Alawn/micro-fast
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();

Browse Source
This commit is contained in:
lsy
2017-12-07 15:19:12 +08:00
parent 821d053e3f
commit bc0e56878c
16 changed files with 233 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files
boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java
+20 -12
View File
@@ -1,6 +1,8 @@
package com.micro.fast.security.browser.config;
import com.micro.fast.security.core.config.param.SecurityProperties;
import com.micro.fast.security.core.filter.ValidateCodeFilter;
import com.micro.fast.security.core.pojo.ValidateCode;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
@@ -10,6 +12,7 @@ import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
/**
* spring security browser端的配置类
@@ -54,18 +57,23 @@ public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter {
*/
@Override
protected void configure(HttpSecurity http) throws Exception {
http.formLogin()//使用表单登录
.loginPage("/authentication/require")//自定义登录页面
.loginProcessingUrl("/user/login")//配置spring security登录接口的访问地址,用于在自定义的登录页面提交请求
.successHandler(msAuthenticationSuccessHandler)//定义身份认证成功后处理对象
.failureHandler(msAuthenticationFailureHandler)//定义身份认证失败后处理对象
.and()
.authorizeRequests()//下面是权限配置
.antMatchers("/code/image","/authentication/require",securityProperties.getBrowser().getHtml()).permitAll()//当访问这个页面的时候不进行身份认证,对用户自定义的登录页也不进行权限认证
.anyRequest()//任何请求
.authenticated()//都需要身份认证
.and()
.csrf().disable();//暂时关闭掉跨站请求攻击防护
//创建自定义的验证码过滤器，填入身份认证失败处理对象
ValidateCodeFilter validateCodeFilter = new ValidateCodeFilter();
validateCodeFilter.setAuthenticationFailureHandler(msAuthenticationFailureHandler);
http
.addFilterBefore(validateCodeFilter, UsernamePasswordAuthenticationFilter.class)//添加自定义的验证码处理器，在用户密码校验过滤器之前
.formLogin()//使用表单登录
.loginPage("/authentication/require")//自定义登录页面
.loginProcessingUrl("/user/login")//配置spring security登录接口的访问地址,用于在自定义的登录页面提交请求
.successHandler(msAuthenticationSuccessHandler)//定义身份认证成功后处理对象
.failureHandler(msAuthenticationFailureHandler)//定义身份认证失败后处理对象
.and()
.authorizeRequests()//下面是权限配置
.antMatchers("/user/login","/code/image","/authentication/require",securityProperties.getBrowser().getHtml()).permitAll()//当访问这个页面的时候不进行身份认证,对用户自定义的登录页也不进行权限认证
.anyRequest()//任何请求
.authenticated()//都需要身份认证
.and()
.csrf().disable();//暂时关闭掉跨站请求攻击防护
}
/**
* 定义身份认证红密码的加密解密类的bean
boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/component/MsAuthenticationFailureHandler.java
+1 -1
View File
@@ -1,7 +1,7 @@
package com.micro.fast.security.browser.config.component;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.micro.fast.security.core.config.param.LoginType;
import com.micro.fast.security.core.constant.LoginType;
import com.micro.fast.security.core.config.param.SecurityProperties;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/component/MsAuthenticationSuccessHandler.java
+1 -2
View File
@@ -1,13 +1,12 @@
package com.micro.fast.security.browser.config.component;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.micro.fast.security.core.config.param.LoginType;
import com.micro.fast.security.core.constant.LoginType;
import com.micro.fast.security.core.config.param.SecurityProperties;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
import org.springframework.stereotype.Component;
boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/BrowserProperties.java
+1
View File
@@ -1,5 +1,6 @@
package com.micro.fast.security.core.config.param;
import com.micro.fast.security.core.constant.LoginType;
import org.hibernate.validator.constraints.NotBlank;
