解析spring-security權限控制和校驗的問題

<dependency>
	<groupId>org.springframework.boot</groupId>
	<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
	<groupId>org.springframework.boot</groupId>
	<artifactId>spring-boot-starter-security</artifactId>
</dependency>

server.port=8080
server.servlet.context-path=/demo

spring.main.allow-bean-definition-overriding=true
spring.profiles.active=dev

package com.hp.springboot.admin.security;

import java.util.ArrayList;
import java.util.List;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import com.hp.springboot.admin.constant.AdminConstants;
import com.hp.springboot.admin.interceptor.UrlAuthenticationInterceptor;
import com.hp.springboot.admin.security.handler.AdminAccessDeniedHandler;
import com.hp.springboot.admin.security.handler.AdminAuthenticationEntryPoint;
import com.hp.springboot.admin.security.handler.AdminAuthenticationFailureHandler;
import com.hp.springboot.admin.security.handler.AdminAuthenticationSuccessHandler;
import com.hp.springboot.common.configuration.CommonWebMvcConfigurer;

/**
 1. 描述：security全局配置
 2. 作者：黃平
 3. 時間：2021年1月11日
 */
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true) //開啟Security註解的功能，如果你項目中不用Security的註解（hasRole，hasAuthority等），則可以不加該註解
public class AdminWebSecurityConfigurer extends WebSecurityConfigurerAdapter {
	
	@Autowired
	private CommonWebMvcConfigurer commonWebMvcConfigurer;
	
	@Override
	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
		// 設置超級管理員
		auth.inMemoryAuthentication()
			.withUser(AdminConstants.ADMIN_USER)
		;
		
		// 其餘賬號通過數據庫查詢驗證
		auth.userDetailsService(adminUserDetailsService()).passwordEncoder(passwordEncoder());
	}
	
	@Override
	public void configure(WebSecurity web) throws Exception {
		// 靜態資源
		String[] ignoreArray = commonWebMvcConfigurer.getMergeStaticPatternArray();
		
		// 設置系統的靜態資源。靜態資源不會走權限框架
		web.ignoring().antMatchers(ignoreArray);
	}
	
	@Override
	protected void configure(HttpSecurity http) throws Exception {
		// 驗證碼過濾器
		http.addFilterBefore(new ValidateCodeFilter(), UsernamePasswordAuthenticationFilter.class);
		
		// 第一層免過濾列表
		// 就是所有人都可以訪問的地址。區別於靜態資源
		List<String> noFilterList = new ArrayList<>();
		noFilterList.add(AdminConstants.ACCESS_DENIED_URL);
		noFilterList.add(AdminConstants.VERIFY_CODE_URL);
		noFilterList.addAll(commonWebMvcConfigurer.getMergeFirstNoFilterList());
				
		http.formLogin()// 登錄頁面使用form提交的方式
		.usernameParameter("username").passwordParameter("password")// 設置登錄頁面用戶名和密碼的input對應name值（其實默認值就是username,password，所以這裡可以不用設置）
		.loginPage(AdminConstants.LOGIN_PAGE_URL)// 設置登錄頁面的地址
		.loginProcessingUrl(AdminConstants.LOGIN_PROCESSING_URL)// 登錄頁面輸入用戶名密碼後提交的地址
		.successHandler(adminAuthenticationSuccessHandler())// 登錄成功處理
		.failureHandler(adminAuthenticationFailureHandler())// 登錄失敗的處理
		.permitAll()// 以上url全部放行，不需要校驗權限
		.and()
		
		// 註銷相關配置
		.logout()
		.logoutUrl(AdminConstants.LOGOUT_URL)// 註銷地址
		.logoutSuccessUrl(AdminConstants.LOGIN_PAGE_URL)// 註銷成功後跳轉地址（這裡就是跳轉到登錄頁面）
		.permitAll()// 以上地址全部放行
		.and().authorizeRequests()
		
