SpringBoot(四)之使用JWT和SpringSecurity保护RESTAPI

{
 "alg":"HS512"
}

{
 "sub":"wang",
 "created":1489079981393,
 "exp":1489684781
}

{
 "alg": "HS512",
 "typ": "JWT"
}

HMACSHA256(
 base64UrlEncode(header) + "." +
 base64UrlEncode(payload),
 secret)

String generateToken(Map claims) {
 return Jwts.builder()
 .setClaims(claims)
 .setExpiration(generateExpirationDate())
 .signWith(SignatureAlgorithm.HS512, secret) //采用什么算法是可以自己选择的，不一定非要采用HS512
 .compact();
}

Map claims = new HashMap<>();
claims.put(CLAIM_KEY_USERNAME, username());

Claims getClaimsFromToken(String token) {
 Claims claims;
 try {
 claims = Jwts.parser()
 .setSigningKey(secret)
 .parseClaimsJws(token)
 .getBody();
 } catch (Exception e) {
 claims = null;
 }
 return claims;
}

{
 _id: 
 username: 'user',
 password: 'pass',
 roles: ['USER', 'ADMIN']
}

@Data
public class User {
 @Id
 private String id;
 @Indexed(unique=true, direction= IndexDirection.DESCENDING, dropDups=true)
 private String username;
 private String password;
 private String email;
 private Date lastPasswordResetDate;
 private List roles;
}

@Data
public class Todo {
 @Id private String id;
 private String desc;
 private boolean completed;
 private User user;
}

dependencies {
 // 省略其它依赖
 compile("org.projectlombok:lombok:${lombokVersion}")
}

dependencies {
 compile("org.springframework.boot:spring-boot-starter-data-rest")
 compile("org.springframework.boot:spring-boot-starter-data-mongodb")
 compile("org.springframework.boot:spring-boot-starter-security")
 compile("io.jsonwebtoken:jjwt:${jjwtVersion}")
 compile("org.projectlombok:lombok:${lombokVersion}")
 testCompile("org.springframework.boot:spring-boot-starter-test")
}

public class JwtUser implements UserDetails {
 private final String id;
 private final String username;
 private final String password;
 private final String email;
 private final Collection<? extends GrantedAuthority> authorities;
 private final Date lastPasswordResetDate;
 public JwtUser(
 String id,
 String username,
 String password,
 String email,
 Collection<? extends GrantedAuthority> authorities,
 Date lastPasswordResetDate) {
 this.id = id;
 this.username = username;
 this.password = password;
 this.email = email;
 this.authorities = authorities;
 this.lastPasswordResetDate = lastPasswordResetDate;
 }
 //返回分配给用户的角色列表
 @Override
 public Collection<? extends GrantedAuthority> getAuthorities() {
 return authorities;
 }
 @JsonIgnore
 public String getId() {
 return id;
 }
 @JsonIgnore
 @Override
 public String getPassword() {
 return password;
 }
 @Override
 public String getUsername() {
 return username;
 }
 // 账户是否未过期
 @JsonIgnore
 @Override
 public boolean isAccountNonExpired() {
 return true;
 }
 // 账户是否未锁定
 @JsonIgnore
 @Override
 public boolean isAccountNonLocked() {
 return true;
 }
 // 密码是否未过期
 @JsonIgnore
 @Override
 public boolean isCredentialsNonExpired() {
 return true;
 }
 // 账户是否激活
 @JsonIgnore
 @Override
 public boolean isEnabled() {
 return true;
 }
 // 这个是自定义的，返回上次密码重置日期
 @JsonIgnore
 public Date getLastPasswordResetDate() {
 return lastPasswordResetDate;
 }
}

public final class JwtUserFactory {
 private JwtUserFactory() {
 }
 public static JwtUser create(User user) {
 return new JwtUser(
 user.getId(),
 user.getUsername(),
 user.getPassword(),
 user.getEmail(),
 mapToGrantedAuthorities(user.getRoles()),
 user.getLastPasswordResetDate()
 );
 }
 private static List mapToGrantedAuthorities(List authorities) {
 return authorities.stream()
 .map(SimpleGrantedAuthority::new)
 .collect(Collectors.toList());
 }
}

@Service
public class JwtUserDetailsServiceImpl implements UserDetailsService {
 @Autowired
 private UserRepository userRepository;
 @Override
 public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
 User user = userRepository.findByUsername(username);
 if (user == null) {
 throw new UsernameNotFoundException(String.format("No user found with username '%s'.", username));
 } else {
 return JwtUserFactory.create(user);
 }
 }
}

