JWT之前说过了，可以参考 https://www.cnblogs.com/shigongp/p/17454635.html 。
使用jwt的思路：AuthenticationWebFilter认证成功后生成TOKEN，并通过响应头写回到客户端。新增一个WebFilter校验TOKEN。
添加依赖：
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt</artifactId>
<version>0.9.0</version>
</dependency>
<dependency>
<groupId>javax.xml.bind</groupId>
<artifactId>jaxb-api</artifactId>
<version>2.3.1</version>
</dependency>
在application.properties添加配置：
token.expire=3600000
token.key=123456HJKsdsf,';dfs
添加TokenManager：
public interface TokenManager {
public String createToken(String username);
public String getUserFromToken(String token);
}
@Service
@Slf4j
public class JwtTokenManager implements TokenManager {
@Value("${token.expire}")
private long tokenExpiration = 3600;
@Value("${token.key}")
private String tokenSignKey;
@Override
public String createToken(String username) {
String token = Jwts.builder().setSubject(username)
.setExpiration(new Date(System.currentTimeMillis() + tokenExpiration))
.signWith(SignatureAlgorithm.HS512, tokenSignKey).compressWith(CompressionCodecs.GZIP).compact();
log.info("用户：{}生成token:{}", username, token);
return token;
}
@Override
public String getUserFromToken(String token) {
String user = Jwts.parser().setSigningKey(tokenSignKey).parseClaimsJws(token).getBody().getSubject();
log.info("从token:{}解析的用户名：{}", token, user);
return user;
}
}
修改AuthenticationWebFilter：
@Bean
public AuthenticationWebFilter authenticationManager() {
AuthenticationWebFilter authenticationFilter = new AuthenticationWebFilter(userDetailsRepositoryReactiveAuthenticationManager());
authenticationFilter.setRequiresAuthenticationMatcher(ServerWebExchangeMatchers.pathMatchers(HttpMethod.POST, LOGIN_PAGE));
authenticationFilter.setAuthenticationFailureHandler((webFilterExchange, exception) -> {
log.info("认证异常",exception);
ServerWebExchange exchange = webFilterExchange.getExchange();
exchange.getResponse().getHeaders().add("Content-type", MediaType.APPLICATION_JSON_UTF8_VALUE);
Flux<DataBuffer> dataBufferFlux = DataBufferUtils.read(new ByteArrayResource("认证失败".getBytes(StandardCharsets.UTF_8)), exchange.getResponse().bufferFactory(), 1024 * 8);
return exchange.getResponse().writeAndFlushWith(t -> {
t.onSubscribe(new Subscription() {
@Override
public void request(long l) {
}
@Override
public void cancel() {
}
});
t.onNext(dataBufferFlux);
t.onComplete();
});
});
authenticationFilter.setAuthenticationConverter(new JsonServerAuthenticationConverter());
authenticationFilter.setAuthenticationSuccessHandler((webFilterExchange, authentication) -> {
log.info("认证成功:{}",authentication);
ServerWebExchange exchange = webFilterExchange.getExchange();
UserDetails userDetails = (UserDetails) authentication.getPrincipal();
String token = tokenManager.createToken(userDetails.getUsername());
exchange.getResponse().getHeaders().add("MY_TOKEN", token);
exchange.getResponse().getHeaders().add("Content-type", MediaType.APPLICATION_JSON_UTF8_VALUE);
Flux<DataBuffer> dataBufferFlux = DataBufferUtils.read(new ByteArrayResource("认证成功".getBytes(StandardCharsets.UTF_8)), exchange.getResponse().bufferFactory(), 1024 * 8);
return exchange.getResponse().writeAndFlushWith(t -> {
t.onSubscribe(new Subscription() {
@Override
public void request(long l) {