		// 第一層免過濾列表
		// 不需要登錄，就可以直接訪問的地址
		.antMatchers(noFilterList.toArray(new String[noFilterList.size()])).permitAll() // 全部放行
		
		// 其他都需要權限控制
		// 這裡使用.anyRequest().access方法，把權限驗證交給指定的一個方法去處理。
		// 這裡 hasPermission接受兩個參數request和authentication
		.anyRequest().access("@UrlAuthenticationInterceptor.hasPermission(request, authentication)")
		
		// 異常處理
		.and().exceptionHandling()
		.accessDeniedHandler(new AdminAccessDeniedHandler())// 登錄用戶訪問無權限的資源
		.authenticationEntryPoint(new AdminAuthenticationEntryPoint())// 匿名用戶訪問無權限的資源
		.and().csrf().disable()// 禁用csrf
		
		// session管理
		.sessionManagement()
		.invalidSessionUrl(AdminConstants.LOGIN_PAGE_URL)// session失效後，跳轉的地址
		.maximumSessions(1)// 同一個賬號最大允許同時在線數
		;
	}
	
	/**
	 * @Title: passwordEncoder
	 * @Description: 加密方式
	 * @return
	 */
	@Bean
 public PasswordEncoder passwordEncoder() {
  return new BCryptPasswordEncoder();
 }
	
	/**
	 * @Title: adminUserDetailsService
	 * @Description: 用戶信息
	 * @return
	 */
	@Bean
	public UserDetailsService adminUserDetailsService() {
		return new AdminUserDetailsService();
	}
	
	/**
	 * d
	 * @Title: adminAuthenticationFailureHandler
	 * @Description: 登錄異常處理
	 * @return
	 */
	@Bean
	public AdminAuthenticationFailureHandler adminAuthenticationFailureHandler() {
		return new AdminAuthenticationFailureHandler();
	}
	
	/**
	 * @Title: adminAuthenticationSuccessHandler
	 * @Description: 登錄成功後的處理
	 * @return
	 */
	@Bean
	public AdminAuthenticationSuccessHandler adminAuthenticationSuccessHandler() {
		return new AdminAuthenticationSuccessHandler();
	}
	
	/**
	 * @Title: urlAuthenticationInterceptor
	 * @Description: 查詢權限攔截器
	 * @return
	 */
	@Bean("UrlAuthenticationInterceptor")
	public UrlAuthenticationInterceptor urlAuthenticationInterceptor() {
		return new UrlAuthenticationInterceptor();
	}
}

.anyRequest().authenticated().withObjectPostProcessor(new ObjectPostProcessor<FilterSecurityInterceptor>() {

			@Override
			public <O extends FilterSecurityInterceptor> O postProcess(O object) {
				// 權限查詢器
				// 設置你有哪些權限
				object.setSecurityMetadataSource(null);
				
				// 權限決策器
				// 判斷你有沒有權限訪問當前的url
				object.setAccessDecisionManager(null);
				return object;
			}

		})

package com.hp.springboot.admin.security;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

import com.hp.springboot.admin.convert.SysUserConvert;
import com.hp.springboot.admin.dal.ISysUserDAO;
import com.hp.springboot.admin.dal.model.SysUser;
import com.hp.springboot.admin.model.response.SysUserResponseBO;
import com.hp.springboot.database.bean.SQLBuilders;
import com.hp.springboot.database.bean.SQLWhere;

/**
 * 描述：Security需要的操作用戶的接口實現
 * 執行登錄,構建Authentication對象必須的信息
 * 如果用戶不存在，則拋出UsernameNotFoundException異常
 * 作者：黃平
 * 時間：2021年1月12日
 */
public class AdminUserDetailsService implements UserDetailsService {

	private static Logger log = LoggerFactory.getLogger(AdminUserDetailsService.class);
	
	@Autowired
	private ISysUserDAO sysUserDAO;
	
