SpringSecurity自动登录流程与实现详解

@Override
protected void onLoginSuccess(HttpServletRequest request, HttpServletResponse response,
		Authentication successfulAuthentication) {
	// 1. 登录的用户名账号	
	String username = successfulAuthentication.getName();
	// 2. 生成一个Token
	PersistentRememberMeToken persistentToken = new PersistentRememberMeToken(username, generateSeriesData(),
			generateTokenData(), new Date());
	try {
		// 3. 持久化到数据库中
		this.tokenRepository.createNewToken(persistentToken);
		// 4. 添加到Cookie中
		addCookie(persistentToken, request, response);
	}
	catch (Exception ex) {
		this.logger.error("Failed to save persistent token ", ex);
	}
}

@Override
protected UserDetails processAutoLoginCookie(String[] cookieTokens, HttpServletRequest request,
		HttpServletResponse response) {
	// 1. cookie残缺	
	if (cookieTokens.length != 2) {
		throw new InvalidCookieException("Cookie token did not contain " + 2 + " tokens, but contained '"
				+ Arrays.asList(cookieTokens) + "'");
	}
	String presentedSeries = cookieTokens[0];
	String presentedToken = cookieTokens[1];
	PersistentRememberMeToken token = this.tokenRepository.getTokenForSeries(presentedSeries);
	
	....
	// 2. 这里有一大堆的校验失败
	....
	
	// 3. 校验成功，重新生成Cookie等一系列操作
	PersistentRememberMeToken newToken = new PersistentRememberMeToken(token.getUsername(), token.getSeries(),
			generateTokenData(), new Date());
	try {
		this.tokenRepository.updateToken(newToken.getSeries(), newToken.getTokenValue(), newToken.getDate());
		addCookie(newToken, request, response);
	}
	
	// 4. 查用户（因为有可能用户删除掉）
	return getUserDetailsService().loadUserByUsername(token.getUsername());
}

// 操作token的数据表
create table persistent_logins (
    username varchar(64) not null, 
    series varchar(64) primary key, 
    token varchar(64) not null, 
    last_used timestamp not null
)engine=innodb default charset=utf8

// 存放用户信息表
create table `account` (
  `id` int(11) not null auto_increment comment '编号',
  `username` varchar(30) not null comment '姓名',
  `password` varchar(30) not null comment '密码',
  `role` varchar(100) not null comment '权限',
  primary key (`id`)
) engine=innodb default charset=utf8
insert into account(`id`, `username`, `password`, `role`) values (1, 'admin', '123456', 'root')

// pojo
@Data
@AllArgsConstructor
@NoArgsConstructor
public class Account {

    private Integer id;
    private String username;
    private String password;
    private String role;
}

// mapper
@Mapper
@Repository
public interface AccountMapper {

    Account getLoginAccount(String username);
}

// accountmapper.xml
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper
        PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
        "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.splay.mapper.AccountMapper">
    
    <select id="getLoginAccount" parameterType="string" resultType="Account">
        select *from account where username = #{username}
    </select>
</mapper>

@Service
public class UserDetailsServiceImpl implements UserDetailsService {

    // 注入dao层
    @Autowired
    AccountMapper mapper;

    @Autowired
    BCryptPasswordEncoder passwordEncoder;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException{
        Account account = mapper.getLoginAccount(username);
        System.out.println(account.toString());
        List<GrantedAuthority> list = new ArrayList<>();
        // SpringSecurity权限控制角色需要使用"ROLE_"开头, 并且密码在构造时需要进行加密。
        list.add(new SimpleGrantedAuthority("ROLE_" + account.getRole()));

        return new User(passwordEncoder.encode(account.getUsername()), passwordEncoder.encode(account.getPassword()), list);
    }
}

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
	
	// 数据源
	@Autowired
    DataSource dataSource;

	// UserDetailsService实现类
	@Autowired
    UserDetailsService userDetailsService;

    // 注入密码加密解密类
    @Bean
    public BCryptPasswordEncoder bCryptPasswordEncoder(){
        return new BCryptPasswordEncoder();
    }

    // 注入jdbc Token操作类
    @Bean
    PersistentTokenRepository persistentTokenRepository(){
        JdbcTokenRepositoryImpl repository = new JdbcTokenRepositoryImpl();
        repository.setCreateTableOnStartup(false);				//关闭自动创建表
        repository.setDataSource(dataSource);					//注入数据源
        return repository;
    }
		
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {

	// 密码需要进行加密解密进行验证匹配！
	auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder);
}

@Override
protected void configure(HttpSecurity http) throws Exception {
	http
        .formLogin()
        .loginPage("/login")                    // 登录页面
        .loginProcessingUrl("/user/login")      // 提交表单处理的请求，由Security实现
        .defaultSuccessUrl("/index",true).permitAll()      //成功访问哪里
    .and()
        .logout()
        .logoutUrl("/logout")
        .logoutSuccessUrl("/index").deleteCookies().permitAll()    //退出成功页面

    // 2. 无需保护的页面
    .and()
        .authorizeRequests()
            .antMatchers("/level1/**").permitAll()
            .antMatchers("/level2/**").hasAnyRole("customer", "admin")
            .antMatchers("/level3/**").hasRole("admin")
    .anyRequest().authenticated().and()
            .rememberMe()                                       //记住我
            .tokenRepository(persistentTokenRepository)         //注入操作token的jdbc
            .tokenValiditySeconds(60).rememberMeCookieName("remember-me")                   //Cookie有效时间 单位: 秒
            .userDetailsService(userDetailsService);             //注入用户验证UserDetailsService
    http.exceptionHandling().accessDeniedPage("/nodeny");
    http.csrf().disable();
}

<form action="/user/login" method="post">
    用户名: <input type="text" name="username"><br/>
    密码: <input type="text" name="password"><br/>
    <input type="checkbox" name="remember-me">记住我<br/>
    <input type="submit" value="登录"/>
</form>