}
@Override
public void cancel() {
}
});
t.onNext(dataBufferFlux);
t.onComplete();
});
});
authenticationFilter.setSecurityContextRepository(NoOpServerSecurityContextRepository.getInstance());
return authenticationFilter;
}
将SecurityContextRepository设置成NoOpServerSecurityContextRepository，替换默认的WebSessionServerSecurityContextRepository。不需要将认证信息保存到WebSession中了。
SecurityWebFilterChain添加配置（只粘部分代码）：
.exceptionHandling()
.authenticationEntryPoint(((exchange, ex) -> {
exchange.getResponse().getHeaders().add("Content-type", MediaType.APPLICATION_JSON_UTF8_VALUE);
Flux<DataBuffer> dataBufferFlux = DataBufferUtils.read(new ByteArrayResource("请先登录".getBytes(StandardCharsets.UTF_8)), exchange.getResponse().bufferFactory(), 1024 * 8);
return exchange.getResponse().writeAndFlushWith(t -> {
t.onSubscribe(new Subscription() {
@Override
public void request(long l) {
}
@Override
public void cancel() {
}
});
t.onNext(dataBufferFlux);
t.onComplete();
});
}))
用于处理未登录的情形。
添加token校验WebFilter：
@Slf4j
public class TokenFilter implements WebFilter {
private TokenManager tokenManager;
private ReactiveUserDetailsService reactiveUserDetailsService;
public TokenFilter(TokenManager tokenManager, ReactiveUserDetailsService reactiveUserDetailsService){
this.tokenManager = tokenManager;
this.reactiveUserDetailsService = reactiveUserDetailsService;
}
@Override
public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
log.info("123");
List<String> myToken = exchange.getRequest().getHeaders().get("MY_TOKEN");
log.info("my_token:{}",myToken);
return Mono.justOrEmpty(myToken)
.map(s -> {
if (Objects.nonNull(s)) {
return s.get(0);
} else {
return null;
}
})
.filter(s -> s!=null)
.map(s -> {
String username = tokenManager.getUserFromToken(s);
if (username == null || username.trim().equals("")) {
throw new RuntimeException("非法TOKEN");
}
return username;
})
.flatMap(t -> {
Mono<UserDetails> userDetailsMono = reactiveUserDetailsService.findByUsername(t);
userDetailsMono.filter(tt -> Objects.isNull(t)).map(tt -> {
throw new RuntimeException("非法TOKEN");
}).subscribe();
return userDetailsMono;
})
.map(t -> {
SecurityContextImpl securityContext = new SecurityContextImpl();
securityContext.setAuthentication(UsernamePasswordAuthenticationToken.authenticated(t, t.getPassword(),t.getAuthorities()));
log.info("userDetail:{}",securityContext);
return Mono.just(securityContext);
})
.switchIfEmpty(Mono.defer(() -> chain.filter(exchange)).then(Mono.empty()))
.flatMap(t -> chain.filter(exchange).subscriberContext(ReactiveSecurityContextHolder.withSecurityContext(t)));
}
}
从TOKEN取出用户名并加载UserDetails到ReactiveSecurityContextHolder中。注意：switchIfEmpty(Mono.defer(() -> chain.filter(exchange)).then(Mono.empty()))是必须的，相当于始终都会调用chain.filter(exchange)。
将TokenFilter添加到SecurityWebFilterChain中：
@Bean
public TokenFilter tokenFilter() {
int order = SecurityWebFiltersOrder.FORM_LOGIN.getOrder();
TokenFilter tokenFilter = new TokenFilter(tokenManager, reactiveUserDetailsService);
return tokenFilter;
}
修改SecurityWebFilterChain：
http.addFilterAt(authenticationManager(), SecurityWebFiltersOrder.FORM_LOGIN);
http.addFilterAt(tokenFilter(), SecurityWebFiltersOrder.FORM_LOGIN);
用Postman获取验证码后在调用登录接口获取TOKEN，在使用TOKEN去访问controller。试下删除TOKEN能不能访问。