源码下载
摘要
前面做的用户名和密码登陆是SpringSecurity框架内部集成好的功能，但是手机短信验证码登陆SpringSecurity框架并没有内部实现这个功能，所以需要使用者自己去实现手机短信验证码的功能，最后在把自己的实现嫁接到SpringSecurity框架上。
一、手机短信验证码实现原理
通过前面对SpringSecurity的用户名密码登陆源码的分析，主要流程就是：
- 1、通过过滤器（UsernamePasswordAuthenticationFilter）来拦截指定的url接口
- 2、通过用户名和密码来生成一个用于认证的Token（UsernamePasswordAuthenticationToken）
- 3、然后通过AuthenticationManager管理器（ProviderManager）来找到一个合适的处理器（DaoAuthenticationProvider）处理UsernamePasswordAuthenticationToken
- 4、通过UserDetailsService接口中loadUserByUsername方法把用户信息传给SpringSecurity框架，然后与UsernamePasswordAuthenticationToken中的用户名和密码进行比对校验，如果校验成功，那就认证通过
- 5、认证通过后把带有权限的UserDetails存储到session
-
6、加入自定义图形验证码时，需要在UsernamePasswordAuthenticationFilter过滤器之前再加上一个验证码过滤器，图片验证码验证通过后才可以继续执行后面的步骤
用户名密码登陆流程.png
通过上面对用户名密码登陆的分析，可以推出手机验证码登陆流程如下
- 1、自定义手机短信验证过滤器（RavenMobileCodeValidateFilter）
- 2、拦截指定url的过滤器（RavenMobileCodeAuthenticationFilter）
- 3、封装手机号为Token（RavenMobileCodeAuthenticationToken）
- 4、用户处理Token的Provider（RavenMobileCodeAuthenticationProvider）
- 5、通过UserDetailsService加载用户信息
-
6、认证通过后把带有权限的UserDetails存储到session
手机短信验证登陆.png
二、编写代码
- RavenMobileCodeAuthenticationFilter 过滤器
/**
* 手机短信验证码过滤器
*/
public class RavenMobileCodeAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
public static final String SPRING_SECURITY_FORM_MOBILE_KEY = "mobile";
private String mobileParameter = SPRING_SECURITY_FORM_MOBILE_KEY;
private boolean postOnly = true;
/**
* 指定拦截的请求url 和 请求方法
*/
public RavenMobileCodeAuthenticationFilter() {
super(new AntPathRequestMatcher("/authentication/mobile", "POST"));
}
/**
* 认证逻辑
*/
public Authentication attemptAuthentication(HttpServletRequest request,
HttpServletResponse response) throws AuthenticationException {
if (postOnly && !request.getMethod().equals("POST")) {
throw new AuthenticationServiceException(
"Authentication method not supported: " + request.getMethod());
}
String mobile = obtainMobile(request);
if (mobile == null) {
mobile = "";
}
mobile = mobile.trim();
RavenMobileCodeAuthenticationToken authRequest = new RavenMobileCodeAuthenticationToken(mobile);
// Allow subclasses to set the "details" property
setDetails(request, authRequest);
return this.getAuthenticationManager().authenticate(authRequest);
}
// protected String obtainPassword(HttpServletRequest request) {
// return request.getParameter(passwordParameter);
// }
protected String obtainMobile(HttpServletRequest request) {
return request.getParameter(mobileParameter);
}
protected void setDetails(HttpServletRequest request,
RavenMobileCodeAuthenticationToken authRequest) {
authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
}
public void setMobileParameter(String mobileParameter) {
Assert.hasText(mobileParameter, "Username parameter must not be empty or null");
this.mobileParameter = mobileParameter;
}
public void setPasswordParameter(String passwordParameter) {
Assert.hasText(passwordParameter, "Password parameter must not be empty or null");
}
public void setPostOnly(boolean postOnly) {
this.postOnly = postOnly;
}
public final String getMobileParameter() {
return mobileParameter;
}
public final String getPasswordParameter() {
return null;
}
}
- RavenMobileCodeAuthenticationToken
public class RavenMobileCodeAuthenticationToken extends AbstractAuthenticationToken {
private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
/**
* 认证主题
* 认证前：principal存储的是手机号
* 认证后：principal存储的是认证信息
*/
private final Object principal;
/**
* 通过手机号来构造
*/
public RavenMobileCodeAuthenticationToken(String mobile) {
super(null);
this.principal = mobile;
setAuthenticated(false);
}
/**
