SpringSecurity实现验证码功能

转x33g5p2x  于2022-03-23 转载在 Spring  
字(15.9k)|赞(0)|评价(0)|浏览(275)

1.pom.xml

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  3.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  4.     <modelVersion>4.0.0</modelVersion>
  5.     <parent>
  6.         <groupId>org.springframework.boot</groupId>
  7.         <artifactId>spring-boot-starter-parent</artifactId>
  8.         <version>2.6.4</version>
  9.         <relativePath/> <!-- lookup parent from repository -->
  10.     </parent>
  11.     <groupId>com.yl</groupId>
  12.     <artifactId>securitydemo</artifactId>
  13.     <version>0.0.1-SNAPSHOT</version>
  14.     <name>securitydemo</name>
  15.     <description>Demo project for Spring Boot</description>
  16.     <properties>
  17.         <java.version>11</java.version>
  18.     </properties>
  19.     <dependencies>
  20.         <dependency>
  21.             <groupId>org.springframework.boot</groupId>
  22.             <artifactId>spring-boot-starter-security</artifactId>
  23.         </dependency>
  24.         <dependency>
  25.             <groupId>org.springframework.boot</groupId>
  26.             <artifactId>spring-boot-starter-web</artifactId>
  27.         </dependency>
  28.         <dependency>
  29.             <groupId>com.alibaba</groupId>
  30.             <artifactId>druid-spring-boot-starter</artifactId>
  31.             <version>1.1.10</version>
  32.         </dependency>
  33.         <dependency>
  34.             <groupId>org.mybatis.spring.boot</groupId>
  35.             <artifactId>mybatis-spring-boot-starter</artifactId>
  36.             <version>2.2.2</version>
  37.         </dependency>
  38.         <dependency>
  39.             <groupId>mysql</groupId>
  40.             <artifactId>mysql-connector-java</artifactId>
  41.             <scope>runtime</scope>
  42.         </dependency>
  43.         <dependency>
  44.             <groupId>com.github.penggle</groupId>
  45.             <artifactId>kaptcha</artifactId>
  46.             <version>2.3.2</version>
  47.         </dependency>
  48.         <dependency>
  49.             <groupId>org.springframework.boot</groupId>
  50.             <artifactId>spring-boot-starter-test</artifactId>
  51.             <scope>test</scope>
  52.         </dependency>
  53.         <dependency>
  54.             <groupId>org.springframework.security</groupId>
  55.             <artifactId>spring-security-test</artifactId>
  56.             <scope>test</scope>
  57.         </dependency>
  58.     </dependencies>
  60.     <build>
  61.         <resources>
  62.             <resource>
  63.                 <directory>src/main/java</directory>
  64.                 <includes>
  65.                     <include>**/*.xml</include>
  66.                 </includes>
  67.             </resource>
  68.             <resource>
  69.                 <directory>src/min/resources</directory>
  70.             </resource>
  71.         </resources>
  72.         <plugins>
  73.             <plugin>
  74.                 <groupId>org.springframework.boot</groupId>
  75.                 <artifactId>spring-boot-maven-plugin</artifactId>
  76.             </plugin>
  77.         </plugins>
  78.     </build>
  80. </project>

