解析spring-security权限控制和校验的问题

<dependency>
	<groupid>org.springframework.boot</groupid>
	<artifactid>spring-boot-starter-web</artifactid>
</dependency>
<dependency>
	<groupid>org.springframework.boot</groupid>
	<artifactid>spring-boot-starter-security</artifactid>
</dependency>

server.port=8080
server.servlet.context-path=/demo

spring.main.allow-bean-definition-overriding=true
spring.profiles.active=dev

package com.hp.springboot.admin.security;

import java.util.arraylist;
import java.util.list;

import org.springframework.beans.factory.annotation.autowired;
import org.springframework.context.annotation.bean;
import org.springframework.context.annotation.configuration;
import org.springframework.security.config.annotation.authentication.builders.authenticationmanagerbuilder;
import org.springframework.security.config.annotation.method.configuration.enableglobalmethodsecurity;
import org.springframework.security.config.annotation.web.builders.httpsecurity;
import org.springframework.security.config.annotation.web.builders.websecurity;
import org.springframework.security.config.annotation.web.configuration.websecurityconfigureradapter;
import org.springframework.security.core.userdetails.userdetailsservice;
import org.springframework.security.crypto.bcrypt.bcryptpasswordencoder;
import org.springframework.security.crypto.password.passwordencoder;
import org.springframework.security.web.authentication.usernamepasswordauthenticationfilter;

import com.hp.springboot.admin.constant.adminconstants;
import com.hp.springboot.admin.interceptor.urlauthenticationinterceptor;
import com.hp.springboot.admin.security.handler.adminaccessdeniedhandler;
import com.hp.springboot.admin.security.handler.adminauthenticationentrypoint;
import com.hp.springboot.admin.security.handler.adminauthenticationfailurehandler;
import com.hp.springboot.admin.security.handler.adminauthenticationsuccesshandler;
import com.hp.springboot.common.configuration.commonwebmvcconfigurer;

/**
 1. 描述：security全局配置
 2. 作者：黄平
 3. 时间：2021年1月11日
 */
@configuration
@enableglobalmethodsecurity(prepostenabled = true) //开启security注解的功能，如果你项目中不用security的注解（hasrole，hasauthority等），则可以不加该注解
public class adminwebsecurityconfigurer extends websecurityconfigureradapter {
	
	@autowired
	private commonwebmvcconfigurer commonwebmvcconfigurer;
	
	@override
	protected void configure(authenticationmanagerbuilder auth) throws exception {
		// 设置超级管理员
		auth.inmemoryauthentication()
			.withuser(adminconstants.admin_user)
		;
		
		// 其余账号通过数据库查询验证
		auth.userdetailsservice(adminuserdetailsservice()).passwordencoder(passwordencoder());
	}
	
	@override
	public void configure(websecurity web) throws exception {
		// 静态资源
		string[] ignorearray = commonwebmvcconfigurer.getmergestaticpatternarray();
		
		// 设置系统的静态资源。静态资源不会走权限框架
		web.ignoring().antmatchers(ignorearray);
	}
	
	@override
	protected void configure(httpsecurity http) throws exception {
		// 验证码过滤器
		http.addfilterbefore(new validatecodefilter(), usernamepasswordauthenticationfilter.class);
		
		// 第一层免过滤列表
		// 就是所有人都可以访问的地址。区别于静态资源
		list<string> nofilterlist = new arraylist<>();
		nofilterlist.add(adminconstants.access_denied_url);
		nofilterlist.add(adminconstants.verify_code_url);
		nofilterlist.addall(commonwebmvcconfigurer.getmergefirstnofilterlist());
				
		http.formlogin()// 登录页面使用form提交的方式
		.usernameparameter("username").passwordparameter("password")// 设置登录页面用户名和密码的input对应name值（其实默认值就是username,password，所以这里可以不用设置）
		.loginpage(adminconstants.login_page_url)// 设置登录页面的地址
		.loginprocessingurl(adminconstants.login_processing_url)// 登录页面输入用户名密码后提交的地址
		.successhandler(adminauthenticationsuccesshandler())// 登录成功处理
		.failurehandler(adminauthenticationfailurehandler())// 登录失败的处理
		.permitall()// 以上url全部放行，不需要校验权限
		.and()
		
