SpringBoot+SpringSecurity实现认证的流程详解

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(user.getUserName(),user.getPassword());

 @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //查询用户信息
        User user = userMapper.findByColumnAndValue("user_name", username);
        if(user==null){
            throw new UsernameNotFoundException("用户名或密码错误");
        }
        //查询用户权限
        List<String> perms = menuMapper.selectPermsByUserId(user.getId());
        return new LoginUser(user,perms);
    }

//加密器 bean
@Bean
    public PasswordEncoder PasswordEncoder(){
        return new BCryptPasswordEncoder();
    }
//验证逻辑
Authentication authenticate = authenticationManager.authenticate(usernamePasswordAuthenticationToken);

SecurityContextHolder.getContext().setAuthentication(authenticate);

@Component
public class AuthenticationEntryPointImpl implements AuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
        ResponseResult<Object> noAuthentication = ResponseResult.noAuthentication("认证失败");
        String json = JSON.toJSONString(noAuthentication);
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Cache-Control","no-cache");
        response.setCharacterEncoding("UTF-8");
        response.setContentType("application/json");
        response.getWriter().println(json);
        response.getWriter().flush();
    }
}

@Component
public class CheckLoginFilter extends OncePerRequestFilter {
    @Autowired
    private UserMapper userMapper;
    @Autowired
    private RedisCache redisCache;
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        // 如果请求路径是登录接口，直接放行
        String requestURI = request.getRequestURI();
        if ("/user/login".equals(requestURI)) {
            filterChain.doFilter(request, response);
            return;
        }
​
        //获取token
        String token = request.getHeader("token");
        if(token==null){
            //springSecurity有一个过滤器会自动检查Context有没有认证
            throw new RuntimeException("token为空");
        }
        //解析token，获取userId
        Claims claims = JwtUtils.parserClaimsFromToken(token);
        if(claims==null){
            throw new RuntimeException("token非法");
        }
        //从redis数据库里取
        Long userId = claims.get("userId", Long.class);
        String redisKey="login:"+userId;
        LoginUser loginUser = (LoginUser) redisCache.getCacheObject(redisKey);
        if(loginUser==null){
            throw new RuntimeException("没有登录：redis没有登录key");
        }
        //todo 从数据库查该用户的权限，先写死
        //将用户信息存入Authentication
        //权限存入，全局设置为该请求已经认证过
        UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(loginUser,null,loginUser.getAuthorities());
        SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
        //checkLogin完成，放行
        filterChain.doFilter(request,response);
​
    }
}