spring security 使用 application/json 接收数据

Posted 2022-01-06

spring security 使用 application/json 接收数据

---

不了解 security 的请看 security 的简单使用

https://blog.51cto.com/5013162/2404946

---

在使用 spring security 登录用户的时候 发现使用 application/josn 后台不能获取到数据
看 UsernamePasswordAuthenticationFilter 源码发现

    //获取密码
    protected String obtainPassword(HttpServletRequest request) 
         return request.getParameter(passwordParameter);
    
    //获取用户名
    protected String obtainUsername(HttpServletRequest request) 
         return request.getParameter(usernameParameter);
    

是直接从request 获取的 不是从 requestBody 中获取的

那我们就只需要重写这两个方法从 requestBody 中获取参数

重写 UsernamePasswordAuthenticationFilter 类

    public class UserAuthenticationFilter extends UsernamePasswordAuthenticationFilter 

        private ThreadLocal<Map<String,String>> threadLocal = new ThreadLocal<>();

        @Override
        protected String obtainPassword(HttpServletRequest request) 
                String password = this.getBodyParams(request).get(super.SPRING_SECURITY_FORM_PASSWORD_KEY);
                if(!StringUtils.isEmpty(password))
                        return password;
                
                return super.obtainPassword(request);
        

        @Override
        protected String obtainUsername(HttpServletRequest request) 
                String username = this.getBodyParams(request).get(super.SPRING_SECURITY_FORM_USERNAME_KEY);
                if(!StringUtils.isEmpty(username))
                        return username;
                
                return super.obtainUsername(request);
        

        /**
         * 获取body参数  body中的参数只能获取一次 
         * @param request
         * @return
         */
        private Map<String,String> getBodyParams(HttpServletRequest request)
                Map<String,String> bodyParams =  threadLocal.get();
                if(bodyParams==null) 
                        ObjectMapper objectMapper = new ObjectMapper();
                        try (InputStream is = request.getInputStream()) 
                                bodyParams = objectMapper.readValue(is, Map.class);
                         catch (IOException e) 
                        
                        if(bodyParams==null) bodyParams = new HashMap<>();
                        threadLocal.set(bodyParams);
                

                return bodyParams;
        


自定义 SecurityConfig 类

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter 

        @Autowired
        UserDetailServiceImpl userDetailService;
        @Autowired
        LoginSuccessHandler loginSuccessHandler;

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception 
                //自定义用户验证和加密方式
                auth.userDetailsService(userDetailService).passwordEncoder(new BCryptPasswordEncoder());
        

        @Override
        protected void configure(HttpSecurity http) throws Exception 
                http.formLogin()                    //  定义当需要用户登录时候，转到的登录页面。
        //          .loginPage("/login.html") //自定义登录页面
//                .loginProcessingUrl("/login") //自定义登录接口地址
//                .successHandler(loginSuccessHandler)
                                .and()
                                // 定义哪些URL需要被保护、哪些不需要被保护
                                .authorizeRequests().antMatchers("/login").permitAll() //不需要保护的URL
                                .anyRequest()               // 任何请求,登录后可以访问
                                .authenticated()
                                .and()
                                .logout().logoutSuccessUrl("/login").permitAll() // 登出
                                .and()
                                .csrf().disable();
                //配置自定义过滤器 增加post json 支持
                http.addFilterAt(UserAuthenticationFilterBean(), UsernamePasswordAuthenticationFilter.class);
        

        private UserAuthenticationFilter UserAuthenticationFilterBean() throws Exception 
                UserAuthenticationFilter userAuthenticationFilter = new UserAuthenticationFilter();
                userAuthenticationFilter.setAuthenticationManager(super.authenticationManager());
                userAuthenticationFilter.setAuthenticationSuccessHandler(loginSuccessHandler);
                return userAuthenticationFilter;
        

登录成功处理类
LoginSuccessHandler.class

@Component
public class LoginSuccessHandler implements AuthenticationSuccessHandler 
        @Override
        public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException 

                httpServletResponse.setContentType("application/json;charset=UTF-8");

                httpServletResponse.getWriter().write(authentication.getName());
        

用户校验处理类

@Component
public class UserDetailServiceImpl implements UserDetailsService 
        /**
         * 用户校验
         * @param s
         * @return
         * @throws UsernameNotFoundException
         */
        @Override
        public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException 
                Collection<GrantedAuthority> collection = new ArrayList<>();//权限集合
                String password = new BCryptPasswordEncoder().encode("123456");
                User user = new User(s,password,collection);

                return user;
        

改造完成 支持 post application/json 同时也支持 post form-data/x-www-form-urlencoded
都可以获取到传入的参数