2.建表语句

  1. DROP TABLE IF EXISTS `user`;
  2. CREATE TABLE `user`  (
  3.   `id` int(11) NOT NULL AUTO_INCREMENT,
  4.   `username` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL,
  5.   `password` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL,
  6.   `enabled` tinyint(1) NULL DEFAULT NULL,
  7.   `locked` tinyint(1) NULL DEFAULT NULL,
  8.   PRIMARY KEY (`id`) USING BTREE
  9. ) ENGINE = InnoDB AUTO_INCREMENT = 4 CHARACTER SET = utf8mb4 COLLATE = utf8mb4_0900_ai_ci ROW_FORMAT = Dynamic;
  11. -- ----------------------------
  12. -- Records of user
  13. -- ----------------------------
  14. INSERT INTO `user` VALUES (1, 'root', '$2a$10$O8G0X/sUPAA76MV7U3BwY.3Uo8/QMBcqK678Rwkoz.fowbce.CLtO', 1, 0);
  15. INSERT INTO `user` VALUES (2, 'admin', '$2a$10$O8G0X/sUPAA76MV7U3BwY.3Uo8/QMBcqK678Rwkoz.fowbce.CLtO', 1, 0);
  16. INSERT INTO `user` VALUES (3, 'tom', '$2a$10$O8G0X/sUPAA76MV7U3BwY.3Uo8/QMBcqK678Rwkoz.fowbce.CLtO', 1, 0);
  18. DROP TABLE IF EXISTS `role`;
  19. CREATE TABLE `role`  (
  20.   `id` int(11) NOT NULL AUTO_INCREMENT,
  21.   `name` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL,
  22.   `description` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL,
  23.   PRIMARY KEY (`id`) USING BTREE
  24. ) ENGINE = InnoDB AUTO_INCREMENT = 4 CHARACTER SET = utf8mb4 COLLATE = utf8mb4_0900_ai_ci ROW_FORMAT = Dynamic;
  26. -- ----------------------------
  27. -- Records of role
  28. -- ----------------------------
  29. INSERT INTO `role` VALUES (1, 'ROLE_db', '数据库管理员');
  30. INSERT INTO `role` VALUES (2, 'ROLE_admin', '系统管理员');
  31. INSERT INTO `role` VALUES (3, 'ROLE_user', '用户');
  33. DROP TABLE IF EXISTS `user_role_ref`;
  34. CREATE TABLE `user_role_ref`  (
  35.   `id` int(11) NOT NULL AUTO_INCREMENT,
  36.   `user_id` int(11) NULL DEFAULT NULL,
  37.   `role_id` int(11) NULL DEFAULT NULL,
  38.   PRIMARY KEY (`id`) USING BTREE
  39. ) ENGINE = InnoDB AUTO_INCREMENT = 5 CHARACTER SET = utf8mb4 COLLATE = utf8mb4_0900_ai_ci ROW_FORMAT = Dynamic;
  41. -- ----------------------------
  42. -- Records of user_role_ref
  43. -- ----------------------------
  44. INSERT INTO `user_role_ref` VALUES (1, 1, 1);
  45. INSERT INTO `user_role_ref` VALUES (2, 1, 2);
  46. INSERT INTO `user_role_ref` VALUES (3, 2, 2);
  47. INSERT INTO `user_role_ref` VALUES (4, 3, 3);

3. application.properties

  1. spring.datasource.url=jdbc:mysql://localhost:3306/demo?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai
  2. spring.datasource.type=com.alibaba.druid.pool.DruidDataSource
  3. spring.datasource.username=root
  4. spring.datasource.password=root

