Practical article: Security + JWT combination | attached source code

SecurityYou can view it as a groupfilterFilter chain consists of permission authentication. Its entire workflow is shown below:



In the figure, the green authentication mode can be configured, and the orange and blue positions cannot be changed:

• FilterSecurityInterceptor: The final filter that determines whether the current request is reachableController
• ExceptionTranslationFilter: Exception filter. When receiving an exception message, users will be guided to authenticate.

We use the Spring Boot framework for integration.

1. Dependencies introduced by POM files

<dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-web</artifactId> <exclusions> <exclusion> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-tomcat</artifactId> </exclusion>  </exclusions> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-undertow</artifactId> </dependency> <dependency> <groupId>mysql</groupId> <artifactId>mysql-connector-java</artifactId> </dependency> <dependency> <groupId>com.baomidou</groupId> < artifactId > mybatis - plus - the boot - starter < / artifactId > < version > 3.4.0 < / version > < / dependency > < the dependency > <groupId>org.projectlombok</groupId> <artifactId>lombok</artifactId> </dependency> <! Alibaba </groupId> <artifactId>fastjson</artifactId> <version>1.2.74</version> </dependency> <dependency> <groupId>joda-time</groupId> <artifactId>joda-time</artifactId> <version>2.10.6</version> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-test</artifactId>  </dependency>Copy the code

2. Application. Yml configuration

spring:
  application:
    name: securityjwt
  datasource:
    driver-class-name: com.mysql.cj.jdbc.Driver
    url: JDBC: mysql: / / 127.0.0.1:3306 / cheetah? characterEncoding=utf-8&useSSL=false&serverTimezone=UTC
    username: root
    password: 123456

server:
  port: 8080

mybatis:
  mapper-locations: classpath:mapper/*.xml
  type-aliases-package: com.itcheetah.securityjwt.entity
  configuration:
    map-underscore-to-camel-case: true

rsa:
  key:
    pubKeyFile: C:\Users\Desktop\jwt\id_key_rsa.pub
    priKeyFile: C:\Users\Desktop\jwt\id_key_rsa
Copy the code

3. SQL file

/**
* sys_user_info
**/

SET NAMES utf8mb4;
SET FOREIGN_KEY_CHECKS = 0;

-- ----------------------------
-- Table structure for sys_user_info
-- ----------------------------
DROP TABLE IF EXISTS `sys_user_info`;
CREATE TABLE `sys_user_info`  (
  `id` bigint(20) NOT NULL AUTO_INCREMENT,
  `username` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
  `password` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL.PRIMARY KEY (`id`) USING BTREE
) ENGINE = InnoDB AUTO_INCREMENT = 3 CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Dynamic;

SET FOREIGN_KEY_CHECKS = 1;


/**
* product_info
**/

SET NAMES utf8mb4;
SET FOREIGN_KEY_CHECKS = 0;

-- ----------------------------
-- Table structure for product_info
-- ----------------------------
DROP TABLE IF EXISTS `product_info`;
CREATE TABLE `product_info`  (
  `id` bigint(20) NOT NULL AUTO_INCREMENT,
  `name` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
  `price` decimal(10.4) NULL DEFAULT NULL,
  `create_date` datetime(0) NULL DEFAULT NULL,
  `update_date` datetime(0) NULL DEFAULT NULL.PRIMARY KEY (`id`) USING BTREE
) ENGINE = InnoDB AUTO_INCREMENT = 4 CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Dynamic;

SET FOREIGN_KEY_CHECKS = 1;
Copy the code

// Enable global method security
@EnableGlobalMethodSecurity(prePostEnabled=true, securedEnabled=true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    // Authentication failure handling class
    @Autowired
    private AuthenticationEntryPointImpl unauthorizedHandler;

    // Provides the public and private key configuration classes
    @Autowired
    private RsaKeyProperties prop;

    @Autowired
    private UserInfoService userInfoService;
    