* 认证成功后
* principal：认证信息
* 设置被已认证
*/
public RavenMobileCodeAuthenticationToken(Object principal, Collection<? extends GrantedAuthority> authorities) {
super(authorities);
this.principal = principal;
super.setAuthenticated(true); // must use super, as we override
}
public Object getCredentials() {
return null;
}
public Object getPrincipal() {
return this.principal;
}
public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
if (isAuthenticated) {
throw new IllegalArgumentException(
"Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
}
super.setAuthenticated(false);
}
@Override
public void eraseCredentials() {
super.eraseCredentials();
}
}
- RavenMobileCodeAuthenticationProvider
@Setter
@Getter
public class RavenMobileCodeAuthenticationProvider implements AuthenticationProvider {
private UserDetailsService userDetailsService;
@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
RavenMobileCodeAuthenticationToken mobileToken = (RavenMobileCodeAuthenticationToken) authentication;
// 通过手机号来验证
UserDetails userDetails = this.userDetailsService.loadUserByUsername((String) mobileToken.getPrincipal());
if (userDetails == null) {
throw new InternalAuthenticationServiceException("无法获取用户信息");
}
/**
* 到这里认证通过
* 通过重新创建RavenMobileCodeAuthenticationToken，使用2个参数的构造器
* 这样认证标识会被设置为true
*/
RavenMobileCodeAuthenticationToken mobileAuthenticationToken = new RavenMobileCodeAuthenticationToken(userDetails, userDetails.getAuthorities());
// 重新赋值
mobileAuthenticationToken.setDetails(mobileToken.getDetails());
return mobileAuthenticationToken;
}
/**
* AuthenticationManager 选择要执行的Provider
* 这里就决定了不同的 Provider 执行不同的 Token
* RavenMobileCodeAuthenticationToken
*/
@Override
public boolean supports(Class<?> authentication) {
return (RavenMobileCodeAuthenticationToken.class
.isAssignableFrom(authentication));
}
}
- 添加配置，把自定义的Provider和Filter添加到SpringSecurity的过滤器链上
@Component
public class RavenMobileCodeAuthenticationSecurityConfig extends SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity> {
@Autowired
private AuthenticationSuccessHandler successHandler;
@Autowired
private AuthenticationFailureHandler failureHandler;
@Autowired
private UserDetailsService userDetailsService;
@Override
public void configure(HttpSecurity http) throws Exception {
// 手机短信登录过滤器
RavenMobileCodeAuthenticationFilter mobileFilter = new RavenMobileCodeAuthenticationFilter();
mobileFilter.setAuthenticationManager(http.getSharedObject(AuthenticationManager.class));
mobileFilter.setAuthenticationSuccessHandler(this.successHandler);
mobileFilter.setAuthenticationFailureHandler(this.failureHandler);
//Provider
RavenMobileCodeAuthenticationProvider mobileProvider = new RavenMobileCodeAuthenticationProvider();
mobileProvider.setUserDetailsService(this.userDetailsService);
// 把自定义Provider 和 Filter 加入到SpringSecurity的过滤器链上
http.authenticationProvider(mobileProvider)
.addFilterAfter(mobileFilter, UsernamePasswordAuthenticationFilter.class);
}
}
三、手机短信登录验证
- bw-login.html
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>首页</title>
</head>
<body>
<h3>短信登录</h3>
<form action="/authentication/mobile" method="post">
<table>
<tr>
<td>手机号:</td>
<td><input type="text" name="mobile" value="18212345678"></td>
</tr>
<tr>
<td>短信验证码:</td>
<td>
<input type="text" name="smsCode">
<a href="/code/sms?mobile=18212345678">发送验证码</a>
</td>
</tr>
<tr>
<td colspan='2'><input name="remember-me" type="checkbox" value="true" />记住我</td>
</tr>
<tr>
<td colspan="2"><button type="submit">登录</button></td>
</tr>
</table>
</form>
</body>
</html>
- 处理验证码请求
