core.config.param.ImageCodeProperties; import com.micro.fast.security.core.config.param.SecurityProperties; import com.micro.fast.security.core.pojo.ImageCode; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.stereotype.Component; import org.springframework.web.bind.ServletRequestUtils; import org.springframework.web.context.request.ServletWebRequest; @@ -15,7 +13,7 @@ import java.util.Random; /** * 验证码工具类 */ -public class ImageCodeUtil { +public class ImageCodeUtil implements ValidateCodeUtil{ private SecurityProperties securityProperties; diff --git a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/util/ValidateCodeUtil.java b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/util/ValidateCodeUtil.java new file mode 100644 index 0000000..51423fd --- /dev/null +++ b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/util/ValidateCodeUtil.java @@ -0,0 +1,11 @@ +package com.micro.fast.security.core.util; + +import com.micro.fast.security.core.pojo.ImageCode; +import org.springframework.web.context.request.ServletWebRequest; + +/** + * 验证码生成的接口 + */ +public interface ValidateCodeUtil { + ImageCode createImageCode(ServletWebRequest request); +} diff --git a/boot-starter/boot-starter-security/boot-starter-security-core/src/main/resources/application.properties b/boot-starter/boot-starter-security/boot-starter-security-core/src/main/resources/application.properties deleted file mode 100644 index e69de29..0000000 diff --git a/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml b/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml index 629bad4..bc98658 100644 --- a/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml +++ b/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml @@ -19,5 +19,5 @@ ms: loginType: JSON code: image: - length: 6 + length: 4