Spring Security系列教程14--基于自定义的认证提供器实现图形验证码

@ConfigurationpublicclassCaptchaConfig {
@BeanpublicProducercaptcha() {
// 配置图形验证码的基本参数Propertiesproperties=newProperties();
// 图片宽度properties.setProperty("kaptcha.image.width", "150");
// 图片长度properties.setProperty("kaptcha.image.height", "50");
// 字符集properties.setProperty("kaptcha.textproducer.char.string", "0123456789");
// 字符长度properties.setProperty("kaptcha.textproducer.char.length", "4");
Configconfig=newConfig(properties);
// 使用默认的图形验证码实现，当然也可以自定义实现DefaultKaptchadefaultKaptcha=newDefaultKaptcha();
defaultKaptcha.setConfig(config);
returndefaultKaptcha;
    }
}

@ControllerpublicclassCaptchaController {
@AutowiredprivateProducercaptchaProducer;
@GetMapping("/captcha.jpg")
publicvoidgetCaptcha(HttpServletRequestrequest, HttpServletResponseresponse) throwsIOException {
// 设置内容类型response.setContentType("image/jpeg");
// 创建验证码文本StringcapText=captchaProducer.createText();
// 将验证码文本设置到sessionrequest.getSession().setAttribute("captcha", capText);
// 创建验证码图片BufferedImagebi=captchaProducer.createImage(capText);
// 获取响应输出流ServletOutputStreamout=response.getOutputStream();
// 将图片验证码数据写到响应输出流ImageIO.write(bi, "jpg", out);
// 推送并关闭响应输出流try {
out.flush();
        } finally {
out.close();
        }
    }
}

publicclassVerificationCodeExceptionextendsAuthenticationException {
publicVerificationCodeException() {
super("图形验证码校验失败");
    }
}

/*** 添加额外的用户认证信息*/publicclassMyWebAuthenticationDetailsextendsWebAuthenticationDetails {
privateStringimageCode;
privateStringsavedImageCode;
publicStringgetImageCode() {
returnimageCode;
    }
publicStringgetSavedImageCode() {
returnsavedImageCode;
    }
/*** 补充用户提交的验证码和session保存的验证码*/publicMyWebAuthenticationDetails(HttpServletRequestrequest) {
super(request);
this.imageCode=request.getParameter("captcha");
//获取session对象HttpSessionsession=request.getSession();
this.savedImageCode= (String) session.getAttribute("captcha");
if (!StringUtils.isEmpty(this.savedImageCode)) {
// 随手清除验证码，不管是失败还是成功，所以客户端应在登录失败时刷新验证码session.removeAttribute("captcha");
        }
    }
}

@ComponentpublicclassMyWebAuthenticationDetailsSourceimplementsAuthenticationDetailsSource<HttpServletRequest,WebAuthenticationDetails> {
/*** 创建一个WebAuthenticationDetails对象*/@OverridepublicWebAuthenticationDetailsbuildDetails(HttpServletRequestrequest) {
returnnewMyWebAuthenticationDetails(request);
    }
}

/*** 在常规的数据库认证之上,添加图形验证码功能*/@ComponentpublicclassMyAuthenticationProviderextendsDaoAuthenticationProvider {
/*** 构造方法注入UserDetailService和PasswordEncoder*/publicMyAuthenticationProvider(UserDetailsServiceuserDetailsService, PasswordEncoderpasswordEncoder) {
this.setUserDetailsService(userDetailsService);
this.setPasswordEncoder(passwordEncoder);
    }
/*** 在常规的认证之上,添加额外的图形验证码功能*/@OverrideprotectedvoidadditionalAuthenticationChecks(UserDetailsuserDetails, UsernamePasswordAuthenticationTokenusernamePasswordAuthenticationToken) throwsAuthenticationException {
//获取token令牌中关联的details对象，并将其转换为我们自定义的MyWebAuthenticationDetailsMyWebAuthenticationDetailsdetails= (MyWebAuthenticationDetails) usernamePasswordAuthenticationToken.getDetails();
StringimageCode=details.getImageCode();
StringsavedImageCode=details.getSavedImageCode();
// 检验图形验证码if (StringUtils.isEmpty(imageCode) ||StringUtils.isEmpty(savedImageCode) ||!imageCode.equals(savedImageCode)) {
thrownewVerificationCodeException();
        }
//在正常的认证检查之前，添加额外的关于图形验证码的校验super.additionalAuthenticationChecks(userDetails, usernamePasswordAuthenticationToken);
    }
}

@SuppressWarnings("all")
@EnableWebSecurity(debug=true)
publicclassSecurityConfigextendsWebSecurityConfigurerAdapter {
@AutowiredprivateAuthenticationDetailsSource<HttpServletRequest, WebAuthenticationDetails>myWebAuthenticationDetailsSource;
@AutowiredprivateAuthenticationProviderauthenticationProvider;
@Overrideprotectedvoidconfigure(HttpSecurityhttp) throwsException {
http.authorizeRequests()
                .antMatchers("/admin/api/**")
                .hasRole("ADMIN")
                .antMatchers("/user/api/**")
                .hasRole("USER")
                .antMatchers("/app/api/**", "/captcha.jpg")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .formLogin()
//这里关联配置自定义的AuthenticationDetailsSource                .authenticationDetailsSource(myWebAuthenticationDetailsSource)
                .failureHandler(newSecurityAuthenticationFailureHandler())
                .successHandler(newSecurityAuthenticationSuccessHandler())
                .loginPage("/myLogin.html")
                .loginProcessingUrl("/login")
                .permitAll()
                .and()
                .csrf()
                .disable();
    }
//在这里关联我们自定义的AuthenticationProvider@Overrideprotectedvoidconfigure(AuthenticationManagerBuilderauth) throwsException {
auth.authenticationProvider(authenticationProvider);
    }
@BeanpublicPasswordEncoderpasswordEncoder() {
returnNoOpPasswordEncoder.getInstance();
    }
}