前后端分离状态下,后端SpringSecurity该如何变动呢? 如何变动取决于前后端分离状态下,前后端交互的特点,纯json交互,闲言少叙,上干货
主配置类#
@Configuration @EnableWebSecurity @EnableGlobalMethodSecurity(prePostEnabled = true)// 开启基于方法级别的防护 public class SecurityConfig extends WebSecurityConfigurerAdapter { private Logger logger = LoggerFactory.getLogger(getClass()); @Autowired SecurityService securityService; @Autowired MyAuthenticationFailHandler myAuthenticationFailHandler; @Autowired MyAuthenticationSuccessHandler myAuthenticationSuccessHandler; @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(securityService) .passwordEncoder(new BCryptPasswordEncoder()); } @Bean public AuthenticationEntryPoint macLoginUrlAuthenticationEntryPoint() { return new MacLoginUrlAuthenticationEntryPoint(); } // 安全配置项 @Override protected void configure(HttpSecurity http) throws Exception { http.formLogin() .loginPage("/login123") .loginProcessingUrl("/user/login")// from表单中的action往这里提交 .usernameParameter("username").passwordParameter("password").permitAll() .loginProcessingUrl("/login") .successHandler(myAuthenticationSuccessHandler).failureHandler(myAuthenticationFailHandler) .and() .exceptionHandling().authenticationEntryPoint( macLoginUrlAuthenticationEntryPoint()) .and() .authorizeRequests()// 禁用了 springSecurity ， 允许一切请求 .antMatchers("/api/user/text1","/api/user/text2").hasRole("ADMIN") .antMatchers("/api/user/text3").hasRole("USRE") .anyRequest().permitAll() // .and().csrf().disable();// todo } }
配置登录成功处理器,响应给前端json#
在前后端没有分离时,用户完成了登录认证后,由后端的框架控制页面的跳转,但是前后端分离时,前后路由的跳转后端不能干涉, 只能给前端用户的信息等信息,由前端控制页面的跳转
@Component("MyAuthenticationSuccessHandler") public class MyAuthenticationSuccessHandler implements AuthenticationSuccessHandler { @Autowired ObjectMapper mapper; @Override public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException { System.err.println("登录成功 --- 返回json...."); // 允许跨域 httpServletResponse.setHeader("Access-Control-Allow-Origin", "*"); // 允许自定义请求头token(允许head跨域) httpServletResponse.setHeader("Access-Control-Allow-Headers", "token, Accept, Origin, X-Requested-With, Content-Type, Last-Modified"); httpServletResponse.setContentType("application/json;charset=UTF-8"); httpServletResponse.setStatus(200); // 成功返回200 Result result = new Result(200, "登录成功", true, authentication.getPrincipal()); // 登录成功 httpServletResponse.getWriter().write(mapper.writeValueAsString(result)); }
配置登录失败处理器,响应给前端json#
登录失败,返回给前端失败信息,及状态码
@Component("MyAuthenticationFailHandler") public class MyAuthenticationFailHandler implements AuthenticationFailureHandler { @Autowired ObjectMapper mapper; @Override public void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse response, AuthenticationException e) throws IOException, ServletException { System.err.println("登录失败 -- 返回json...."); // 允许跨域 response.setHeader("Access-Control-Allow-Origin", "*"); // 允许自定义请求头token(允许head跨域) response.setHeader("Access-Control-Allow-Headers", "token, Accept, Origin, X-Requested-With, Content-Type, Last-Modified"); response.setStatus(201); response.setContentType("application/json;charset=UTF-8"); if (e instanceof BadCredentialsException || e instanceof UsernameNotFoundException) { response.getWriter().write(mapper.writeValueAsString("用户名或密码错误")); // 只返回异常消息 } else if (e instanceof LockedException) { response.getWriter().write(mapper.writeValueAsString("账户被锁定，请联系管理员!")); // 只返回异常消息 } else if (e instanceof CredentialsExpiredException) { response.getWriter().write(mapper.writeValueAsString("账户被锁定，请联系管理员!")); // 只返回异常消息 } else if (e instanceof AccountExpiredException) { response.getWriter().write(mapper.writeValueAsString("账户过期，请联系管理员!")); // 只返回异常消息 } else if (e instanceof DisabledException) { response.getWriter().write(mapper.writeValueAsString("账户被禁用，请联系管理员!")); // 只返回异常消息 } else { response.getWriter().write(mapper.writeValueAsString("登录失败!")); // 只返回异常消息 } } }
当用户没有任何权限时,相应给前端json#
默认情况下,当用户没有权限时,springsecurity 会将默认的无权限的页面返回给前端,这个页面巨丑,还会覆盖原来的网页,加入这个配置类实现返回由前端友情json提示
public class MacLoginUrlAuthenticationEntryPoint implements AuthenticationEntryPoint { @Autowired ObjectMapper mapper; @Override public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException { // 允许跨域 response.setHeader("Access-Control-Allow-Origin", "*"); // 允许自定义请求头token(允许head跨域) response.setHeader("Access-Control-Allow-Headers", "token, Accept, Origin, X-Requested-With, Content-Type, Last-Modified"); response.setStatus(202); response.setContentType("application/json;charset=UTF-8"); response.getWriter().write(mapper.writeValueAsString("用户相应的无权限,请联系管理员")); // 只返回异常消息 }