		// 注销相关配置
		.logout()
		.logouturl(adminconstants.logout_url)// 注销地址
		.logoutsuccessurl(adminconstants.login_page_url)// 注销成功后跳转地址（这里就是跳转到登录页面）
		.permitall()// 以上地址全部放行
		.and().authorizerequests()
		
		// 第一层免过滤列表
		// 不需要登录，就可以直接访问的地址
		.antmatchers(nofilterlist.toarray(new string[nofilterlist.size()])).permitall() // 全部放行
		
		// 其他都需要权限控制
		// 这里使用.anyrequest().access方法，把权限验证交给指定的一个方法去处理。
		// 这里 haspermission接受两个参数request和authentication
		.anyrequest().access("@urlauthenticationinterceptor.haspermission(request, authentication)")
		
		// 异常处理
		.and().exceptionhandling()
		.accessdeniedhandler(new adminaccessdeniedhandler())// 登录用户访问无权限的资源
		.authenticationentrypoint(new adminauthenticationentrypoint())// 匿名用户访问无权限的资源
		.and().csrf().disable()// 禁用csrf
		
		// session管理
		.sessionmanagement()
		.invalidsessionurl(adminconstants.login_page_url)// session失效后，跳转的地址
		.maximumsessions(1)// 同一个账号最大允许同时在线数
		;
	}
	
	/**
	 * @title: passwordencoder
	 * @description: 加密方式
	 * @return
	 */
	@bean
  public passwordencoder passwordencoder() {
    return new bcryptpasswordencoder();
  }
	
	/**
	 * @title: adminuserdetailsservice
	 * @description: 用户信息
	 * @return
	 */
	@bean
	public userdetailsservice adminuserdetailsservice() {
		return new adminuserdetailsservice();
	}
	
	/**
	 * d
	 * @title: adminauthenticationfailurehandler
	 * @description: 登录异常处理
	 * @return
	 */
	@bean
	public adminauthenticationfailurehandler adminauthenticationfailurehandler() {
		return new adminauthenticationfailurehandler();
	}
	
	/**
	 * @title: adminauthenticationsuccesshandler
	 * @description: 登录成功后的处理
	 * @return
	 */
	@bean
	public adminauthenticationsuccesshandler adminauthenticationsuccesshandler() {
		return new adminauthenticationsuccesshandler();
	}
	
	/**
	 * @title: urlauthenticationinterceptor
	 * @description: 查询权限拦截器
	 * @return
	 */
	@bean("urlauthenticationinterceptor")
	public urlauthenticationinterceptor urlauthenticationinterceptor() {
		return new urlauthenticationinterceptor();
	}
}

.anyrequest().authenticated().withobjectpostprocessor(new objectpostprocessor<filtersecurityinterceptor>() {

			@override
			public <o extends filtersecurityinterceptor> o postprocess(o object) {
				// 权限查询器
				// 设置你有哪些权限
				object.setsecuritymetadatasource(null);
				
				// 权限决策器
				// 判断你有没有权限访问当前的url
				object.setaccessdecisionmanager(null);
				return object;
			}

		})

package com.hp.springboot.admin.security;

import org.slf4j.logger;
import org.slf4j.loggerfactory;
import org.springframework.beans.factory.annotation.autowired;
import org.springframework.security.core.userdetails.userdetails;
import org.springframework.security.core.userdetails.userdetailsservice;
import org.springframework.security.core.userdetails.usernamenotfoundexception;

import com.hp.springboot.admin.convert.sysuserconvert;
import com.hp.springboot.admin.dal.isysuserdao;
import com.hp.springboot.admin.dal.model.sysuser;
import com.hp.springboot.admin.model.response.sysuserresponsebo;
import com.hp.springboot.database.bean.sqlbuilders;
import com.hp.springboot.database.bean.sqlwhere;

/**
 * 描述：security需要的操作用户的接口实现
 * 执行登录,构建authentication对象必须的信息
 * 如果用户不存在，则抛出usernamenotfoundexception异常
 * 作者：黄平
 * 时间：2021年1月12日
 */
public class adminuserdetailsservice implements userdetailsservice {

	private static logger log = loggerfactory.getlogger(adminuserdetailsservice.class);
	
	@autowired
	private isysuserdao sysuserdao;
	