    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
                // CSRF is disabled because sessions are not used
                .csrf().disable()
                // Authentication failure handling class
                .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
                // Token-based, so no session is required
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
                // Filter requests
                .authorizeRequests()
                .antMatchers(
                        HttpMethod.GET,
                        "/*.html"."/**/*.html"."/**/*.css"."/**/*.js"
                ).permitAll()
                // All requests other than the above require authentication
                .anyRequest().authenticated()
                .and()
                .headers().frameOptions().disable();
        // Add JWT filter
        httpSecurity.addFilter(new TokenLoginFilter(super.authenticationManager(), prop))
                .addFilter(new TokenVerifyFilter(super.authenticationManager(), prop));
    }

    // Specify the source of the authentication object
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        
        auth.userDetailsService(userInfoService)
        // The password passed from the front end will be encrypted, so from the database
        // The queried password must be encrypted, which is always the case
        // It is encrypted when the user registers.
        .passwordEncoder(passwordEncoder());
    }

    // Password encryption
    @Bean
    public BCryptPasswordEncoder passwordEncoder(a){
        return newBCryptPasswordEncoder(); }}Copy the code

Blocking rule

• anyRequest: Matches all request paths
• access:SpringElThe expression results intrueCan be accessed
• anonymous: Anonymously accessible
• ‘denyAll: users cannot access
• fullyAuthenticated: Users are fully authenticated to have access (nonremember-meAutomatic login)
• hasAnyAuthority: If there is a parameter, the parameter indicates the permission, then any of the permissions can be accessed
• hasAnyRole: If there is a parameter, the parameter indicates the role, and any role can access it
• hasAuthority: If there is a parameter, the parameter indicates the permission. The permission can be accessed
• hasIpAddress: Indicates a parameter, if anyIPAddress if the userIPIf the value matches the parameter, it can be accessed
• hasRole: If there is a parameter, which indicates the role, the role can access it
• permitAll: Users can access it at any time
• rememberMe: Permission to passremember-meLogged-in user access
• authenticated: Accessible after login

SecurityThe default login path is/loginWhen we call this interface, it will call the aboveattemptAuthenticationMethods;









So we’re going to customize itUserInfoServiceinheritanceUserDetailsServiceimplementationloadUserByUsernameMethods;

public interface UserInfoService extends UserDetailsService {}@Service
@Transactional
public class UserInfoServiceImpl implements UserInfoService {

    @Autowired
    private SysUserInfoMapper userInfoMapper;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        UserPojo user = userInfoMapper.queryByUserName(username);
        returnuser; }}Copy the code

LoadUserByUsername returns the UserDetails type, so UserPojo inherits the UserDetails class

@Data
public class UserPojo implements UserDetails {

    private Integer id;

    private String username;

    private String password;

    private Integer status;

    private List<RolePojo> roles;

    @JsonIgnore
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        // Ideal type returns admin permission and can handle this by itself
        List<SimpleGrantedAuthority> auth = new ArrayList<>();
        auth.add(new SimpleGrantedAuthority("ADMIN"));
        return auth;
    }

    @Override
    public String getPassword(a) {
        return this.password;
    }

    @Override
    public String getUsername(a) {
        return this.username;
    }

    /** * Whether the account has expired **/
    @JsonIgnore
    @Override
    public boolean isAccountNonExpired(a) {
        return true;
    }

    /** * Whether to disable */
    @JsonIgnore
    @Override
    public boolean isAccountNonLocked(a) {
        return true;
    }

    /** * Whether the password expires */
    @JsonIgnore
    @Override
    public boolean isCredentialsNonExpired(a) {
        return true;
    }

    /** * Whether to enable */
    @JsonIgnore
    @Override
    public boolean isEnabled(a) {
        return true; }}Copy the code

When the certification is approved, it will be inSecurityContextSet in theAuthenticationObject to call back tosuccessfulAuthenticationMethod returnstokenInformation,