Spring Security系列教程15--基于散列加密方案实现自动登录

@EnableWebSecurity(debug=true)
publicclassSecurityConfigextendsWebSecurityConfigurerAdapter {
@Value("${spring.security.remember-me.key}")
privateStringrememberKey;
@AutowiredprivateUserDetailsServiceuserDetailsService;
@Overrideprotectedvoidconfigure(HttpSecurityhttp) throwsException {
//利用JdbcTokenRepositoryImpl关联数据源JdbcTokenRepositoryImpltokenRepository=newJdbcTokenRepositoryImpl();
tokenRepository.setDataSource(dataSource);
http.authorizeRequests()
                .antMatchers("/admin/**")
                .hasRole("ADMIN")
                .antMatchers("/user/**")
                .hasRole("USER")
                .antMatchers("/app/**")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .formLogin()
                .permitAll()
                .and()
//开启“记住我”功能                .rememberMe()
                .userDetailsService(userDetailsService)
//配置散列加密用的key                .key(rememberKey)
                .and()
                .csrf()
                .disable();
    }
@BeanpublicPasswordEncoderpasswordEncoder() {
//不对登录密码进行加密returnNoOpPasswordEncoder.getInstance();
    }
}

@RestController@RequestMapping("/user")
publicclassUserController {
@GetMapping("hello")
publicStringhello() {
return"hello, user";
    }
}

//对各字段进行散列加密hashInfo=md5Hex(username+":"+expirationTime+":"password+":"+key)
//利用base64进行解码rememberCookie=base64(username+":"+expirationrime+":"+hashInfo)

@OverridepublicvoidonLoginSuccess(HttpServletRequestrequest, HttpServletResponseresponse,
AuthenticationsuccessfulAuthentication) {
//从认证对象中获取用户名Stringusername=retrieveUserName(successfulAuthentication);
//从认证对象中获取密码Stringpassword=retrievePassword(successfulAuthentication);
    ......
if (!StringUtils.hasLength(password)) {
//根据用户名查询出对应的用户UserDetailsuser=getUserDetailsService().loadUserByUsername(username);
//获取到用户身上的密码password=user.getPassword();
    }
//获取登录过期时间，默认是2周inttokenLifetime=calculateLoginLifetime(request, successfulAuthentication);
longexpiryTime=System.currentTimeMillis();
expiryTime+=1000L* (tokenLifetime<0?TWO_WEEKS_S : tokenLifetime);
//生成remember-me签名信息StringsignatureValue=makeTokenSignature(expiryTime, username, password);
//保存cookiesetCookie(newString[] { username, Long.toString(expiryTime), signatureValue },
tokenLifetime, request, response);
}
protectedStringmakeTokenSignature(longtokenExpiryTime, Stringusername,
Stringpassword) {
Stringdata=username+":"+tokenExpiryTime+":"+password+":"+getKey();
MessageDigestdigest;
digest=MessageDigest.getInstance("MD5");
returnnewString(Hex.encode(digest.digest(data.getBytes())));
}

publicvoiddoFilter(ServletRequestreq, ServletResponseres, FilterChainchain)
throwsIOException, ServletException {
HttpServletRequestrequest= (HttpServletRequest) req;
HttpServletResponseresponse= (HttpServletResponse) res;
if (SecurityContextHolder.getContext().getAuthentication() ==null) {
//处理自动登录的业务逻辑AuthenticationrememberMeAuth=rememberMeServices.autoLogin(request,
response);
if (rememberMeAuth!=null) {
// Attempt authenticaton via AuthenticationManagertry {
rememberMeAuth=authenticationManager.authenticate(rememberMeAuth);
// Store to SecurityContextHolderSecurityContextHolder.getContext().setAuthentication(rememberMeAuth);
onSuccessfulAuthentication(request, response, rememberMeAuth);
if (logger.isDebugEnabled()) {
logger.debug("SecurityContextHolder populated with remember-me token: '"+SecurityContextHolder.getContext().getAuthentication()
+"'");
     }
// Fire eventif (this.eventPublisher!=null) {
eventPublisher        .publishEvent(newInteractiveAuthenticationSuccessEvent(
SecurityContextHolder.getContext()
            .getAuthentication(), this.getClass()));
     }
if (successHandler!=null) {
successHandler.onAuthenticationSuccess(request, response,
rememberMeAuth);
return;
     }
    }
catch (AuthenticationExceptionauthenticationException) {
if (logger.isDebugEnabled()) {
logger.debug(
"SecurityContextHolder not populated with remember-me token, as "+"AuthenticationManager rejected Authentication returned by RememberMeServices: '"+rememberMeAuth+"'; invalidating remember-me token",
authenticationException);
     }
rememberMeServices.loginFail(request, response);
onUnsuccessfulAuthentication(request, response,
authenticationException);
    }
   }
chain.doFilter(request, response);
    }
else {
if (logger.isDebugEnabled()) {
logger.debug("SecurityContextHolder not populated with remember-me token, as it already contained: '"+SecurityContextHolder.getContext().getAuthentication() +"'");
   }
chain.doFilter(request, response);
    }
 }

@OverridepublicfinalAuthenticationautoLogin(HttpServletRequestrequest,
HttpServletResponseresponse) {
StringrememberMeCookie=extractRememberMeCookie(request);
if (rememberMeCookie==null) {
returnnull;
    }
logger.debug("Remember-me cookie detected");
if (rememberMeCookie.length() ==0) {
logger.debug("Cookie was empty");
cancelCookie(request, response);
returnnull;
    }
UserDetailsuser=null;
try {
String[] cookieTokens=decodeCookie(rememberMeCookie);
user=processAutoLoginCookie(cookieTokens, request, response);
userDetailsChecker.check(user);
logger.debug("Remember-me cookie accepted");
returncreateSuccessfulAuthentication(request, user);
    }
    ......
cancelCookie(request, response);
returnnull;
 }