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter{
 // Spring会自动寻找同样类型的具体类注入，这里就是JwtUserDetailsServiceImpl了
 @Autowired
 private UserDetailsService userDetailsService;
 @Autowired
 public void configureAuthentication(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
 authenticationManagerBuilder
 // 设置UserDetailsService
 .userDetailsService(this.userDetailsService)
 // 使用BCrypt进行密码的hash
 .passwordEncoder(passwordEncoder());
 }
 // 装载BCrypt密码编码器
 @Bean
 public PasswordEncoder passwordEncoder() {
 return new BCryptPasswordEncoder();
 }
 @Override
 protected void configure(HttpSecurity httpSecurity) throws Exception {
 httpSecurity
 // 由于使用的是JWT，我们这里不需要csrf
 .csrf().disable()
 // 基于token，所以不需要session
 .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
 .authorizeRequests()
 //.antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
 // 允许对于网站静态资源的无授权访问
 .antMatchers(
  HttpMethod.GET,
  "/",
  "/*.html",
  "/favicon.ico",
  "/**/*.html",
  "/**/*.css",
  "/**/*.js"
 ).permitAll()
 // 对于获取token的rest api要允许匿名访问
 .antMatchers("/auth/**").permitAll()
 // 除上面外的所有请求全部需要鉴权认证
 .anyRequest().authenticated();
 // 禁用缓存
 httpSecurity.headers().cacheControl();
 }
}

/**
 * 在 @PreAuthorize 中我们可以利用内建的 SPEL 表达式：比如 'hasRole()' 来决定哪些用户有权访问。
 * 需注意的一点是 hasRole 表达式认为每个角色名字前都有一个前缀 'ROLE_'。所以这里的 'ADMIN' 其实在
 * 数据库中存储的是 'ROLE_ADMIN' 。这个 @PreAuthorize 可以修饰Controller也可修饰Controller中的方法。
 **/
@RestController
@RequestMapping("/users")
@PreAuthorize("hasRole('ADMIN')")
public class UserController {
 @Autowired
 private UserRepository repository;

 @RequestMapping(method = RequestMethod.GET)
 public List getUsers() {
 return repository.findAll();
 }
 // 略去其它部分
}

@RestController
@RequestMapping("/todos")
@PreAuthorize("hasRole('USER')")
public class TodoController {
 // 略去
}

# Server configuration
server:
 port: 8090
 contextPath:
# Spring configuration
spring:
 jackson:
 serialization:
 INDENT_OUTPUT: true
 data.mongodb:
 host: localhost
 port: 27017
 database: springboot
# Logging configuration
logging:
 level:
 org.springframework:
 data: DEBUG
 security: DEBUG

2017-03-10 15:51:53.351 DEBUG 57599 --- [nio-8090-exec-4] o.s.s.w.a.ExceptionTranslationFilter : Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
 at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) ~[spring-security-core-4.2.1.RELEASE.jar:4.2.1.RELEASE]

@Component
public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
 @Autowired
 private UserDetailsService userDetailsService;
 @Autowired
 private JwtTokenUtil jwtTokenUtil;
 @Value("${jwt.header}")
 private String tokenHeader;
 @Value("${jwt.tokenHead}")
 private String tokenHead;
 @Override
 protected void doFilterInternal(
  HttpServletRequest request,
  HttpServletResponse response,
  FilterChain chain) throws ServletException, IOException {
 String authHeader = request.getHeader(this.tokenHeader);
 if (authHeader != null && authHeader.startsWith(tokenHead)) {
  final String authToken = authHeader.substring(tokenHead.length()); // The part after "Bearer "
  String username = jwtTokenUtil.getUsernameFromToken(authToken);
  logger.info("checking authentication " + username);
  if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
  UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
  if (jwtTokenUtil.validateToken(authToken, userDetails)) {
   UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(
    userDetails, null, userDetails.getAuthorities());
   authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(
    request));
   logger.info("authenticated user " + username + ", setting security context");
   SecurityContextHolder.getContext().setAuthentication(authentication);
  }
  }
 }
 chain.doFilter(request, response);
 }
}

public class WebSecurityConfig extends WebSecurityConfigurerAdapter{
 // 省略其它部分
 @Bean
 public JwtAuthenticationTokenFilter authenticationTokenFilterBean() throws Exception {
 return new JwtAuthenticationTokenFilter();
 }
 @Override
 protected void configure(HttpSecurity httpSecurity) throws Exception {
 // 省略之前写的规则部分，具体看前面的代码
 // 添加JWT filter
 httpSecurity
  .addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
 }
}

public interface AuthService {
 User register(User userToAdd);
 String login(String username, String password);
 String refresh(String oldToken);
}