@RestController
public class RavenValidateCodeController {
/**
* 操作session的工具类
*/
private SessionStrategy sessionStrategy = new HttpSessionSessionStrategy();
@Autowired
private IRavenValidateCodeGenerator imageValidateCodeGenerator;
@Autowired
private IRavenMobileValidateCodeGenerator mobileValidateCodeGenerator;
@Autowired
private IRavenMobileCodeSendService mobileCodeSendService;
@GetMapping("/code/image")
public void createCode(HttpServletRequest request, HttpServletResponse response) throws Exception {
// 生成图片
RavenImageCode imageCode = this.imageValidateCodeGenerator.generator(new ServletWebRequest(request, response));
// 保存
sessionStrategy.setAttribute(new ServletWebRequest(request, response), RavenSecurityConstants.SESSION_KEY_PREFIX, imageCode);
// 发送
ImageIO.write(imageCode.getImage(), "JPEG", response.getOutputStream());
}
@GetMapping("/code/sms")
public void createMobileCode(HttpServletRequest request, HttpServletResponse response) throws Exception {
// 获取手机号
String mobile = ServletRequestUtils.getStringParameter(request, "mobile");
// 生成验证码
RavenValidateCode validateCode = this.mobileValidateCodeGenerator.generator(new ServletWebRequest(request, response));
// 保存
sessionStrategy.setAttribute(new ServletWebRequest(request, response), RavenSecurityConstants.SESSION_KEY_PREFIX, validateCode);
// 发送
this.mobileCodeSendService.send(mobile, validateCode.getCode());
}
}
- 验证码RavenValidateCode
@Setter
@Getter
public class RavenValidateCode {
private String code;
private LocalDateTime expireTime;
public RavenValidateCode(String code, int expireIn) {
this.code = code;
this.expireTime = LocalDateTime.now().plusSeconds(expireIn);
}
public boolean isExpried() {
return LocalDateTime.now().isAfter(this.expireTime);
}
}
- 短信生成器IRavenMobileValidateCodeGenerator
public interface IRavenMobileValidateCodeGenerator {
/**
* 生成验证码
*/
RavenValidateCode generator(ServletWebRequest request);
}
- 默认手机验证码生成器
/**
* 默认的手机验证码生成器
*/
@Setter
public class DefaultRavenMobileValidateCodeGenerator implements IRavenMobileValidateCodeGenerator {
private RavenSecurityProperties securityProperties;
@Override
public RavenValidateCode generator(ServletWebRequest request) {
int expireIn = securityProperties.getValidate().getMobile().getExpireIn();
int count = securityProperties.getValidate().getMobile().getCount();
String code = RandomStringUtils.randomNumeric(count);
return new RavenValidateCode(code, expireIn);
}
}
- 发送验证码到手机 IRavenMobileCodeSendService
public interface IRavenMobileCodeSendService {
/**
* 给手机发送短信
* 默认实现使用服务器随机生成验证码
*/
void send(String mobile, String code);
}
- 默认发送验证码到手机实现 DefaultRavenMobileCodeSendServiceImpl
/**
* 由于 IRavenMobileCodeSendService 需要外接来实现发送短信验证码到手机
* 所以这里就不能直接入住的spring容器中，需要通过Bean的方式来配置注入
*/
public class DefaultRavenMobileCodeSendServiceImpl implements IRavenMobileCodeSendService {
private Logger logger = LoggerFactory.getLogger(getClass());
@Override
public void send(String mobile, String code) {
logger.info("发送验证码：" + code + " 到手机：" + mobile + " 请注意查收");
}
}
- 短信验证码生成器、发送短信验证码Bean配置。因为需要外接自己实现，所以就以配置Bean的方式来注入容器
@Configuration
public class RavenBeanConfig {
@Autowired
private RavenSecurityProperties securityProperties;
@Bean
PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
/**
* 图形验证码生成器
* 由于IRavenValidateCodeGenerator这个接口是为了让外界实现，所以不能在它默认的实现类
* DefaultRavenValidateCodeGenerator上直接使用@Component，防止会造成2个Bean，
* 所以需要使用@ConditionalOnMissingBean(name = "imageValidateCodeGenerator")
* 来判断Bean imageValidateCodeGenerator是否存在，如果存在就不会执行下面的Bean
*/
@Bean
