当前位置：首页>后端>正文

spring项目私钥存储 springsecurity存储用户信息

后端2024-04-23 23:30:39

一.前言

1.介绍

上文主要介绍了后端使用Spring Security对API进行保护
本文主要介绍Spring Security使用数据库存储角色和权限，并在此情况下进行登录操作，同时介绍了记住我操作

2.项目例子

此文章用到的例子在spring-boot项目中，传送门
此篇文章用到项目模块：spring-boot-security-login
还有更多：spring-cloud项目

3.概述

使用数据库存储用户，角色和权限，代码中使用jpa进行数据库访问
自定义UserDetailsService用于登陆时获取用户信息
添加rememberMe记住我的功能
sql文件在项目模块中login.sql
基于上篇后端使用Spring Security对API进行保护添加登陆的新功能

二.Spring Security用户，角色和权限

1. 数据库表设计

用户，角色，权限，之间多对多关系
用户实体类，包含角色

@Entity
@Table(name = "user_account")
public class User {

    @Id
    @Column(unique = true, nullable = false)
    @GeneratedValue(strategy = GenerationType.AUTO)
    private Long id;

    private String firstName;

    private String lastName;

    private String email;

    @Column(length = 60)
    private String password;

    private boolean enabled;
    private boolean isUsing2FA;

    private String secret;

    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(name = "users_roles", joinColumns = @JoinColumn(name = "user_id", referencedColumnName = "id"), inverseJoinColumns = @JoinColumn(name = "role_id", referencedColumnName = "id"))
    private Collection<Role> roles;

角色实体类，包含权限

@Entity
public class Role {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private Long id;

    @ManyToMany(mappedBy = "roles")
    private Collection<User> users;

    @ManyToMany
    @JoinTable(name = "roles_privileges", joinColumns = @JoinColumn(name = "role_id", referencedColumnName = "id"), inverseJoinColumns = @JoinColumn(name = "privilege_id", referencedColumnName = "id"))
    private Collection<Privilege> privileges;

    private String name;

权限实体类

@Entity
public class Privilege {
    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private Long id;

    private String name;

    @ManyToMany(mappedBy = "privileges")
    private Collection<Role> roles;

2. 自定义获取登陆时用户数据

实现UserDetailsService接口
重写loadUserByUsername方法，返回User给security进行验证
使用userRepository从数据库中获取用户以及权限
User构造方法，依次是账号，密码，账号是否过期，证书是否过期，是否锁定账号，权限集合

@Service("userDetailsService")
@Transactional
public class MyUserDetailsService implements UserDetailsService {

    @Autowired
    private UserRepository userRepository;

    public MyUserDetailsService() {
        super();
    }

    // API
    @Override
    public UserDetails loadUserByUsername(final String email) throws UsernameNotFoundException {
        try {
            final User user = userRepository.findByEmail(email);
            if (user == null) {
                throw new UsernameNotFoundException("No user found with username: " + email);
            }

            return new org.springframework.security.core.userdetails.User(user.getEmail(), user.getPassword(), user.isEnabled(), true, true, true, getAuthorities(user.getRoles()));
        } catch (final Exception e) {
            throw new RuntimeException(e);
        }
    }

    // UTIL
    private final Collection<? extends GrantedAuthority> getAuthorities(final Collection<Role> roles) {
        return getGrantedAuthorities(getPrivileges(roles));
    }

    private final List<String> getPrivileges(final Collection<Role> roles) {
        final List<String> privileges = new ArrayList<>();
        final List<Privilege> collection = new ArrayList<>();
        for (final Role role : roles) {
            collection.addAll(role.getPrivileges());
        }
        for (final Privilege item : collection) {
            privileges.add(item.getName());
        }

        return privileges;
    }

    private final List<GrantedAuthority> getGrantedAuthorities(final List<String> privileges) {
        final List<GrantedAuthority> authorities = new ArrayList<>();
        for (final String privilege : privileges) {
            authorities.add(new SimpleGrantedAuthority(privilege));
        }
        return authorities;
    }

}

3. 将自定义用户源放入到spring security配置中

将MyUserDetailsService 放入到spring security配置中

@Autowired
    private MyUserDetailsService userDetailsService;
    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService);
    }