4.model

  1. package com.yl.securitydemo.model;
  3. import org.springframework.security.core.GrantedAuthority;
  4. import org.springframework.security.core.authority.SimpleGrantedAuthority;
  5. import org.springframework.security.core.userdetails.UserDetails;
  7. import java.util.ArrayList;
  8. import java.util.Collection;
  9. import java.util.List;
  11. public class User implements UserDetails {
  12.     private Integer id;
  13.     private String username;
  14.     private String password;
  15.     private Boolean enabled;
  16.     private Boolean locked;
  17.     private List<Role> roles;
  19.     public Integer getId() {
  20.         return id;
  21.     }
  23.     public void setId(Integer id) {
  24.         this.id = id;
  25.     }
  27.     public void setUsername(String username) {
  28.         this.username = username;
  29.     }
  31.     @Override
  32.     public Collection<? extends GrantedAuthority> getAuthorities() {
  33.         List<SimpleGrantedAuthority> list = new ArrayList<>();
  34.         for (Role role : roles) {
  35.             list.add(new SimpleGrantedAuthority("ROLE_" + role.getName()));
  36.         }
  37.         return list;
  38.     }
  40.     @Override
  41.     public String getPassword() {
  42.         return password;
  43.     }
  45.     @Override
  46.     public String getUsername() {
  47.         return username;
  48.     }
  50.     // 账户是否未过期
  51.     @Override
  52.     public boolean isAccountNonExpired() {
  53.         return true;
  54.     }
  56.     // 账户是否未锁定
  57.     @Override
  58.     public boolean isAccountNonLocked() {
  59.         return !locked;
  60.     }
  62.     // 凭证是否未过期
  63.     @Override
  64.     public boolean isCredentialsNonExpired() {
  65.         return true;
  66.     }
  68.     @Override
  69.     public boolean isEnabled() {
  70.         return enabled;
  71.     }
  73.     public void setPassword(String password) {
  74.         this.password = password;
  75.     }
  77.     public void setEnabled(Boolean enabled) {
  78.         this.enabled = enabled;
  79.     }
  81.     public void setLocked(Boolean locked) {
  82.         this.locked = locked;
  83.     }
  85.     public List<Role> getRoles() {
  86.         return roles;
  87.     }
  89.     public void setRoles(List<Role> roles) {
  90.         this.roles = roles;
  91.     }
  93.     @Override
  94.     public String toString() {
  95.         return "User{" +
  96.                 "id=" + id +
  97.                 ", username='" + username + '\'' +
  98.                 ", password='" + password + '\'' +
  99.                 ", enabled=" + enabled +
  100.                 ", locked=" + locked +
  101.                 '}';
  102.     }
  103. }
  1. package com.yl.securitydemo.model;
  3. import java.io.Serializable;
  5. public class Role implements Serializable {
  6.     private Integer id;
  7.     private String name;
  8.     private String description;
  10.     public Integer getId() {
  11.         return id;
  12.     }
  14.     public void setId(Integer id) {
  15.         this.id = id;
  16.     }
  18.     public String getName() {
  19.         return name;
  20.     }
  22.     public void setName(String name) {
  23.         this.name = name;
  24.     }
  26.     public String getDescription() {
  27.         return description;
  28.     }
  30.     public void setDescription(String description) {
  31.         this.description = description;
  32.     }
  34.     @Override
  35.     public String toString() {
  36.         return "Role{" +
  37.                 "id=" + id +
  38.                 ", name='" + name + '\'' +
  39.                 ", description='" + description + '\'' +
  40.                 '}';
  41.     }
  42. }
  1. package com.yl.securitydemo.model;
  3. import java.io.Serializable;
  5. public class UserRoleRef implements Serializable {
  6.     private Integer id;
  7.     private Integer userId;
  8.     private Integer roleId;
  10.     public Integer getId() {
  11.         return id;
  12.     }
  14.     public void setId(Integer id) {
  15.         this.id = id;
  16.     }
  18.     public Integer getUserId() {
  19.         return userId;
  20.     }
  22.     public void setUserId(Integer userId) {
  23.         this.userId = userId;
  24.     }
  26.     public Integer getRoleId() {
  27.         return roleId;
  28.     }
  30.     public void setRoleId(Integer roleId) {
  31.         this.roleId = roleId;
  32.     }
  34.     @Override
  35.     public String toString() {
  36.         return "UserRoleRef{" +
  37.                 "id=" + id +
  38.                 ", userId=" + userId +
  39.                 ", roleId=" + roleId +
  40.                 '}';
  41.     }
  42. }

5.mapper及其对应的xml文件

  1. package com.yl.securitydemo.mapper;
  4. import com.yl.securitydemo.model.Role;
  5. import com.yl.securitydemo.model.User;
  6. import org.apache.ibatis.annotations.Mapper;
  8. import java.util.List;
  10. @Mapper
  11. public interface UserMapper {
  12.     User loadUserByUsername(String username);
  14.     List<Role> getRolesByUserId(Integer userId);
  15. }
  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
  3. <mapper namespace="com.yl.securitydemo.mapper.UserMapper">
  5.     <select id="loadUserByUsername" resultType="com.yl.securitydemo.model.User">
  6.         select * from user where username = #{username}
  7.     </select>
  8.     <select id="getRolesByUserId" resultType="com.yl.securitydemo.model.Role">
  9.         select * from role where id in (select role_id from user_role_ref where user_id = #{userId})
  10.     </select>
  12. </mapper>

