Spring Security實現HTTP認證
Spring Security是一個能夠為基於Spring的企業應用系統提供聲明式的安全訪問控制解決方案的安全框架。它提供瞭一組可以在Spring應用上下文中配置的Bean，充分利用瞭Spring IoC（控制反轉），DI（依賴註入）和AOP（面向切面編程）功能，為應用系統提供聲明式的安全訪問控制功能，減少瞭為企業系統安全控制編寫大量重復代碼的工作。
前言
除系統內維護的用戶名和密碼認證技術外，Spring Security還支持HTTP層面的認證，包括HTTP基本認證和HTTP摘要認證
一、HTTP基本認證是什麼？
HTTP基本認證是在RFC2616中定義的一種認證模式。
二、HTTP基本認證流程
- 客戶端發起一條沒有攜帶認證信息的請求。
- 服務器返回一條401 Unauthorized響應， 並在WWW-Authentication首部說明認證形式， 當進行HTTP基本認證時， WWW-Authentication會被設置為Basic realm=“被保護頁面”。
- 客戶端收到401 Unauthorized 響應後， 彈出對話框， 詢問用戶名和密碼。 當用戶完成後， 客戶端將用戶名和密碼使用冒號拼接並編碼為Base64形式， 然後放入請求的Authorization首部發送給服務器。
- 服務器解碼得到客戶端發來的用戶名和密碼，並在驗證它們是正確的之後，返回客戶端請求的報文
有上面可以看出隻需要驗證Authentication即可，因此如果不使用瀏覽器訪問HTTP基本認證保護的頁面，則自行在請求頭中設置Authorization也是可以.
HTTP基本認證是一種無狀態的認證方式，與表單認證相比，HTTP基本認證是一種基於HTTP層面的認證方式，無法攜帶session，即無法實現Remember-ME功能。另外，用戶名和密碼在傳遞時僅做一次簡單的Base64編碼，幾乎等同於明文傳輸，極易出現密碼被竊聽和重放攻擊等安全性問題，在實際系統開發中很少使用這種方式來進行安全驗證。 如果有必要，也應使用加密的傳輸層HTTPS來保障安全.
一.Spring Security使用HTTP基本認證
1.創建項目spring-security-http-auth
pom.xml:
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
2.創建配置文件WebSecurityConfig
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests().anyRequest().authenticated().and().httpBasic();
}
}
上面的配置最後添加瞭httpBasic()，使用http基本認證
3.運行項目
訪問本地項目，http://localhost:8080
會彈出登陸框，我們看到調試工具中返回瞭401無權限。
我們使用Spring Security提供的默認的用戶名和密碼登陸。
登陸成功後，header中就會有Authorization: Basic dXNlcjo0NWU2NzViOC1hZGYwLTQzNzMtYjA2MS02MGE0YzkzZjA2ZGU=
二.Spring Security HTTP基本認證原理
上面我們實現瞭HTTP基本認證，我們看看其中Spring Security中是如何做到的？
我們使用HTTP基本認證的時候，在配置類中使用httpBasic()進行處理。
httpBasic方法：
public HttpBasicConfigurer<HttpSecurity> httpBasic() throws Exception {
return (HttpBasicConfigurer)this.getOrApply(new HttpBasicConfigurer());
}
上面可以看出，Spring Security進行HTTP基本認證是使用HttpBasicConfigurer配置類進行的。HttpBasicConfigurer.class:
//構建HttpBasicConfigurer
public HttpBasicConfigurer() {
this.realmName("Realm");
LinkedHashMap<RequestMatcher, AuthenticationEntryPoint> entryPoints = new LinkedHashMap();
entryPoints.put(X_REQUESTED_WITH, new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED));
DelegatingAuthenticationEntryPoint defaultEntryPoint = new DelegatingAuthenticationEntryPoint(entryPoints);
defaultEntryPoint.setDefaultEntryPoint(this.basicAuthEntryPoint);
this.authenticationEntryPoint = defaultEntryPoint;
}
//進行配置
public void configure(B http) {
//進行認證管理
AuthenticationManager authenticationManager = (AuthenticationManager)http.getSharedObject(AuthenticationManager.class);
//聲明basic認證攔截器
BasicAuthenticationFilter basicAuthenticationFilter = new BasicAuthenticationFilter(authenticationManager, this.authenticationEntryPoint);
if (this.authenticationDetailsSource != null) {
basicAuthenticationFilter.setAuthenticationDetailsSource(this.authenticationDetailsSource);
}
//註冊一個RememberMeServices
RememberMeServices rememberMeServices = (RememberMeServices)http.getSharedObject(RememberMeServices.class);
if (rememberMeServices != null) {
//設置rememberMeServices
basicAuthenticationFilter.setRememberMeServices(rememberMeServices);
}
//申明basicAuthenticationFilter過濾器
basicAuthenticationFilter = (BasicAuthenticationFilter)this.postProcess(basicAuthenticationFilter);
http.addFilter(basicAuthenticationFilter);
}
上面聲明BasicAuthenticationFilter並添加到攔截器鏈中BasicAuthenticationFilter.class:
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
try {
//獲取token
UsernamePasswordAuthenticationToken authRequest = this.authenticationConverter.convert(request);