	/**
	 * 执行登录,构建authentication对象必须的信息,
	 */
	@override
	public userdetails loaduserbyusername(string username) throws usernamenotfoundexception {
		log.info("loaduserbyusername with username={}", username);
		
		//根据登录名，查询用户
		sysuser user = sysuserdao.selectone(sqlbuilders.create()
				.withwhere(sqlwhere.builder()
						.eq("login_name", username)
						.build()
						)
				);
		if (user == null) {
			log.warn("loaduserbyusername with user is not exists. with username={}", username);
			throw new usernamenotfoundexception("用户不存在");
		}
		
		// 对象装换，转换成sysuserresponsebo对象
		sysuserresponsebo resp = sysuserconvert.dal2boresponse(user);
		return resp;
	}

}

/**
	 * 获取该用户的角色
	 */
	public collection<? extends grantedauthority> getauthorities() {
		return this.authorities;
	}

@override
	public void onauthenticationsuccess(httpservletrequest request, httpservletresponse response,
			authentication authentication) throws ioexception, servletexception {
		response.setcontenttype(contenttypeconstant.application_json_utf8);
		
		// 获取session对象
		httpsession session = request.getsession();
		
		//设置登录用户session
		setusersession(session);
		
		//查询用户的菜单和按钮
		setusermenu(session);
		
		//session中获取当前登录的用户
		sysuserresponsebo user = securitysessionutil.getsessiondata();
		
		// 更新最近登录时间
		sysuserservice.updatelastlogintime(user.getid());
		
		//项目名称
		session.setattribute("projectname", projectname);
		
		// 注销地址
		session.setattribute("logouturl", adminconstants.logout_url);
		
		// 返回json格式数据
		response<object> resp = response.success();
		try (printwriter out = response.getwriter()) {
			out.write(resp.tostring());
			out.flush();
		}
	}

package com.hp.springboot.admin.security.handler;

import java.io.ioexception;
import java.io.printwriter;

import javax.servlet.servletexception;
import javax.servlet.http.httpservletrequest;
import javax.servlet.http.httpservletresponse;

import org.slf4j.logger;
import org.slf4j.loggerfactory;
import org.springframework.security.authentication.accountexpiredexception;
import org.springframework.security.authentication.badcredentialsexception;
import org.springframework.security.authentication.credentialsexpiredexception;
import org.springframework.security.authentication.disabledexception;
import org.springframework.security.authentication.insufficientauthenticationexception;
import org.springframework.security.authentication.lockedexception;
import org.springframework.security.core.authenticationexception;
import org.springframework.security.core.userdetails.usernamenotfoundexception;
import org.springframework.security.web.authentication.authenticationfailurehandler;

import com.hp.springboot.admin.exception.validatecodeexception;
import com.hp.springboot.common.bean.response;
import com.hp.springboot.common.constant.contenttypeconstant;

/**
 * 描述：登录失败处理 作者：黄平 时间：2021年1月15日
 */
public class adminauthenticationfailurehandler implements authenticationfailurehandler {

	private static logger log = loggerfactory.getlogger(adminauthenticationfailurehandler.class);

	@override
	public void onauthenticationfailure(httpservletrequest request, httpservletresponse response,
			authenticationexception exception) throws ioexception, servletexception {
		log.warn("login error with exception is {}", exception.getmessage());
		response.setcontenttype(contenttypeconstant.application_json_utf8);
		string message = "";
		if (exception instanceof badcredentialsexception || exception instanceof usernamenotfoundexception) {
			message = "账户名或者密码输入错误!";
		} else if (exception instanceof lockedexception) {
			message = "账户被锁定，请联系管理员!";
		} else if (exception instanceof credentialsexpiredexception) {
			message = "密码过期，请联系管理员!";
		} else if (exception instanceof accountexpiredexception) {
			message = "账户过期，请联系管理员!";
		} else if (exception instanceof disabledexception) {
			message = "账户被禁用，请联系管理员!";
		} else if (exception instanceof validatecodeexception) {
			// 图形验证码输入错误
			message = exception.getmessage();
		} else if (exception instanceof insufficientauthenticationexception) {
			message = exception.getmessage();
		} else {
			message = "登录失败!";
		}
		
		// 返回json格式数据
		response<object> resp = response.error(message);
		try (printwriter out = response.getwriter()) {
			out.write(resp.tostring());
			out.flush();
		}
	}

}