6.UserService

  1. package com.yl.securitydemo.service;
  3. import com.yl.securitydemo.mapper.UserMapper;
  4. import com.yl.securitydemo.model.User;
  5. import org.springframework.beans.factory.annotation.Autowired;
  6. import org.springframework.security.core.userdetails.UserDetails;
  7. import org.springframework.security.core.userdetails.UserDetailsService;
  8. import org.springframework.security.core.userdetails.UsernameNotFoundException;
  9. import org.springframework.stereotype.Service;
  11. @Service
  12. public class UserService implements UserDetailsService {
  13.     @Autowired
  14.     UserMapper userMapper;
  16.     @Override
  17.     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
  18.         User user = userMapper.loadUserByUsername(username);
  19.         if (user == null) {
  20.             throw new UsernameNotFoundException("用户名不存在");
  21.         }
  22.         user.setRoles(userMapper.getRolesByUserId(user.getId()));
  23.         return user;
  24.     }
  25. }

7.controller

  1. package com.yl.securitydemo.controller;
  3. import com.google.code.kaptcha.Producer;
  4. import org.springframework.beans.factory.annotation.Autowired;
  5. import org.springframework.web.bind.annotation.GetMapping;
  6. import org.springframework.web.bind.annotation.RestController;
  8. import javax.imageio.ImageIO;
  9. import javax.servlet.ServletOutputStream;
  10. import javax.servlet.http.HttpServletResponse;
  11. import javax.servlet.http.HttpSession;
  12. import java.awt.image.BufferedImage;
  14. @RestController
  15. public class KaptchaController {
  16.     @Autowired
  17.     Producer producer;
  19.     @GetMapping("/hello")
  20.     public String hello() {
  21.         return "hello";
  22.     }
  24.     //生成验证码
  25.     @GetMapping("/getVerifyCode")
  26.     public void getVerifyCode(HttpServletResponse response, HttpSession session) throws Exception{
  27.         response.setContentType("image/jpeg");
  28.         String text = producer.createText();
  29.         session.setAttribute("vf",text);
  30.         BufferedImage image = producer.createImage(text);
  31.         try(ServletOutputStream sos = response.getOutputStream()) {
  32.             ImageIO.write(image,"jpg",sos);
  33.         }
  34.     }
  35. }

8.验证码配置

  1. package com.yl.securitydemo.config;
  3. import com.google.code.kaptcha.Producer;
  4. import com.google.code.kaptcha.impl.DefaultKaptcha;
  5. import com.google.code.kaptcha.util.Config;
  6. import org.springframework.context.annotation.Bean;
  7. import org.springframework.context.annotation.Configuration;
  9. import java.util.Properties;
  11. @Configuration
  12. public class VerifyCodeConfig {
  13.     @Bean
  14.     Producer producer() {
  15.         Properties properties = new Properties();
  16.         properties.setProperty("kaptcha.image.width","150");
  17.         properties.setProperty("kaptcha.image.height","50");
  18.         properties.setProperty("kaptcha.textproducer.char.string","0123456789");
  19.         properties.setProperty("kaptcha.textproducer.char.length","4");
  20.         DefaultKaptcha defaultKaptcha = new DefaultKaptcha();
  21.         defaultKaptcha.setConfig(new Config(properties));
  22.         return defaultKaptcha;
  23.     }
  24. }

9.自定义AuthenticationProvider,对验证码进行校验

  1. package com.yl.securitydemo.config;
  3. import org.apache.tomcat.util.http.fileupload.servlet.ServletRequestContext;
  4. import org.springframework.context.annotation.Configuration;
  5. import org.springframework.security.authentication.AuthenticationServiceException;
  6. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  7. import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
  8. import org.springframework.security.core.AuthenticationException;
  9. import org.springframework.security.core.userdetails.UserDetails;
  10. import org.springframework.stereotype.Service;
  11. import org.springframework.web.context.request.RequestContextHolder;
  12. import org.springframework.web.context.request.ServletRequestAttributes;
  14. import javax.servlet.http.HttpServletRequest;
  16. public class MyAuthenticationProvider extends DaoAuthenticationProvider {
  18.     @Override
  19.     protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
  20.        //校验密码前先校验验证码
  21.         HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();
  22.         String code = request.getParameter("code");
  23.         String vf = (String)request.getSession().getAttribute("vf");
  24.         if (code == null || vf == null || !code.equals(vf)) {
  25.             throw new AuthenticationServiceException("验证码错误");
  26.         }
  27.         //校验密码
  28.         super.additionalAuthenticationChecks(userDetails, authentication);
  29.     }
  30. }