//authRequest為空直接放行
if (authRequest == null) {
this.logger.trace("Did not process authentication request since failed to find username and password in Basic Authorization header");
chain.doFilter(request, response);
return;
}
//獲取用戶名
String username = authRequest.getName();
this.logger.trace(LogMessage.format("Found username '%s' in Basic Authorization header", username));
if (this.authenticationIsRequired(username)) {
Authentication authResult = this.authenticationManager.authenticate(authRequest);
//創建上下文
SecurityContext context = SecurityContextHolder.createEmptyContext();
context.setAuthentication(authResult);
//設置響應的上下文
SecurityContextHolder.setContext(context);
if (this.logger.isDebugEnabled()) {
this.logger.debug(LogMessage.format("Set SecurityContextHolder to %s", authResult));
}
this.rememberMeServices.loginSuccess(request, response, authResult);
this.onSuccessfulAuthentication(request, response, authResult);
}
} catch (AuthenticationException var8) {
SecurityContextHolder.clearContext();
this.logger.debug("Failed to process authentication request", var8);
this.rememberMeServices.loginFail(request, response);
this.onUnsuccessfulAuthentication(request, response, var8);
if (this.ignoreFailure) {
chain.doFilter(request, response);
} else {
this.authenticationEntryPoint.commence(request, response, var8);
}
return;
}
chain.doFilter(request, response);
}
BasicAuthenticationEntryPoint返回進行響應的處理
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException {
//添加響應響應頭
response.addHeader("WWW-Authenticate", "Basic realm=\"" + this.realmName + "\"");
response.sendError(HttpStatus.UNAUTHORIZED.value(), HttpStatus.UNAUTHORIZED.getReasonPhrase());
}
三.HTTP摘要認證是什麼？
HTTP摘要認證和HTTP基本認證一樣，也是在RFC2616中定義的認證模式，RFC2617專門對這兩種認證模式做瞭規定。與 HTTP 基本認證相比，HTTP 摘要認證使用對通信雙方都可知的口令進行校驗，且最終的傳輸數據並非明文形式。
摘要認證是一種協議規定的Web服務器用來同網頁瀏覽器進行認證信息協商的方法。它在密碼發出前，先對其應用哈希函數，這相對於HTTP基本認證發送明文而言，更安全。
從技術上講，摘要認證是使用隨機數來阻止進行密碼分析的MD5加密哈希函數應用。
HTTP摘要認證流程：
HTTP摘要認證中的相關參數：
- username： 用戶名。
- password： 用戶密碼。
- realm： 認證域， 由服務器返回。
- opaque： 透傳字符串， 客戶端應原樣返回。
- method： 請求的方法。
- nonce： 由服務器生成的隨機字符串。
- nc： 即nonce-count， 指請求的次數， 用於計數， 防止重放攻擊。 qop被指定時， nc也必須被指定。
- cnonce： 客戶端發給服務器的隨機字符串， qop被指定時， cnonce也必須被指定。
- qop： 保護級別， 客戶端根據此參數指定摘要算法。 若取值為auth， 則隻進行身份驗證； 若取
- 值為auth-int， 則還需要校驗內容完整性。
- uri： 請求的uri。
- response：客戶端根據算法算出的摘要值。
- algorithm：摘要算法， 目前僅支持MD5。
- entity-body：頁面實體，非消息實體，僅在auth-int中支持。
- 通常服務器攜帶的數據包括realm、 opaque、 nonce、 qop等字段， 如果客戶端需要做出驗證回應，就必須按照一定的算法計算得到一些新的數據並一起返回。
四.Spring Security使用HTTP摘要認證流程？
在Spring Security中沒有像HTTP基礎認證那樣，通過httpBasic()方法進行集成HTTP摘要認證，但是Spring Security提供瞭像BasicAuthenticationEntryPoint一樣的DigestAuthenticationEntryPoint.就是我們需要將DigestAuthenticationEntryPoint添加到filter過濾器中去處理。
代碼如下：WebSecurityConfig類：
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private DigestAuthenticationEntryPoint digestAuthenticationEntryPoint;
@Autowired
private UserDetailsService userDetailsService;
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests().anyRequest().authenticated().and()
.exceptionHandling()
.authenticationEntryPoint(digestAuthenticationEntryPoint)
.and().addFilter(digestAuthenticationFilter());
}
public DigestAuthenticationFilter digestAuthenticationFilter(){
DigestAuthenticationFilter digestAuthenticationFilter = new DigestAuthenticationFilter();
digestAuthenticationFilter.setUserDetailsService(userDetailsService);
digestAuthenticationFilter.setAuthenticationEntryPoint(digestAuthenticationEntryPoint);