	/**
	 * 執行登錄,構建Authentication對象必須的信息,
	 */
	@Override
	public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
		log.info("loadUserByUsername with username={}", username);
		
		//根據登錄名，查詢用戶
		SysUser user = sysUserDAO.selectOne(SQLBuilders.create()
				.withWhere(SQLWhere.builder()
						.eq("login_name", username)
						.build()
						)
				);
		if (user == null) {
			log.warn("loadUserByUsername with user is not exists. with username={}", username);
			throw new UsernameNotFoundException("用戶不存在");
		}
		
		// 對象裝換，轉換成SysUserResponseBO對象
		SysUserResponseBO resp = SysUserConvert.dal2BOResponse(user);
		return resp;
	}

}

/**
	 * 獲取該用戶的角色
	 */
	public Collection<? extends GrantedAuthority> getAuthorities() {
		return this.authorities;
	}

@Override
	public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
			Authentication authentication) throws IOException, ServletException {
		response.setContentType(ContentTypeConstant.APPLICATION_JSON_UTF8);
		
		// 獲取session對象
		HttpSession session = request.getSession();
		
		//設置登錄用戶session
		setUserSession(session);
		
		//查詢用戶的菜單和按鈕
		setUserMenu(session);
		
		//session中獲取當前登錄的用戶
		SysUserResponseBO user = SecuritySessionUtil.getSessionData();
		
		// 更新最近登錄時間
		sysUserService.updateLastLoginTime(user.getId());
		
		//項目名稱
		session.setAttribute("projectName", projectName);
		
		// 註銷地址
		session.setAttribute("logoutUrl", AdminConstants.LOGOUT_URL);
		
		// 返回json格式數據
		Response<Object> resp = Response.success();
		try (PrintWriter out = response.getWriter()) {
			out.write(resp.toString());
			out.flush();
		}
	}

package com.hp.springboot.admin.security.handler;

import java.io.IOException;
import java.io.PrintWriter;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.authentication.AccountExpiredException;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.CredentialsExpiredException;
import org.springframework.security.authentication.DisabledException;
import org.springframework.security.authentication.InsufficientAuthenticationException;
import org.springframework.security.authentication.LockedException;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;

import com.hp.springboot.admin.exception.ValidateCodeException;
import com.hp.springboot.common.bean.Response;
import com.hp.springboot.common.constant.ContentTypeConstant;

/**
 * 描述：登錄失敗處理 作者：黃平 時間：2021年1月15日
 */
public class AdminAuthenticationFailureHandler implements AuthenticationFailureHandler {

	private static Logger log = LoggerFactory.getLogger(AdminAuthenticationFailureHandler.class);

	@Override
	public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
			AuthenticationException exception) throws IOException, ServletException {
		log.warn("login error with exception is {}", exception.getMessage());
		response.setContentType(ContentTypeConstant.APPLICATION_JSON_UTF8);
		String message = "";
		if (exception instanceof BadCredentialsException || exception instanceof UsernameNotFoundException) {
			message = "賬戶名或者密碼輸入錯誤!";
		} else if (exception instanceof LockedException) {
			message = "賬戶被鎖定，請聯系管理員!";
		} else if (exception instanceof CredentialsExpiredException) {
			message = "密碼過期，請聯系管理員!";
		} else if (exception instanceof AccountExpiredException) {
			message = "賬戶過期，請聯系管理員!";
		} else if (exception instanceof DisabledException) {
			message = "賬戶被禁用，請聯系管理員!";
		} else if (exception instanceof ValidateCodeException) {
			// 圖形驗證碼輸入錯誤
			message = exception.getMessage();
		} else if (exception instanceof InsufficientAuthenticationException) {
			message = exception.getMessage();
		} else {
			message = "登錄失敗!";
		}
		
		// 返回json格式數據
		Response<Object> resp = Response.error(message);
		try (PrintWriter out = response.getWriter()) {
			out.write(resp.toString());
			out.flush();
		}
	}

}