/**
boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/config/param/LoginType.java → boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/constant/LoginType.java
+1 -1
View File
@@ -1,4 +1,4 @@
package com.micro.fast.security.core.config.param;
package com.micro.fast.security.core.constant;
/**
* 用户进行身份认证后返回的类型
boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/controller/ValidateCodeController.java
+7 -5
View File
@@ -1,8 +1,9 @@
package com.micro.fast.security.core.controller;
import com.micro.fast.security.core.constant.ValidateCodeConst;
import com.micro.fast.util.ImageCodeUtil;
import com.micro.fast.util.pojo.ImageCode;
import com.micro.fast.security.core.pojo.ValidateCode;
import com.micro.fast.security.core.util.ImageCodeUtil;
import com.micro.fast.security.core.pojo.ImageCode;
import org.springframework.social.connect.web.HttpSessionSessionStrategy;
import org.springframework.social.connect.web.SessionStrategy;
import org.springframework.web.bind.annotation.GetMapping;
@@ -26,11 +27,12 @@ public class ValidateCodeController {
@GetMapping("/code/image")
public void createCode(HttpServletResponse response, HttpServletRequest request) throws IOException {
//创建图片验证码
ImageCode imageCode = ImageCodeUtil.createImageCode();
ImageCode imageCode = new ImageCodeUtil().createImageCode();
ValidateCode validateCode = new ValidateCode(imageCode.getCode(),imageCode.getExpireTime());
//将验证码对象写入session中
sessionStrategy.setAttribute(new ServletWebRequest(request), ValidateCodeConst.SESSION_KEY_IMAGE_CODE,imageCode);
sessionStrategy.setAttribute(new ServletWebRequest(request), ValidateCodeConst.SESSION_KEY_IMAGE_CODE,validateCode);
//将验证码写入到响应之中
ImageIO.write(imageCode.getImage(),"JEPG",response.getOutputStream());
ImageIO.write(imageCode.getImage(),"JPEG",response.getOutputStream());
}
}
boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/exception/ValidateCodeException.java
+1 -1
View File
@@ -3,7 +3,7 @@ package com.micro.fast.security.core.exception;
import org.springframework.security.core.AuthenticationException;
/**
* 验证码校验异常
* 验证码校验异常,继承自AuthenticationException对象
*/
public class ValidateCodeException extends AuthenticationException {
boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/filter/ValidateCodeFilter.java
+32 -9
View File
@@ -2,11 +2,14 @@ package com.micro.fast.security.core.filter;
import com.micro.fast.security.core.constant.ValidateCodeConst;
import com.micro.fast.security.core.exception.ValidateCodeException;
import com.micro.fast.security.core.pojo.ImageCode;
import com.micro.fast.security.core.pojo.ValidateCode;
import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.social.connect.web.HttpSessionSessionStrategy;
import org.springframework.social.connect.web.SessionStrategy;
import org.springframework.stereotype.Component;
import org.springframework.web.context.request.ServletWebRequest;
import org.springframework.web.filter.OncePerRequestFilter;
@@ -21,7 +24,7 @@ import java.io.IOException;
*/
public class ValidateCodeFilter extends OncePerRequestFilter{
@Autowired
private AuthenticationFailureHandler authenticationFailureHandler;
/**
* session操作工具类
@@ -38,17 +41,17 @@ public class ValidateCodeFilter extends OncePerRequestFilter{
if (StringUtils.equals("/user/login",httpServletRequest.getRequestURI())
&& StringUtils.endsWithIgnoreCase(httpServletRequest.getMethod(),"post")){
try{
//校验验证码是否正确
validate(new ServletWebRequest(httpServletRequest));
validate(new ServletWebRequest(httpServletRequest));