return digestAuthenticationFilter;
}
}
申明DigestAuthenticationEntryPointBean:
@Bean
public DigestAuthenticationEntryPoint digestAuthenticationEntryPoint(){
DigestAuthenticationEntryPoint digestAuthenticationEntryPoint = new DigestAuthenticationEntryPoint();
digestAuthenticationEntryPoint.setRealmName("realName");
digestAuthenticationEntryPoint.setKey("tony");
return digestAuthenticationEntryPoint;
}
@Bean
public DigestAuthenticationEntryPoint digestAuthenticationEntryPoint(){
DigestAuthenticationEntryPoint digestAuthenticationEntryPoint = new DigestAuthenticationEntryPoint();
digestAuthenticationEntryPoint.setRealmName("realm");
digestAuthenticationEntryPoint.setKey("tony");
return digestAuthenticationEntryPoint;
}
@Bean
public UserDetailsService userDetailsService() {
InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
manager.createUser(User.withUsername("tony").password("123456").roles("admin").build());
return manager;
}
@Bean
public PasswordEncoder passwordEncoder() {
return NoOpPasswordEncoder.getInstance();
}
運行項目
訪問主頁，http://localhost:8080,返回如下頁面：
我們輸入用戶名和密碼登陸。
當長時間未登錄，隨機字符串到期瞭也登陸不上。
默認的過期時間為300s，我們可以通過設置時間。DigestAuthenticationEntryPoint中realmName和key是必須要設置的。
相關源碼：
public void afterPropertiesSet() {
Assert.hasLength(this.realmName, "realmName must be specified");
Assert.hasLength(this.key, "key must be specified");
}
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException {
//計算過期時間
long expiryTime = System.currentTimeMillis() + (long)(this.nonceValiditySeconds * 1000);
//計算簽名值
String signatureValue = DigestAuthUtils.md5Hex(expiryTime + ":" + this.key);
//隨機字符串
String nonceValue = expiryTime + ":" + signatureValue;
//隨機字符串base64
String nonceValueBase64 = new String(Base64.getEncoder().encode(nonceValue.getBytes()));
String authenticateHeader = "Digest realm=\"" + this.realmName + "\", qop=\"auth\", nonce=\"" + nonceValueBase64 + "\"";
if (authException instanceof NonceExpiredException) {
authenticateHeader = authenticateHeader + ", stale=\"true\"";
}
logger.debug(LogMessage.format("WWW-Authenticate header sent to user agent: %s", authenticateHeader));
response.addHeader("WWW-Authenticate", authenticateHeader);
response.sendError(HttpStatus.UNAUTHORIZED.value(), HttpStatus.UNAUTHORIZED.getReasonPhrase());
}
進行處理的時候使用DigestAuthenticationFilter進行處理
public void afterPropertiesSet() {
//必須設置userDetailsService
Assert.notNull(this.userDetailsService, "A UserDetailsService is required");
//必須設置authenticationEntryPoint
Assert.notNull(this.authenticationEntryPoint, "A DigestAuthenticationEntryPoint is required");
}
private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
String header = request.getHeader("Authorization");
if (header != null && header.startsWith("Digest ")) {
logger.debug(LogMessage.format("Digest Authorization header received from user agent: %s", header));
DigestAuthenticationFilter.DigestData digestAuth = new DigestAuthenticationFilter.DigestData(header);
try {
//驗證並且解密
digestAuth.validateAndDecode(this.authenticationEntryPoint.getKey(), this.authenticationEntryPoint.getRealmName());
} catch (BadCredentialsException var11) {
this.fail(request, response, var11);
return;
}
//緩存
boolean cacheWasUsed = true;
//緩存用戶數據
UserDetails user = this.userCache.getUserFromCache(digestAuth.getUsername());
String serverDigestMd5;
try {
if (user == null) {
cacheWasUsed = false;