@Service
public class AuthServiceImpl implements AuthService {
 private AuthenticationManager authenticationManager;
 private UserDetailsService userDetailsService;
 private JwtTokenUtil jwtTokenUtil;
 private UserRepository userRepository;
 @Value("${jwt.tokenHead}")
 private String tokenHead;
 @Autowired
 public AuthServiceImpl(
  AuthenticationManager authenticationManager,
  UserDetailsService userDetailsService,
  JwtTokenUtil jwtTokenUtil,
  UserRepository userRepository) {
 this.authenticationManager = authenticationManager;
 this.userDetailsService = userDetailsService;
 this.jwtTokenUtil = jwtTokenUtil;
 this.userRepository = userRepository;
 }
 @Override
 public User register(User userToAdd) {
 final String username = userToAdd.getUsername();
 if(userRepository.findByUsername(username)!=null) {
  return null;
 }
 BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
 final String rawPassword = userToAdd.getPassword();
 userToAdd.setPassword(encoder.encode(rawPassword));
 userToAdd.setLastPasswordResetDate(new Date());
 userToAdd.setRoles(asList("ROLE_USER"));
 return userRepository.insert(userToAdd);
 }
 @Override
 public String login(String username, String password) {
 UsernamePasswordAuthenticationToken upToken = new UsernamePasswordAuthenticationToken(username, password);
 final Authentication authentication = authenticationManager.authenticate(upToken);
 SecurityContextHolder.getContext().setAuthentication(authentication);
 final UserDetails userDetails = userDetailsService.loadUserByUsername(username);
 final String token = jwtTokenUtil.generateToken(userDetails);
 return token;
 }
 @Override
 public String refresh(String oldToken) {
 final String token = oldToken.substring(tokenHead.length());
 String username = jwtTokenUtil.getUsernameFromToken(token);
 JwtUser user = (JwtUser) userDetailsService.loadUserByUsername(username);
 if (jwtTokenUtil.canTokenBeRefreshed(token, user.getLastPasswordResetDate())){
  return jwtTokenUtil.refreshToken(token);
 }
 return null;
 }
}

# JWT
jwt:
 header: Authorization
 secret: mySecret
 expiration: 604800
 tokenHead: "Bearer "
 route:
 authentication:
 path: auth
 refresh: refresh
 register: "auth/register"

@RestController
public class AuthController {
 @Value("${jwt.header}")
 private String tokenHeader;
 @Autowired
 private AuthService authService;
 @RequestMapping(value = "${jwt.route.authentication.path}", method = RequestMethod.POST)
 public ResponseEntity<?> createAuthenticationToken(
  @RequestBody JwtAuthenticationRequest authenticationRequest) throws AuthenticationException{
 final String token = authService.login(authenticationRequest.getUsername(), authenticationRequest.getPassword());
 // Return the token
 return ResponseEntity.ok(new JwtAuthenticationResponse(token));
 }
 @RequestMapping(value = "${jwt.route.authentication.refresh}", method = RequestMethod.GET)
 public ResponseEntity<?> refreshAndGetAuthenticationToken(
  HttpServletRequest request) throws AuthenticationException{
 String token = request.getHeader(tokenHeader);
 String refreshedToken = authService.refresh(token);
 if(refreshedToken == null) {
  return ResponseEntity.badRequest().body(null);
 } else {
  return ResponseEntity.ok(new JwtAuthenticationResponse(refreshedToken));
 }
 }
 @RequestMapping(value = "${jwt.route.authentication.register}", method = RequestMethod.POST)
 public User register(@RequestBody User addedUser) throws AuthenticationException{
 return authService.register(addedUser);
 }
}

@PostAuthorize("returnObject.username == principal.username or hasRole('ROLE_ADMIN')")
 @RequestMapping(value = "/",method = RequestMethod.GET)
 public User getUserByUsername(@RequestParam(value="username") String username) {
 return repository.findByUsername(username);
 }