}catch(ValidateCodeException e){
//进行身份认证失败后的处理
authenticationFailureHandler.onAuthenticationFailure(httpServletRequest,httpServletResponse,e);
//身份认证失败的时候直接return返回给页面信息，不进行后续的
return;
}
}else {
//直接执行后续的过滤器
filterChain.doFilter(httpServletRequest,httpServletResponse);
}
//执行后续的过滤器
filterChain.doFilter(httpServletRequest,httpServletResponse);
}
/**
@@ -56,9 +59,29 @@ public class ValidateCodeFilter extends OncePerRequestFilter{
* @param servletWebRequest
*/
//todo 实现验证码校验的逻辑
private Boolean validate(ServletWebRequest servletWebRequest) {
sessionStrategy.getAttribute(servletWebRequest, ValidateCodeConst.SESSION_KEY_IMAGE_CODE);
return null;
private void validate(ServletWebRequest servletWebRequest) {
ValidateCode validateCode = (ValidateCode)(sessionStrategy.getAttribute(servletWebRequest, ValidateCodeConst.SESSION_KEY_IMAGE_CODE));
String code = servletWebRequest.getParameter("imageCode");
//session和用户传入的验证码不能为空
if (validateCode==null || StringUtils.isBlank(code)){
throw new ValidateCodeException("未生成验证码对象或用户传入的验证码为空");
}
if (validateCode.getCode()==null
|| !validateCode.getCode().equals(code)){
throw new ValidateCodeException("验证码校验失败");
}
if (validateCode.isExpire()){
throw new ValidateCodeException("验证码已过期");
}
//一次校验完成之后删除验证码
sessionStrategy.removeAttribute(servletWebRequest,ValidateCodeConst.SESSION_KEY_IMAGE_CODE);
}
public AuthenticationFailureHandler getAuthenticationFailureHandler() {
return authenticationFailureHandler;
}
public void setAuthenticationFailureHandler(AuthenticationFailureHandler authenticationFailureHandler) {
this.authenticationFailureHandler = authenticationFailureHandler;
}
}
boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/pojo/ImageCode.java
+43
View File
@@ -0,0 +1,43 @@
package com.micro.fast.security.core.pojo;
import java.awt.image.BufferedImage;
import java.io.Serializable;
import java.time.LocalDateTime;
/**
* 图片验证码
*/
public class ImageCode extends ValidateCode implements Serializable{
private static final long serialVersionUID = -1389697804518380230L;
/**
* 图片
*/
private BufferedImage image;
public ImageCode() {
}
/**
* @param image 验证码图片对象
* @param code 验证码
* @param inSeconds 在多长时间内过期
*/
public ImageCode(BufferedImage image, String code, int inSeconds) {
super(code,inSeconds);
this.image = image;
}
public BufferedImage getImage() {
return image;
}
public void setImage(BufferedImage image) {
this.image = image;
}
}
boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/pojo/ValidateCode.java
+51
View File
@@ -0,0 +1,51 @@
package com.micro.fast.security.core.pojo;
import java.io.Serializable;
import java.time.LocalDateTime;
/**
* 验证码
*/
public class ValidateCode implements Serializable{
private static final long serialVersionUID = 2406040171085392418L;
/**
* 验证码
*/
private String code;
/**
* 过期时间
*/
private LocalDateTime expireTime;
public ValidateCode() {
}
public ValidateCode(String code, int inSeconds) {
this.code = code;
this.expireTime = LocalDateTime.now().plusSeconds(inSeconds);
}
public ValidateCode(String code, LocalDateTime expireTime) {
this.code = code;
this.expireTime = expireTime;
}
public boolean isExpire(){
return LocalDateTime.now().isAfter(expireTime);
}
public String getCode() {
return code;
}
public void setCode(String code) {
this.code = code;
}
public LocalDateTime getExpireTime() {
return expireTime;
}
public void setExpireTime(LocalDateTime expireTime) {
this.expireTime = expireTime;
}
}
boot-starter/boot-starter-security/boot-starter-security-core/src/main/java/com/micro/fast/security/core/util/ImageCodeUtil.java