user = this.userDetailsService.loadUserByUsername(digestAuth.getUsername());
if (user == null) {
throw new AuthenticationServiceException("AuthenticationDao returned null, which is an interface contract violation");
}
this.userCache.putUserInCache(user);
}
//服務器md5摘要
serverDigestMd5 = digestAuth.calculateServerDigest(user.getPassword(), request.getMethod());
if (!serverDigestMd5.equals(digestAuth.getResponse()) && cacheWasUsed) {
logger.debug("Digest comparison failure; trying to refresh user from DAO in case password had changed");
user = this.userDetailsService.loadUserByUsername(digestAuth.getUsername());
this.userCache.putUserInCache(user);
serverDigestMd5 = digestAuth.calculateServerDigest(user.getPassword(), request.getMethod());
}
} catch (UsernameNotFoundException var12) {
String message = this.messages.getMessage("DigestAuthenticationFilter.usernameNotFound", new Object[]{digestAuth.getUsername()}, "Username {0} not found");
this.fail(request, response, new BadCredentialsException(message));
return;
}
String message;
if (!serverDigestMd5.equals(digestAuth.getResponse())) {
logger.debug(LogMessage.format("Expected response: '%s' but received: '%s'; is AuthenticationDao returning clear text passwords?", serverDigestMd5, digestAuth.getResponse()));
message = this.messages.getMessage("DigestAuthenticationFilter.incorrectResponse", "Incorrect response");
this.fail(request, response, new BadCredentialsException(message));
} else if (digestAuth.isNonceExpired()) {
message = this.messages.getMessage("DigestAuthenticationFilter.nonceExpired", "Nonce has expired/timed out");
this.fail(request, response, new NonceExpiredException(message));
} else {
logger.debug(LogMessage.format("Authentication success for user: '%s' with response: '%s'", digestAuth.getUsername(), digestAuth.getResponse()));
Authentication authentication = this.createSuccessfulAuthentication(request, user);
SecurityContext context = SecurityContextHolder.createEmptyContext();
context.setAuthentication(authentication);
SecurityContextHolder.setContext(context);
chain.doFilter(request, response);
}
} else {
chain.doFilter(request, response);
}
}
DigestData為摘要數據：
private class DigestData {
//用戶名
private final String username;
//認證域
private final String realm;
//隨機字符串
private final String nonce;
private final String uri;
private final String response;
//保護級別
private final String qop;
//即nonce-count， 指請求的次數， 用於計數， 防止重放攻擊
private final String nc;
private final String cnonce;
private final String section212response;
private long nonceExpiryTime;
DigestData(String header) {
this.section212response = header.substring(7);
String[] headerEntries = DigestAuthUtils.splitIgnoringQuotes(this.section212response, ',');
Map<String, String> headerMap = DigestAuthUtils.splitEachArrayElementAndCreateMap(headerEntries, "=", "\"");
this.username = (String)headerMap.get("username");
this.realm = (String)headerMap.get("realm");
this.nonce = (String)headerMap.get("nonce");
this.uri = (String)headerMap.get("uri");
this.response = (String)headerMap.get("response");
this.qop = (String)headerMap.get("qop");
this.nc = (String)headerMap.get("nc");
this.cnonce = (String)headerMap.get("cnonce");
DigestAuthenticationFilter.logger.debug(LogMessage.format("Extracted username: '%s'; realm: '%s'; nonce: '%s'; uri: '%s'; response: '%s'", new Object[]{this.username, this.realm, this.nonce, this.uri, this.response}));
