分类导航

程序笔记发布时间：2022-07-19 发布网站：大佬教程 code.js-code.com

大佬教程收集整理的这篇文章主要介绍了Springboot WebFlux集成Spring Security实现JWT认证，大佬教程大佬觉得挺不错的，现在分享给大家，也给大家做个参考。

@H_450_1@我最新最全的文章都在南瓜慢说 www.pkslow.com ，欢迎大家来喝茶！

1 简介

@H_450_1@在之前的文章《Springboot集成Spring Security实现JWT认证》讲解了如何在传统的Web项目中整合Spring Security和JWT，今天我们讲解如何在响应式WebFlux项目中整合。二者大体是相同的，主要区别在于Reactive WebFlux与传统Web的区别。

2 项目整合

@H_450_1@引入必要的依赖：

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-webflux</artifactId>
</dependency>
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
  <groupId>io.jsonwebtoken</groupId>
  <artifactId>jjwt</artifactId>
  <version>0.9.1</version>
</dependency>

2.1 JWT工具类

@H_450_1@该工具类主要功能是创建、校验、解析JWT。

@Component
public class JwtTokenProvider {

    private static final String AUTHORITIES_KEY = "roles";

    private final JwtProperties jwtProperties;

    private String secretKey;

    public JwtTokenProvider(JwtProperties jwtProperties) {
        this.jwtProperties = jwtProperties;
    }

    @PostConstruct
    public void init() {
        secretKey = Base64.getEncoder().encodeToString(jwtProperties.getSecretKey().getBytes());
    }

    public String createToken(Authentication authentication) {

        String username = authentication.getName();
        Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
        Claims claims = Jwts.claims().setSubject(userName);
        if (!authorities.isEmpty()) {
            claims.put(AUTHORITIES_KEY, authorities.stream().map(GrantedAuthority::getAuthority).collect(joining(",")));
        }

        Date now = new Date();
        Date validity = new Date(now.getTime() + this.jwtProperties.getValidityInMs());

        return Jwts.builder()
                .setClaims(claims)
                .setIssuedAt(now)
                .setExpiration(validity)
                .signWith(SignatureAlgorithm.HS256, this.secretKey)
                .compact();

    }

    public Authentication getAuthentication(String token) {
        Claims claims = Jwts.parser().setSigningKey(this.secretKey).parseClaimsJws(token).getBody();

        Object authoritiesClaim = claims.get(AUTHORITIES_KEY);

        Collection<? extends GrantedAuthority> authorities = authoritiesClaim == null ? AuthorityUtils.NO_AUTHORITIES
                : AuthorityUtils.commaSeparatedStringToAuthorityList(authoritiesClaim.toString());

        User principal = new User(claims.getSubject(), "", authorities);

        return new UsernamepasswordAuthenticationToken(principal, token, authorities);
    }

    public Boolean validateToken(String token) {
        try {
            Jws<Claims> claims = Jwts.parser().setSigningKey(secretKey).parseClaimsJws(token);

            if (claims.getBody().getExpiration().before(new Date())) {
                return false;
            }

            return true;
        } catch (JwtException | IllegalArgumentexception E) {
            throw new InvalidJwtAuthenticationException("Expired or invalid JWT token");
        }
    }

}

2.2 JWT的过滤器

@H_450_1@这个过滤器的主要功能是从请求中获取JWT，然后进行校验，如何成功则把Authentication放进ReactiveSecurityContext里去。当然，如果没有带相关的请求头，那可能是通过其它方式进行鉴权，则直接放过，让它进入下一个Filter。

public class JwtTokenAuthenticationFilter implements WebFilter {

    public static final String HEADER_PREFIX = "Bearer ";

    private final JwtTokenProvider tokenProvider;

    public JwtTokenAuthenticationFilter(JwtTokenProvider tokenProvider) {
        this.tokenProvider = tokenProvider;
    }

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
        String token = resolveToken(exchange.getrequest());
        if (StringUtils.hasText(token) && this.tokenProvider.validateToken(token)) {
            Authentication authentication = this.tokenProvider.getAuthentication(token);
            return chain.filter(exchangE)
                    .subscriberContext(ReactiveSecurityContextHolder.withAuthentication(authentication));
        }
        return chain.filter(exchangE);
    }

    private String resolveToken(Serverhttprequest request) {
        String bearerToken = request.getHeaders().getFirst(httpHeaders.AUTHORIZATION);
        if (StringUtils.hasText(bearerToken) && bearerToken.startsWith(HEADER_PREFIX)) {
            return bearerToken.subString(7);
        }
        return null;
    }
}

2.3 Security的配置

@H_450_1@这里设置了两个异常处理authenticationEntryPoint和accessDeniedHandler。

@Configuration
public class SecurityConfig {

    @Bean
    SecurityWebFilterChain springWebFilterChain(ServerhttpSecurity http,
                                                JwtTokenProvider tokenProvider,
                                                ReactiveAuthenticationManager reactiveAuthenticationManager) {

        return http.csrf(ServerhttpSecurity.CsrfSpec::disablE)
                .httpBasic(ServerhttpSecurity.httpBasicSpec::disablE)
                .authenticationManager(reactiveAuthenticationManager)
                .exceptionHandling().authenticationEntryPoint(
                        (swe, E) -> {
            swe.getResponse().setStatusCode(httpStatuS.UNAUTHORIZED);
            return swe.getResponse().writeWith(Mono.just(new DefaultDataBufferFactory().wrap("UNAUTHORIZED".getBytes())));
        })
                .accessDeniedHandler((swe, E) -> {
            swe.getResponse().setStatusCode(httpStatus.FORBIDDEN);
            return swe.getResponse().writeWith(Mono.just(new DefaultDataBufferFactory().wrap("FORBIDDEN".getBytes())));
        }).and()
                .securityContextRepository(NoOpServerSecurityContextRepository.geTinstance())
                .authorizeExchange(it -> it
                        .pathMatchers(httpR_418_11845@ethod.POST, "/auth/login").permitAll()
                        .pathMatchers(httpR_418_11845@ethod.GET, "/admin").hasRole("ADMIN")
                        .pathMatchers(httpR_418_11845@ethod.GET, "/user").hasRole("USER")
                        .anyExchange().permitAll()
                )
                .addFilterAt(new JwtTokenAuthenticationFilter(tokenProvider), SecurityWebFiltersOrder.http_BASIC)
                .build();
    }


    @Bean
    public ReactiveAuthenticationManager reactiveAuthenticationManager(CustomUserDetailsservice userDetailsservice,
                                                                       passwordEncoder passwordEncoder) {
        UserDetailsRepositoryReactiveAuthenticationManager authenticationManager = new UserDetailsRepositoryReactiveAuthenticationManager(userDetailsservicE);
        authenticationManager.setpasswordEncoder(passwordEncoder);
        return authenticationManager;
    }
}

2.4 获取JWT的Controller

@H_450_1@先判断对用户密码进行判断，如果正确则返回对应的权限用户，根据用户生成JWT，再返回给客户端。

@RestController
@requestMapping("/auth")
public class AuthController {

    @Autowired
    ReactiveAuthenticationManager authenticationManager;

    @Autowired
    JwtTokenProvider jwtTokenProvider;

    @PostMapping("/login")
    public Mono<String> login(@requestBody Authrequest request) {
        String username = request.getUsername();
        Mono<Authentication> authentication = authenticationManager.authenticate(new UsernamepasswordAuthenticationToken(username, request.getpassword()));

        return authentication.map(auth -> jwtTokenProvider.createToken(auth));
    }
}