@ConditionalOnMissingBean(name = "imageValidateCodeGenerator")
IRavenValidateCodeGenerator imageValidateCodeGenerator() {
DefaultRavenValidateCodeGenerator generator = new DefaultRavenValidateCodeGenerator();
generator.setSecurityProperties(this.securityProperties);
return generator;
}
/**
* 手机短信验证码生成器
*/
@Bean
@ConditionalOnMissingBean(name = "mobileValidateCodeGenerator")
IRavenMobileValidateCodeGenerator mobileValidateCodeGenerator() {
DefaultRavenMobileValidateCodeGenerator generator = new DefaultRavenMobileValidateCodeGenerator();
generator.setSecurityProperties(this.securityProperties);
return generator;
}
/**
* 发送手机短信
*/
@Bean
@ConditionalOnMissingBean(name = "mobileCodeSendService")
IRavenMobileCodeSendService mobileCodeSendService() {
DefaultRavenMobileCodeSendServiceImpl mobileCodeSendImpl = new DefaultRavenMobileCodeSendServiceImpl();
return mobileCodeSendImpl;
}
}
- 自己实现手机短信的生成
@Component("mobileValidateCodeGenerator")
public class DemoMobileCodeGenerator implements IRavenMobileValidateCodeGenerator {
@Override
public RavenValidateCode generator(ServletWebRequest request) {
return new RavenValidateCode("111", 100);
}
}
- 自己实现手机短信发送
@Component("mobileCodeSend")
public class DemoMobileCodeSend implements IRavenMobileCodeSendService {
private Logger logger = LoggerFactory.getLogger(getClass());
@Override
public void send(String mobile, String code) {
logger.info(mobile);
logger.info(code);
}
}
- 配置
/**
* Web端security配置
*/
@Configuration
public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private RavenSecurityProperties securityProperties;
@Autowired
private BrowserAuthenticationSuccessHandler browserAuthenticationSuccessHandler;
@Autowired
private BrowserAuthenticationFailureHandler browserAuthenticationFailureHandler;
@Autowired
private RavenValidateCodeFilter validateCodeFilter;
@Autowired
private RavenMobileCodeAuthenticationSecurityConfig mobileCodeConfig;
@Autowired
private HikariDataSource hikariDataSource;
@Autowired
private UserDetailsService userDetailsService;
@Bean
public PersistentTokenRepository persistentTokenRepository() {
JdbcTokenRepositoryImpl tokenRepository = new JdbcTokenRepositoryImpl();
tokenRepository.setDataSource(this.hikariDataSource);
// tokenRepository.setCreateTableOnStartup(true);
return tokenRepository;
}
@Override
protected void configure(HttpSecurity http) throws Exception {
// 配置登录界面
String loginPage = this.securityProperties.getBrowser().getLoginPage();
int tokenTime = this.securityProperties.getBrowser().getTokenTime();
RavenMobileValidateCodeFilter mobileFilter = new RavenMobileValidateCodeFilter();
mobileFilter.setFailureHandler(this.browserAuthenticationFailureHandler);
mobileFilter.setSecurityProperties(this.securityProperties);
mobileFilter.afterPropertiesSet();
http.csrf().disable()
.apply(this.mobileCodeConfig)
.and()
.addFilterBefore(this.validateCodeFilter, UsernamePasswordAuthenticationFilter.class)
.addFilterBefore(mobileFilter, UsernamePasswordAuthenticationFilter.class)
.formLogin()
.loginPage("/authentication/require") // 当需要身份认证时，跳转到这里
.loginProcessingUrl("/authentication/form") // 默认处理的/login，自定义登录界面需要指定请求路径
.successHandler(this.browserAuthenticationSuccessHandler)
.failureHandler(this.browserAuthenticationFailureHandler)
.and()
.rememberMe()
.tokenRepository(persistentTokenRepository())
.tokenValiditySeconds(tokenTime)
.userDetailsService(this.userDetailsService)
.and()
.authorizeRequests()
.antMatchers("/authentication/require",
loginPage,
"/code/*"
).permitAll()
.anyRequest()
.authenticated();
}
}
网友评论