}
//驗證和解密
void validateAndDecode(String entryPointKey, String expectedRealm) throws BadCredentialsException {
if (this.username != null && this.realm != null && this.nonce != null && this.uri != null && this.response != null) {
if ("auth".equals(this.qop) && (this.nc == null || this.cnonce == null)) {
DigestAuthenticationFilter.logger.debug(LogMessage.format("extracted nc: '%s'; cnonce: '%s'", this.nc, this.cnonce));
throw new BadCredentialsException(DigestAuthenticationFilter.this.messages.getMessage("DigestAuthenticationFilter.missingAuth", new Object[]{this.section212response}, "Missing mandatory digest value; received header {0}"));
} else if (!expectedRealm.equals(this.realm)) {
throw new BadCredentialsException(DigestAuthenticationFilter.this.messages.getMessage("DigestAuthenticationFilter.incorrectRealm", new Object[]{this.realm, expectedRealm}, "Response realm name '{0}' does not match system realm name of '{1}'"));
} else {
byte[] nonceBytes;
try {
nonceBytes = Base64.getDecoder().decode(this.nonce.getBytes());
} catch (IllegalArgumentException var8) {
throw new BadCredentialsException(DigestAuthenticationFilter.this.messages.getMessage("DigestAuthenticationFilter.nonceEncoding", new Object[]{this.nonce}, "Nonce is not encoded in Base64; received nonce {0}"));
}
String nonceAsPlainText = new String(nonceBytes);
String[] nonceTokens = StringUtils.delimitedListToStringArray(nonceAsPlainText, ":");
if (nonceTokens.length != 2) {
throw new BadCredentialsException(DigestAuthenticationFilter.this.messages.getMessage("DigestAuthenticationFilter.nonceNotTwoTokens", new Object[]{nonceAsPlainText}, "Nonce should have yielded two tokens but was {0}"));
} else {
try {
this.nonceExpiryTime = new Long(nonceTokens[0]);
} catch (NumberFormatException var7) {
throw new BadCredentialsException(DigestAuthenticationFilter.this.messages.getMessage("DigestAuthenticationFilter.nonceNotNumeric", new Object[]{nonceAsPlainText}, "Nonce token should have yielded a numeric first token, but was {0}"));
}
String expectedNonceSignature = DigestAuthUtils.md5Hex(this.nonceExpiryTime + ":" + entryPointKey);
if (!expectedNonceSignature.equals(nonceTokens[1])) {
throw new BadCredentialsException(DigestAuthenticationFilter.this.messages.getMessage("DigestAuthenticationFilter.nonceCompromised", new Object[]{nonceAsPlainText}, "Nonce token compromised {0}"));
}
}
}
} else {
throw new BadCredentialsException(DigestAuthenticationFilter.this.messages.getMessage("DigestAuthenticationFilter.missingMandatory", new Object[]{this.section212response}, "Missing mandatory digest value; received header {0}"));
}
}
//計算服務摘要
String calculateServerDigest(String password, String httpMethod) {
//生產摘要
return DigestAuthUtils.generateDigest(DigestAuthenticationFilter.this.passwordAlreadyEncoded, this.username, this.realm, password, httpMethod, this.uri, this.qop, this.nonce, this.nc, this.cnonce);
}
//判斷隨機數是否到期
boolean isNonceExpired() {
long now = System.currentTimeMillis();
return this.nonceExpiryTime < now;
}
String getUsername() {
return this.username;
}
String getResponse() {
return this.response;
}
}
到此這篇關於Spring Security實現HTTP認證的文章就介紹到這瞭,更多相關Spring Security HTTP認證內容請搜索WalkonNet以前的文章或繼續瀏覽下面的相關文章希望大傢以後多多支持WalkonNet！
推薦閱讀：
- spring security認證異常後返回中文提示的問題
- Spring Security實現自動登陸功能示例
- Spring Security過濾器鏈加載執行流程源碼解析
- Redis快速實現分佈式session的方法詳解
- Spring Security認證的完整流程記錄