Spring Security實現自動登陸功能示例
當我們在登錄像QQ郵箱這種大多數的網站，往往在登錄按鍵上會有下次自動登錄這個選項，勾選後登錄成功，在一段時間內，即便退出瀏覽器或者服務器重啟，再次訪問不需要用戶輸入賬號密碼進行登錄，這也解決瞭用戶每次輸入賬號密碼的麻煩。
接下來實現自動登陸。
applicatio.properties配置用戶名密碼
spring.security.user.name=java spring.security.user.password=java
controller層實現
@RestController
public class HelloController {
@GetMapping("/hello")
public String hello() {
return "hello";
}
}
配置類實現
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.formLogin()
.and()
.authorizeRequests()
.anyRequest()
.authenticated()
.and()
.rememberMe()
.and()
.csrf().disable();
}
訪問http://localhost:8080/hello，此時系統會重定向到登錄頁面。
二話不說，輸入賬號密碼，開搞！
此時看到瞭登錄數據remember-me的值為on，當自定義登陸框的時候應該知道如何定義key瞭吧。
在hello接口，可以很清楚的看到cookie裡保存瞭一個remember-me的令牌，這個就是自動登錄的關鍵所在。
至於令牌是怎麼生成的，先看一段源碼。核心處理類TokenBasedRememberMeServices->onLoginSuccess
public void onLoginSuccess(HttpServletRequest request, HttpServletResponse response, Authentication successfulAuthentication) {
//拿到用戶名和密碼
String username = this.retrieveUserName(successfulAuthentication);
String password = this.retrievePassword(successfulAuthentication);
//用戶名為空 打印日志
if (!StringUtils.hasLength(username)) {
this.logger.debug("Unable to retrieve username");
} else {
//密碼為空 通過用戶名再去查詢
if (!StringUtils.hasLength(password)) {
UserDetails user = this.getUserDetailsService().loadUserByUsername(username);
password = user.getPassword();
//查到的密碼還為空 打印日志 結束
if (!StringUtils.hasLength(password)) {
this.logger.debug("Unable to obtain password for user: " + username);
return;
}
}
//令牌有效期的生成 1209600是兩周 也就是說令牌有效期14天
int tokenLifetime = this.calculateLoginLifetime(request, successfulAuthentication);
long expiryTime = System.currentTimeMillis();
expiryTime += 1000L * (long)(tokenLifetime < 0 ? 1209600 : tokenLifetime);
//生成簽名 signature
String signatureValue = this.makeTokenSignature(expiryTime, username, password);
//設置cookie
this.setCookie(new String[]{username, Long.toString(expiryTime), signatureValue}, tokenLifetime, request, response);
if (this.logger.isDebugEnabled()) {
this.logger.debug("Added remember-me cookie for user '" + username + "', expiry: '" + new Date(expiryTime) + "'");
}
}
}
//使用MD5加密 通過用戶名、令牌有效期、密碼和key生成rememberMe的令牌 這裡的key也就是加密的鹽值
protected String makeTokenSignature(long tokenExpiryTime, String username, String password) {
String data = username + ":" + tokenExpiryTime + ":" + password + ":" + this.getKey();
try {
MessageDigest digest = MessageDigest.getInstance("MD5");
return new String(Hex.encode(digest.digest(data.getBytes())));
} catch (NoSuchAlgorithmException var7) {
throw new IllegalStateException("No MD5 algorithm available!");
}
}
看完瞭核心的源碼，也就知道瞭令牌的生成規則：username + “:” + tokenExpiryTime + “:” + password + “:” + key（key 是一個散列鹽值，可以用來防治令牌被修改，通過MD5散列函數生成。），然後通過Base64編碼。
取出剛才的remember-me=amF2YToxNjM3MTI2MDk1OTMxOmQ5OGI3OTY5OTE4ZmQwMzE3ZWUyY2U4Y2MzMjQxZGQ0進行下驗證。
解碼後是java:1637126095931:d98b7969918fd0317ee2ce8cc3241dd4，很明顯java是username，1637126095931是兩周後的tokenExpiryTime，d98b7969918fd0317ee2ce8cc3241dd4是password和key值的MD5加密生成的。
需要註意的是key值是通過UUID隨機生成的，當重啟服務器時，UUID的變化會導致自動登錄失敗，所以為瞭避免之前生成的令牌失效，可以在配置中定義key值。
@Override
protected void configure(HttpSecurity http) throws Exception {
http.formLogin()
.and()
.authorizeRequests()
.anyRequest()
.authenticated()
.and()
.rememberMe()
.key("HelloWorld")
.and()
.csrf().disable();
}
在Spring Security—登陸流程分析曾經說到 Spring Security中的認證授權都是通過過濾器來實現的。RememberMeAuthenticationFilter 是自動登錄的核心過濾器。
public class RememberMeAuthenticationFilter extends GenericFilterBean implements ApplicationEventPublisherAware {
