Spring Security系列教程13--基于过滤器实现图形验证码

@ConfigurationpublicclassCaptchaConfig {
@BeanpublicProducercaptcha() {
// 配置图形验证码的基本参数Propertiesproperties=newProperties();
// 图片宽度properties.setProperty("kaptcha.image.width", "150");
// 图片长度properties.setProperty("kaptcha.image.height", "50");
// 字符集properties.setProperty("kaptcha.textproducer.char.string", "0123456789");
// 字符长度properties.setProperty("kaptcha.textproducer.char.length", "4");
Configconfig=newConfig(properties);
// 使用默认的图形验证码实现，当然也可以自定义实现DefaultKaptchadefaultKaptcha=newDefaultKaptcha();
defaultKaptcha.setConfig(config);
returndefaultKaptcha;
    }
}

@ControllerpublicclassCaptchaController {
@AutowiredprivateProducercaptchaProducer;
@GetMapping("/captcha.jpg")
publicvoidgetCaptcha(HttpServletRequestrequest, HttpServletResponseresponse) throwsIOException {
// 设置内容类型response.setContentType("image/jpeg");
// 创建验证码文本StringcapText=captchaProducer.createText();
// 将验证码文本设置到sessionrequest.getSession().setAttribute("captcha", capText);
// 创建验证码图片BufferedImagebi=captchaProducer.createImage(capText);
// 获取响应输出流ServletOutputStreamout=response.getOutputStream();
// 将图片验证码数据写到响应输出流ImageIO.write(bi, "jpg", out);
// 推送并关闭响应输出流try {
out.flush();
        } finally {
out.close();
        }
    }
}

publicclassVerificationCodeExceptionextendsAuthenticationException {
publicVerificationCodeException () {
super("图形验证码校验失败");
    }
}

/*** 基于过滤器实现图形验证码的验证功能,这属于Servlet层面,简单易理解.*/publicclassVerificationCodeFilterextendsOncePerRequestFilter {
privateAuthenticationFailureHandlerauthenticationFailureHandler=newSecurityAuthenticationFailureHandler();
@OverrideprotectedvoiddoFilterInternal(HttpServletRequesthttpServletRequest, HttpServletResponsehttpServletResponse, FilterChainfilterChain) throwsServletException, IOException {
// 非登录请求不校验验证码，直接放行if (!"/login".equals(httpServletRequest.getRequestURI())) {
filterChain.doFilter(httpServletRequest, httpServletResponse);
        } else {
try {
//校验验证码verificationCode(httpServletRequest);
//验证码校验通过后，对请求进行放行filterChain.doFilter(httpServletRequest, httpServletResponse);
            } catch (VerificationCodeExceptione) {
authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);
            }
        }
    }
publicvoidverificationCode (HttpServletRequesthttpServletRequest) throwsVerificationCodeException {
HttpSessionsession=httpServletRequest.getSession();
StringsavedCode= (String) session.getAttribute("captcha");
if (!StringUtils.isEmpty(savedCode)) {
// 随手清除验证码，不管是失败还是成功，所以客户端应在登录失败时刷新验证码session.removeAttribute("captcha");
        }
StringrequestCode=httpServletRequest.getParameter("captcha");
// 校验不通过抛出异常if (StringUtils.isEmpty(requestCode) ||StringUtils.isEmpty(savedCode) ||!requestCode.equals(savedCode)) {
thrownewVerificationCodeException();
        }
    }
}

/*** @Author: 一一哥* 增加图形验证码功能.*/@EnableWebSecurity(debug=true)
publicclassSecurityConfigextendsWebSecurityConfigurerAdapter {
@Overrideprotectedvoidconfigure(HttpSecurityhttp) throwsException {
http.authorizeRequests()
                .antMatchers("/admin/api/**")
                .hasRole("ADMIN")
                .antMatchers("/user/api/**")
                .hasRole("USER")
                .antMatchers("/app/api/**", "/captcha.jpg")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .formLogin()
                .failureHandler(newSecurityAuthenticationFailureHandler())
                .successHandler(newSecurityAuthenticationSuccessHandler())
                .loginPage("/myLogin.html")
                .loginProcessingUrl("/login")
                .permitAll()
                .and()
                .csrf()
                .disable();
//将过滤器添加在UsernamePasswordAuthenticationFilter之前http.addFilterBefore(newVerificationCodeFilter(), UsernamePasswordAuthenticationFilter.class);
    }
@BeanpublicPasswordEncoderpasswordEncoder() {
returnNoOpPasswordEncoder.getInstance();
    }
}