解析spring-security权限控制和校验的问题

<dependency>
	<groupId>org.springframework.boot</groupId>
	<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
	<groupId>org.springframework.boot</groupId>
	<artifactId>spring-boot-starter-security</artifactId>
</dependency>

server.port=8080
server.servlet.context-path=/demo

spring.main.allow-bean-definition-overriding=true
spring.profiles.active=dev

package com.hp.springboot.admin.security;

import java.util.ArrayList;
import java.util.List;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import com.hp.springboot.admin.constant.AdminConstants;
import com.hp.springboot.admin.interceptor.UrlAuthenticationInterceptor;
import com.hp.springboot.admin.security.handler.AdminAccessDeniedHandler;
import com.hp.springboot.admin.security.handler.AdminAuthenticationEntryPoint;
import com.hp.springboot.admin.security.handler.AdminAuthenticationFailureHandler;
import com.hp.springboot.admin.security.handler.AdminAuthenticationSuccessHandler;
import com.hp.springboot.common.configuration.CommonWebMvcConfigurer;

/**
 1. 描述：security全局配置
 2. 作者：黄平
 3. 时间：2021年1月11日
 */
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true) //开启Security注解的功能，如果你项目中不用Security的注解（hasRole，hasAuthority等），则可以不加该注解
public class AdminWebSecurityConfigurer extends WebSecurityConfigurerAdapter {
	
	@Autowired
	private CommonWebMvcConfigurer commonWebMvcConfigurer;
	
	@Override
	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
		// 设置超级管理员
		auth.inMemoryAuthentication()
			.withUser(AdminConstants.ADMIN_USER)
		;
		
		// 其余账号通过数据库查询验证
		auth.userDetailsService(adminUserDetailsService()).passwordEncoder(passwordEncoder());
	}
	
	@Override
	public void configure(WebSecurity web) throws Exception {
		// 静态资源
		String[] ignoreArray = commonWebMvcConfigurer.getMergeStaticPatternArray();
		
		// 设置系统的静态资源。静态资源不会走权限框架
		web.ignoring().antMatchers(ignoreArray);
	}
	
	@Override
	protected void configure(HttpSecurity http) throws Exception {
		// 验证码过滤器
		http.addFilterBefore(new ValidateCodeFilter(), UsernamePasswordAuthenticationFilter.class);
		
		// 第一层免过滤列表
		// 就是所有人都可以访问的地址。区别于静态资源
		List<String> noFilterList = new ArrayList<>();
		noFilterList.add(AdminConstants.ACCESS_DENIED_URL);
		noFilterList.add(AdminConstants.VERIFY_CODE_URL);
		noFilterList.addAll(commonWebMvcConfigurer.getMergeFirstNoFilterList());
				
		http.formLogin()// 登录页面使用form提交的方式
		.usernameParameter("username").passwordParameter("password")// 设置登录页面用户名和密码的input对应name值（其实默认值就是username,password，所以这里可以不用设置）
		.loginPage(AdminConstants.LOGIN_PAGE_URL)// 设置登录页面的地址
		.loginProcessingUrl(AdminConstants.LOGIN_PROCESSING_URL)// 登录页面输入用户名密码后提交的地址
		.successHandler(adminAuthenticationSuccessHandler())// 登录成功处理
		.failureHandler(adminAuthenticationFailureHandler())// 登录失败的处理
		.permitAll()// 以上url全部放行，不需要校验权限
		.and()
		
		// 注销相关配置
		.logout()
		.logoutUrl(AdminConstants.LOGOUT_URL)// 注销地址
		.logoutSuccessUrl(AdminConstants.LOGIN_PAGE_URL)// 注销成功后跳转地址（这里就是跳转到登录页面）
		.permitAll()// 以上地址全部放行
		.and().authorizeRequests()
		
		// 第一层免过滤列表
		// 不需要登录，就可以直接访问的地址
		.antMatchers(noFilterList.toArray(new String[noFilterList.size()])).permitAll() // 全部放行
		
		// 其他都需要权限控制
		// 这里使用.anyRequest().access方法，把权限验证交给指定的一个方法去处理。
		// 这里 hasPermission接受两个参数request和authentication
		.anyRequest().access("@UrlAuthenticationInterceptor.hasPermission(request, authentication)")
		
		// 异常处理
		.and().exceptionHandling()
		.accessDeniedHandler(new AdminAccessDeniedHandler())// 登录用户访问无权限的资源
		.authenticationEntryPoint(new AdminAuthenticationEntryPoint())// 匿名用户访问无权限的资源
		.and().csrf().disable()// 禁用csrf
		
		// session管理
		.sessionManagement()
		.invalidSessionUrl(AdminConstants.LOGIN_PAGE_URL)// session失效后，跳转的地址
		.maximumSessions(1)// 同一个账号最大允许同时在线数
		;
	}
	
	/**
	 * @Title: passwordEncoder
	 * @Description: 加密方式
	 * @return
	 */
	@Bean
 public PasswordEncoder passwordEncoder() {
  return new BCryptPasswordEncoder();
 }
	
	/**
	 * @Title: adminUserDetailsService
	 * @Description: 用户信息
	 * @return
	 */
	@Bean
	public UserDetailsService adminUserDetailsService() {
		return new AdminUserDetailsService();
	}
	
	/**
	 * d
	 * @Title: adminAuthenticationFailureHandler
	 * @Description: 登录异常处理
	 * @return
	 */
	@Bean
	public AdminAuthenticationFailureHandler adminAuthenticationFailureHandler() {
		return new AdminAuthenticationFailureHandler();
	}
	