private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
throws IOException, ServletException {
//獲取當前用戶實例 繼續過濾校驗
if (SecurityContextHolder.getContext().getAuthentication() != null) {
this.logger.debug(LogMessage
.of(() -> "SecurityContextHolder not populated with remember-me token, as it already contained: '"
+ SecurityContextHolder.getContext().getAuthentication() + "'"));
chain.doFilter(request, response);
return;
}
//登錄獲取Auth
Authentication rememberMeAuth = this.rememberMeServices.autoLogin(request, response);
if (rememberMeAuth != null) {
// Attempt authenticaton via AuthenticationManager
try {
//進行remember-me校驗
rememberMeAuth = this.authenticationManager.authenticate(rememberMeAuth);
// Store to SecurityContextHolder
//保存用戶實例
SecurityContextHolder.getContext().setAuthentication(rememberMeAuth);
//成功頁面跳轉
onSuccessfulAuthentication(request, response, rememberMeAuth);
this.logger.debug(LogMessage.of(() -> "SecurityContextHolder populated with remember-me token: '"
+ SecurityContextHolder.getContext().getAuthentication() + "'"));
if (this.eventPublisher != null) {
this.eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(
SecurityContextHolder.getContext().getAuthentication(), this.getClass()));
}
if (this.successHandler != null) {
this.successHandler.onAuthenticationSuccess(request, response, rememberMeAuth);
return;
}
}
catch (AuthenticationException ex) {
this.logger.debug(LogMessage
.format("SecurityContextHolder not populated with remember-me token, as AuthenticationManager "
+ "rejected Authentication returned by RememberMeServices: '%s'; "
+ "invalidating remember-me token", rememberMeAuth),
ex);
this.rememberMeServices.loginFail(request, response);
//失敗頁面跳轉
onUnsuccessfulAuthentication(request, response, ex);
}
}
chain.doFilter(request, response);
}
}
@Override
public final Authentication autoLogin(HttpServletRequest request, HttpServletResponse response) {
//獲取cookie
String rememberMeCookie = extractRememberMeCookie(request);
if (rememberMeCookie == null) {
return null;
}
this.logger.debug("Remember-me cookie detected");
if (rememberMeCookie.length() == 0) {
this.logger.debug("Cookie was empty");
cancelCookie(request, response);
return null;
}
try {
//解碼cookie 拿到令牌
String[] cookieTokens = decodeCookie(rememberMeCookie);
//通過令牌獲取UserdDetails
UserDetails user = processAutoLoginCookie(cookieTokens, request, response);
this.userDetailsChecker.check(user);
this.logger.debug("Remember-me cookie accepted");
return createSuccessfulAuthentication(request, user);
}
catch (CookieTheftException ex) {
cancelCookie(request, response);
throw ex;
}
catch (UsernameNotFoundException ex) {
this.logger.debug("Remember-me login was valid but corresponding user not found.", ex);
}
catch (InvalidCookieException ex) {
this.logger.debug("Invalid remember-me cookie: " + ex.getMessage());
}
catch (AccountStatusException ex) {
this.logger.debug("Invalid UserDetails: " + ex.getMessage());
}
catch (RememberMeAuthenticationException ex) {
this.logger.debug(ex.getMessage());
}
cancelCookie(request, response);
return null;
}
大致整體流程就是如果拿不到實例，則進行remember-me驗證，通過autoLogin方法裡獲取cookie，解析令牌，拿到Auth，最後進行校驗。之後剩下的和登陸流程分析的差不多。
到此這篇關於Spring Security實現自動登陸功能示例的文章就介紹到這瞭,更多相關Spring Security 自動登陸內容請搜索WalkonNet以前的文章或繼續瀏覽下面的相關文章希望大傢以後多多支持WalkonNet！
推薦閱讀：
- Spring Security安全框架之記住我功能
- Spring Security實現HTTP認證
- SSM項目使用攔截器實現登錄驗證功能
- Spring Security認證的完整流程記錄
- JavaWeb實現簡單的自動登錄功能