4. 使用PreAuthorize标识访问接口需要使用的权限

开启PreAuthorize支持，将prePostEnabled设置为true

@EnableGlobalMethodSecurity(prePostEnabled = true)
@Configuration
public class SecurityJavaConfig extends WebSecurityConfigurerAdapter {

controller中DeleteMapping需要DELETE_USER权限，而GetMapping需要GET_USER权限

@RestController
	@RequestMapping("/api/user")
	public class BusinessController {
	
	    @DeleteMapping("/{id}")
	    @PreAuthorize("hasAuthority('DELETE_USER')")
	    public String deleteUser(@PathVariable Long id){
	        return "delete user success by user id :"+id;
	    }
	
	    @GetMapping("/{id}")
	    @PreAuthorize("hasAuthority('GET_USER')")
	    public User getUser(@PathVariable Long id){
	        User user = new User();
	        user.setId(id);
	        return user;
	    }
	}

5. 验证

没有登录，访问接口，返回401 Unauthorized

@Test
public void notLogin() {
        ResponseEntity<String> entity = this.restTemplate.exchange("http://localhost:8081/api/user/1", HttpMethod.DELETE,
                new HttpEntity<Void>(loginHeaders), String.class);
        assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
    }

账号test2@test.com账号没有调用删除用户接口，返回403 Forbidden

@Test
public void noHasDeleteUserAuthority() {
    MultiValueMap<String, String> form = new LinkedMultiValueMap<>();
    form.set("username", "test2@test.com");
    form.set("password", "123456");
    login(form);
    ResponseEntity<String> entity = this.restTemplate.exchange("http://localhost:8081/api/user/1", HttpMethod.DELETE,
            new HttpEntity<Void>(loginHeaders), String.class);
    assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
}

三.记住我

1. 在spring security中设置记住我

在configure(HttpSecurity http)中添加rememberMe
添加过期时间为24小时

.and().rememberMe().tokenValiditySeconds(60*60*24);

2. 将servlet session有效活动时间修改为1分钟

默认servlet session有效活动时间为30分钟
在application.yml中设置

server:
  port: 8081
  tomcat:
    uri-encoding: UTF-8
  servlet:
    session:
      timeout: 1m

3. 介绍

当登陆的时候，使用remember-me：true，此时返回值会生成remember-me的cookie值，存储了账号的md5加密和过期时间，如下

remember-me=dGVzdCU0MHRlc3QuY29tOjE1NjY4MzE1NjQzNjQ6YjNiODE4YzhhZTgwMDMwNzY4NDE2YTE1ZDU5YmZmOTg; Max-Age=30000; Expires=Mon, 26-Aug-2019 14:59:24 GMT; Path=/; HttpOnly

同时登陆，返回登陆cookie凭证如下

JSESSIONID=1DD1D2BDFDA29944732B394F26F73D7E; Path=/; HttpOnly

因为我们设置了session的过期时间为1分钟后，在登陆一分钟后JSESSIONID访问业务接口会失败
而使用remember-me的cookie还可以访问业务接口

4. 验证

我们将返回header中的cookie存储到文件中
当一分钟后使用JSESSIONID访问业务接口失败
使用remember-me的cookie访问业务接口成功

@Test
   public void deleteOneMinuteLaterByJsessionId() throws InterruptedException, IOException {
       HttpHeaders loginHeaders = getHttpHeaders(1);
       //sleep one minute until session expired
       Thread.sleep(60000L);
       ResponseEntity<String> entity = this.restTemplate.exchange("http://localhost:8081/api/user/1", HttpMethod.DELETE,
               new HttpEntity<Void>(loginHeaders), String.class);
       assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
   }

   @Test
   public void deleteByRememberMeCookie() throws IOException {
       HttpHeaders loginHeaders = getHttpHeaders(0);
       ResponseEntity<String> entity = this.restTemplate.exchange("http://localhost:8081/api/user/1", HttpMethod.DELETE,
               new HttpEntity<Void>(loginHeaders), String.class);
       assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
   }

四.总结

本文主要介绍Spring Security使用数据库存储角色和权限，并在此情况下进行登录操作，同时介绍了记住我操作

上一篇：Spring Security 对Rest风格API的保护

查看全文

https://www.xamrdz.com/backend/37c1931585.html

一.前言

1.介绍

2.项目例子

3.概述

二.Spring Security用户，角色和权限

1. 数据库表设计

2. 自定义获取登陆时用户数据

3. 将自定义用户源放入到spring security配置中

4. 使用PreAuthorize标识访问接口需要使用的权限

5. 验证

三.记住我

1. 在spring security中设置记住我

2. 将servlet session有效活动时间修改为1分钟

3. 介绍

4. 验证

四.总结

相关文章：