10.security配置

  1. package com.yl.securitydemo.config;
  3. import com.yl.securitydemo.service.UserService;
  4. import org.springframework.beans.factory.annotation.Autowired;
  5. import org.springframework.context.annotation.Bean;
  6. import org.springframework.context.annotation.Configuration;
  7. import org.springframework.security.authentication.AuthenticationManager;
  8. import org.springframework.security.authentication.ProviderManager;
  9. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  10. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  11. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  12. import org.springframework.security.core.Authentication;
  13. import org.springframework.security.core.AuthenticationException;
  14. import org.springframework.security.core.userdetails.UserDetailsService;
  15. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  16. import org.springframework.security.crypto.password.NoOpPasswordEncoder;
  17. import org.springframework.security.crypto.password.PasswordEncoder;
  18. import org.springframework.security.web.authentication.AuthenticationFailureHandler;
  19. import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
  21. import javax.servlet.ServletException;
  22. import javax.servlet.http.HttpServletRequest;
  23. import javax.servlet.http.HttpServletResponse;
  24. import java.io.IOException;
  26. @Configuration
  27. public class SecurityConfig extends WebSecurityConfigurerAdapter {
  28.     @Autowired
  29.     UserService userService;
  30.     @Bean
  31.     PasswordEncoder passwordEncoder() {
  32.         return new BCryptPasswordEncoder();
  33.     }
  35.     @Bean
  36.     MyAuthenticationProvider myAuthenticationProvider() {
  37.         MyAuthenticationProvider provider = new MyAuthenticationProvider();
  38.         provider.setPasswordEncoder(passwordEncoder());
  39.         provider.setUserDetailsService(userService);
  40.         return provider;
  41.     }
  43.     @Override
  44.     @Bean
  45.     protected AuthenticationManager authenticationManager() throws Exception {
  46.         return new ProviderManager(myAuthenticationProvider());
  47.     }
  49.     @Override
  50.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  51.         auth.userDetailsService(userService);
  52.     }
  54.     @Override
  55.     protected void configure(HttpSecurity http) throws Exception {
  56.         http.authorizeRequests()
  57.                 .antMatchers("/getVerifyCode")
  58.                 .permitAll()
  59.                 .anyRequest()
  60.                 .authenticated()
  61.                 .and()
  62.                 .formLogin()
  63.                 .successHandler(new AuthenticationSuccessHandler() {
  64.                     @Override
  65.                     public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
  66.                         response.setContentType("text/html;charset=utf-8");
  67.                         response.getWriter().write("login success");
  68.                     }
  69.                 })
  70.                 .failureHandler(new AuthenticationFailureHandler() {
  71.                     @Override
  72.                     public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
  73.                         response.setContentType("text/html;charset=utf-8");
  74.                         response.getWriter().write("login fail");
  75.                     }
  76.                 })
  77.                 .permitAll()
  78.                 .and()
  79.                 .csrf().disable();
  80.     }
  81. }

11.测试

1.不携带验证码，登陆失败

2.携带错误验证码，登录失败

3.携带正确的验证码，登录成功

版权说明 : 本文为转载文章, 版权归原作者所有 版权申明

原文链接 : https://blog.csdn.net/weixin_41359273/article/details/123692948

内容来源于网络，如有侵权，请联系作者删除！

spring

相关文章

    查看更多

    热门标签

    更多
    JavaquerypythonNode开发语言requestUtil数据库Table后端算法LoggerMessageElementParser

    最新文章

    更多
    • 蜀ICP备13028337号-1 大数据知识库 https://www.saoniuhuo.com © All rights reserved
    • 本站内容来源互联网,如果侵犯您的权益请联系我们删除, 联系方式：448109455@qq.com