	/**
	 * @Title: adminAuthenticationSuccessHandler
	 * @Description: 登录成功后的处理
	 * @return
	 */
	@Bean
	public AdminAuthenticationSuccessHandler adminAuthenticationSuccessHandler() {
		return new AdminAuthenticationSuccessHandler();
	}
	
	/**
	 * @Title: urlAuthenticationInterceptor
	 * @Description: 查询权限拦截器
	 * @return
	 */
	@Bean("UrlAuthenticationInterceptor")
	public UrlAuthenticationInterceptor urlAuthenticationInterceptor() {
		return new UrlAuthenticationInterceptor();
	}
}

.anyRequest().authenticated().withObjectPostProcessor(new ObjectPostProcessor<FilterSecurityInterceptor>() {

			@Override
			public <O extends FilterSecurityInterceptor> O postProcess(O object) {
				// 权限查询器
				// 设置你有哪些权限
				object.setSecurityMetadataSource(null);
				
				// 权限决策器
				// 判断你有没有权限访问当前的url
				object.setAccessDecisionManager(null);
				return object;
			}

		})

package com.hp.springboot.admin.security;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

import com.hp.springboot.admin.convert.SysUserConvert;
import com.hp.springboot.admin.dal.ISysUserDAO;
import com.hp.springboot.admin.dal.model.SysUser;
import com.hp.springboot.admin.model.response.SysUserResponseBO;
import com.hp.springboot.database.bean.SQLBuilders;
import com.hp.springboot.database.bean.SQLWhere;

/**
 * 描述：Security需要的操作用户的接口实现
 * 执行登录,构建Authentication对象必须的信息
 * 如果用户不存在，则抛出UsernameNotFoundException异常
 * 作者：黄平
 * 时间：2021年1月12日
 */
public class AdminUserDetailsService implements UserDetailsService {

	private static Logger log = LoggerFactory.getLogger(AdminUserDetailsService.class);
	
	@Autowired
	private ISysUserDAO sysUserDAO;
	
	/**
	 * 执行登录,构建Authentication对象必须的信息,
	 */
	@Override
	public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
		log.info("loadUserByUsername with username={}", username);
		
		//根据登录名，查询用户
		SysUser user = sysUserDAO.selectOne(SQLBuilders.create()
				.withWhere(SQLWhere.builder()
						.eq("login_name", username)
						.build()
						)
				);
		if (user == null) {
			log.warn("loadUserByUsername with user is not exists. with username={}", username);
			throw new UsernameNotFoundException("用户不存在");
		}
		
		// 对象装换，转换成SysUserResponseBO对象
		SysUserResponseBO resp = SysUserConvert.dal2BOResponse(user);
		return resp;
	}

}

/**
	 * 获取该用户的角色
	 */
	public Collection<? extends GrantedAuthority> getAuthorities() {
		return this.authorities;
	}

@Override
	public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
			Authentication authentication) throws IOException, ServletException {
		response.setContentType(ContentTypeConstant.APPLICATION_JSON_UTF8);
		
		// 获取session对象
		HttpSession session = request.getSession();
		
		//设置登录用户session
		setUserSession(session);
		
		//查询用户的菜单和按钮
		setUserMenu(session);
		
		//session中获取当前登录的用户
		SysUserResponseBO user = SecuritySessionUtil.getSessionData();
		
		// 更新最近登录时间
		sysUserService.updateLastLoginTime(user.getId());
		
		//项目名称
		session.setAttribute("projectName", projectName);
		
		// 注销地址
		session.setAttribute("logoutUrl", AdminConstants.LOGOUT_URL);
		
		// 返回json格式数据
		Response<Object> resp = Response.success();
		try (PrintWriter out = response.getWriter()) {
			out.write(resp.toString());
			out.flush();
		}
	}

package com.hp.springboot.admin.security.handler;

import java.io.IOException;
import java.io.PrintWriter;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.authentication.AccountExpiredException;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.CredentialsExpiredException;
import org.springframework.security.authentication.DisabledException;
import org.springframework.security.authentication.InsufficientAuthenticationException;
import org.springframework.security.authentication.LockedException;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;

import com.hp.springboot.admin.exception.ValidateCodeException;
import com.hp.springboot.common.bean.Response;
import com.hp.springboot.common.constant.ContentTypeConstant;

/**
 * 描述：登录失败处理 作者：黄平 时间：2021年1月15日
 */
public class AdminAuthenticationFailureHandler implements AuthenticationFailureHandler {

	private static Logger log = LoggerFactory.getLogger(AdminAuthenticationFailureHandler.class);

	@Override
	public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
			AuthenticationException exception) throws IOException, ServletException {
		log.warn("login error with exception is {}", exception.getMessage());
		response.setContentType(ContentTypeConstant.APPLICATION_JSON_UTF8);
		String message = "";
		if (exception instanceof BadCredentialsException || exception instanceof UsernameNotFoundException) {
			message = "账户名或者密码输入错误!";
		} else if (exception instanceof LockedException) {
			message = "账户被锁定，请联系管理员!";
		} else if (exception instanceof CredentialsExpiredException) {
			message = "密码过期，请联系管理员!";
		} else if (exception instanceof AccountExpiredException) {
			message = "账户过期，请联系管理员!";
		} else if (exception instanceof DisabledException) {
			message = "账户被禁用，请联系管理员!";
		} else if (exception instanceof ValidateCodeException) {
			// 图形验证码输入错误
			message = exception.getMessage();
		} else if (exception instanceof InsufficientAuthenticationException) {
			message = exception.getMessage();
		} else {
			message = "登录失败!";
		}
		
		// 返回json格式数据
		Response<Object> resp = Response.error(message);
		try (PrintWriter out = response.getWriter()) {
			out.write(resp.toString());
			out.flush();
		}
	}

}