+66
View File
@@ -0,0 +1,66 @@
package com.micro.fast.security.core.util;
import com.micro.fast.security.core.pojo.ImageCode;
import java.awt.*;
import java.awt.image.BufferedImage;
import java.util.Random;
/**
* 验证码工具类
*/
public class ImageCodeUtil {
//TODO 实现验证码生成类
public ImageCode createImageCode(){
//图片验证码的宽度
int width = 63;
//图片验证码的高度
int height =24;
//生成图片
BufferedImage image = new BufferedImage(width, height, BufferedImage.TYPE_INT_RGB);
Graphics g = image.getGraphics();
Random random = new Random();
g.setColor(getRandColor(200, 250));
g.fillRect(0, 0, width, height);
g.setFont(new Font("Times New Roman", Font.ITALIC, 20));
g.setColor(getRandColor(160, 200));
for (int i = 0; i < 155; i++) {
int x = random.nextInt(width);
int y = random.nextInt(height);
int xl = random.nextInt(12);
int yl = random.nextInt(12);
g.drawLine(x, y, x + xl, y + yl);
}
//获取验证码数字
String sRand = "";
for (int i = 0; i < 4; i++) {
String rand = String.valueOf(random.nextInt(10));
sRand += rand;
g.setColor(new Color(20 + random.nextInt(110), 20 + random.nextInt(110), 20 + random.nextInt(110)));
g.drawString(rand, 13 * i + 6, 16);
}
g.dispose();
//设置多少时间过期返回图片验证码对象
return new ImageCode(image, sRand, 300);
}
/**
* 生成随机背景条纹
* @param fc
* @param bc
* @return
*/
private Color getRandColor(int fc, int bc) {
Random random = new Random();
if (fc > 255) {
fc = 255;
}
if (bc > 255) {
bc = 255;
}
int r = fc + random.nextInt(bc - fc);
int g = fc + random.nextInt(bc - fc);
int b = fc + random.nextInt(bc - fc);
return new Color(r, g, b);
}
}
boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml
+1 -1
View File
@@ -16,5 +16,5 @@ ms:
security:
browser:
html: /signIn.html
loginType: REDIRECT
loginType: JSON
boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/static/signIn.html
+1
View File
@@ -9,6 +9,7 @@
<form action="/user/login" method="post">
<input name="username" type="input"/>
<input name="password" type="password"/>
<input name="imageCode" /> <img src="/code/image" />
<button type="submit">login</button>
</form>
</body>
boot-starter/boot-starter-util/src/main/java/com/micro/fast/util/ImageCodeUtil.java
-13
View File
@@ -1,13 +0,0 @@
package com.micro.fast.util;
import com.micro.fast.util.pojo.ImageCode;
/**
* 验证码工具类
*/
public class ImageCodeUtil {
//TODO 实现验证码生成类
public static ImageCode createImageCode(){
return null;
}
}
boot-starter/boot-starter-util/src/main/java/com/micro/fast/util/pojo/ImageCode.java
-63
View File
@@ -1,63 +0,0 @@
package com.micro.fast.util.pojo;
import java.awt.image.BufferedImage;
import java.time.LocalDateTime;
/**
* 图片验证码
*/
public class ImageCode {
/**
* 图片
*/
private BufferedImage image;
/**
* 验证码
*/
private String code;
/**
* 过期时间
*/
private LocalDateTime expireTime;
public ImageCode() {
}
/**
* @param image 验证码图片对象
* @param code 验证码
* @param in 在多长时间内过期
*/
public ImageCode(BufferedImage image, String code, int in) {
this.image = image;
this.code = code;
this.expireTime = LocalDateTime.now().plusSeconds(in);
}
public BufferedImage getImage() {
return image;
}
public void setImage(BufferedImage image) {
this.image = image;
}
public String getCode() {
return code;
}
public void setCode(String code) {
this.code = code;
}
public LocalDateTime getExpireTime() {
return expireTime;
}
public void setExpireTime(LocalDateTime expireTime) {
this.expireTime = expireTime;
}
}
boot-starter/boot-starter-util/src/main/java/com/micro/fast/util/xmlUtil.java
+7
View File
@@ -0,0 +1,7 @@
package com.micro.fast.util;
/**
* Created by root on 12/7/17.
*/
public class xmlUtil {
}