Spring Security Remember me使用及原理详解

<dependency>
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-starter-security</artifactId>
</dependency>

@Autowired
  private UserDetailsService myUserDetailServiceImpl; // 用户信息服务
  @Autowired
  private DataSource dataSource; // 数据源
  @Override
  protected void configure(HttpSecurity http) throws Exception {
    // formLogin()是默认的登录表单页，如果不配置 loginPage(url)，则使用 spring security
    // 默认的登录页，如果配置了 loginPage()则使用自定义的登录页
    http.formLogin() // 表单登录
        .loginPage(SecurityConst.AUTH_REQUIRE)
        .loginProcessingUrl(SecurityConst.AUTH_FORM) // 登录请求拦截的url,也就是form表单提交时指定的action
        .successHandler(loginSuccessHandler)
        .failureHandler(loginFailureHandler)
        .and()
      .rememberMe()
        .userDetailsService(myUserDetailServiceImpl) // 设置userDetailsService
        .tokenRepository(persistentTokenRepository()) // 设置数据访问层
        .tokenValiditySeconds(60 * 60) // 记住我的时间(秒)
        .and()
      .authorizeRequests() // 对请求授权
        .antMatchers(SecurityConst.AUTH_REQUIRE, securityProperty.getBrowser().getLoginPage()).permitAll() // 允许所有人访问login.html和自定义的登录页
        .anyRequest() // 任何请求
        .authenticated()// 需要身份认证
        .and()
      .csrf().disable() // 关闭跨站伪造
    ;
  }
  /**
   * 持久化token
   * 
   * Security中，默认是使用PersistentTokenRepository的子类InMemoryTokenRepositoryImpl，将token放在内存中
   * 如果使用JdbcTokenRepositoryImpl，会创建表persistent_logins，将token持久化到数据库
   */
  @Bean
  public PersistentTokenRepository persistentTokenRepository() {
    JdbcTokenRepositoryImpl tokenRepository = new JdbcTokenRepositoryImpl();
    tokenRepository.setDataSource(dataSource); // 设置数据源
//    tokenRepository.setCreateTableOnStartup(true); // 启动创建表，创建成功后注释掉
    return tokenRepository;
  }

// ...
  private RememberMeServices rememberMeServices = new NullRememberMeServices();
  protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,
      Authentication authResult) throws IOException, ServletException {
    // ...
    SecurityContextHolder.getContext().setAuthentication(authResult);
    // 登录成功后，调用RememberMeServices保存Token相关信息
    rememberMeServices.loginSuccess(request, response, authResult);
    // ...
  }

// ...

  private PersistentTokenRepository tokenRepository = new InMemoryTokenRepositoryImpl();
  protected void onLoginSuccess(HttpServletRequest request,
      HttpServletResponse response, Authentication successfulAuthentication) {
    String username = successfulAuthentication.getName();

    logger.debug("Creating new persistent login for user " + username);

    // 创建一个PersistentRememberMeToken
    PersistentRememberMeToken persistentToken = new PersistentRememberMeToken(
        username, generateSeriesData(), generateTokenData(), new Date());
    try {
      // 保存Token
      tokenRepository.createNewToken(persistentToken);
      // 将Token写到Cookie中
      addCookie(persistentToken, request, response);
    }
    catch (Exception e) {
      logger.error("Failed to save persistent token ", e);
    }
  }

/** The default SQL used by <tt>createNewToken</tt> */
  public static final String DEF_INSERT_TOKEN_SQL = "insert into persistent_logins (username, series, token, last_used) values(?,?,?,?)";

  public void createNewToken(PersistentRememberMeToken token) {
    getJdbcTemplate().update(insertTokenSql, token.getUsername(), token.getSeries(),
        token.getTokenValue(), token.getDate());
  }

protected UserDetails processAutoLoginCookie(String[] cookieTokens,
      HttpServletRequest request, HttpServletResponse response) {

    if (cookieTokens.length != 2) {
      throw new InvalidCookieException("Cookie token did not contain " + 2
          + " tokens, but contained '" + Arrays.asList(cookieTokens) + "'");
    }

    // 从Cookie中获取Series和Token
    final String presentedSeries = cookieTokens[0];
    final String presentedToken = cookieTokens[1]; 

    //在数据库中，通过Series查询PersistentRememberMeToken
    PersistentRememberMeToken token = tokenRepository
        .getTokenForSeries(presentedSeries);

    if (token == null) {
      throw new RememberMeAuthenticationException(
          "No persistent token found for series id: " + presentedSeries);
    }

    // 校验数据库中Token和Cookie中的Token是否相同
    if (!presentedToken.equals(token.getTokenValue())) {
      tokenRepository.removeUserTokens(token.getUsername());

      throw new CookieTheftException(
          messages.getMessage(
              "PersistentTokenBasedRememberMeServices.cookieStolen",
              "Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack."));
    }

    // 判断Token是否超时
    if (token.getDate().getTime() + getTokenValiditySeconds() * 1000L < System
        .currentTimeMillis()) {
      throw new RememberMeAuthenticationException("Remember-me login has expired");
    }

    if (logger.isDebugEnabled()) {
      logger.debug("Refreshing persistent login token for user '"
          + token.getUsername() + "', series '" + token.getSeries() + "'");
    }
    
    // 创建一个新的PersistentRememberMeToken
    PersistentRememberMeToken newToken = new PersistentRememberMeToken(
        token.getUsername(), token.getSeries(), generateTokenData(), new Date());

    try {
      //更新数据库中Token
      tokenRepository.updateToken(newToken.getSeries(), newToken.getTokenValue(),
          newToken.getDate());
      //重新写到Cookie
      addCookie(newToken, request, response);
    }
    catch (Exception e) {
      logger.error("Failed to update token: ", e);
      throw new RememberMeAuthenticationException(
          "Autologin failed due to data access problem");
    }
    //调用UserDetailsService获取用户信息
    return getUserDetailsService().loadUserByUsername(token.getUsername());
  }