Spring Boot(四)之使用JWT和Spring Security保護REST API

{
 "alg":"HS512"
}

{
 "sub":"wang",
 "created":1489079981393,
 "exp":1489684781
}

{
 "alg": "HS512",
 "typ": "JWT"
}

HMACSHA256(
 base64UrlEncode(header) + "." +
 base64UrlEncode(payload),
 secret)

String generateToken(Map<String, Object> claims) {
 return Jwts.builder()
 .setClaims(claims)
 .setExpiration(generateExpirationDate())
 .signWith(SignatureAlgorithm.HS512, secret) //采用什么算法是可以自己選擇的，不一定非要采用HS512
 .compact();
}

Map<String, Object> claims = new HashMap<>();
claims.put(CLAIM_KEY_USERNAME, username());

Claims getClaimsFromToken(String token) {
 Claims claims;
 try {
 claims = Jwts.parser()
 .setSigningKey(secret)
 .parseClaimsJws(token)
 .getBody();
 } catch (Exception e) {
 claims = null;
 }
 return claims;
}

{
 _id: <id_generated>
 username: 'user',
 password: 'pass',
 roles: ['USER', 'ADMIN']
}

@Data
public class User {
 @Id
 private String id;
 @Indexed(unique=true, direction= IndexDirection.DESCENDING, dropDups=true)
 private String username;
 private String password;
 private String email;
 private Date lastPasswordResetDate;
 private List<String> roles;
}

@Data
public class Todo {
 @Id private String id;
 private String desc;
 private boolean completed;
 private User user;
}

dependencies {
 // 省略其它依賴
 compile("org.projectlombok:lombok:${lombokVersion}")
}

dependencies {
 compile("org.springframework.boot:spring-boot-starter-data-rest")
 compile("org.springframework.boot:spring-boot-starter-data-mongodb")
 compile("org.springframework.boot:spring-boot-starter-security")
 compile("io.jsonwebtoken:jjwt:${jjwtVersion}")
 compile("org.projectlombok:lombok:${lombokVersion}")
 testCompile("org.springframework.boot:spring-boot-starter-test")
}

public class JwtUser implements UserDetails {
 private final String id;
 private final String username;
 private final String password;
 private final String email;
 private final Collection<? extends GrantedAuthority> authorities;
 private final Date lastPasswordResetDate;
 public JwtUser(
 String id,
 String username,
 String password,
 String email,
 Collection<? extends GrantedAuthority> authorities,
 Date lastPasswordResetDate) {
 this.id = id;
 this.username = username;
 this.password = password;
 this.email = email;
 this.authorities = authorities;
 this.lastPasswordResetDate = lastPasswordResetDate;
 }
 //返回分配給用戶的角色列表
 @Override
 public Collection<? extends GrantedAuthority> getAuthorities() {
 return authorities;
 }
 @JsonIgnore
 public String getId() {
 return id;
 }
 @JsonIgnore
 @Override
 public String getPassword() {
 return password;
 }
 @Override
 public String getUsername() {
 return username;
 }
 // 賬戶是否未過期
 @JsonIgnore
 @Override
 public boolean isAccountNonExpired() {
 return true;
 }
 // 賬戶是否未鎖定
 @JsonIgnore
 @Override
 public boolean isAccountNonLocked() {
 return true;
 }
 // 密碼是否未過期
 @JsonIgnore
 @Override
 public boolean isCredentialsNonExpired() {
 return true;
 }
 // 賬戶是否激活
 @JsonIgnore
 @Override
 public boolean isEnabled() {
 return true;
 }
 // 這個是自定義的，返回上次密碼重置日期
 @JsonIgnore
 public Date getLastPasswordResetDate() {
 return lastPasswordResetDate;
 }
}

public final class JwtUserFactory {
 private JwtUserFactory() {
 }
 public static JwtUser create(User user) {
 return new JwtUser(
 user.getId(),
 user.getUsername(),
 user.getPassword(),
 user.getEmail(),
 mapToGrantedAuthorities(user.getRoles()),
 user.getLastPasswordResetDate()
 );
 }
 private static List<GrantedAuthority> mapToGrantedAuthorities(List<String> authorities) {
 return authorities.stream()
 .map(SimpleGrantedAuthority::new)
 .collect(Collectors.toList());
 }
}

@Service
public class JwtUserDetailsServiceImpl implements UserDetailsService {
 @Autowired
 private UserRepository userRepository;
 @Override
 public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
 User user = userRepository.findByUsername(username);
 if (user == null) {
 throw new UsernameNotFoundException(String.format("No user found with username '%s'.", username));
 } else {
 return JwtUserFactory.create(user);
 }
 }
}

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter{
 // Spring會自動尋找同樣類型的具體類注入，這里就是JwtUserDetailsServiceImpl了
 @Autowired
 private UserDetailsService userDetailsService;
 @Autowired
 public void configureAuthentication(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
 authenticationManagerBuilder
 // 設(shè)置UserDetailsService
 .userDetailsService(this.userDetailsService)
 // 使用BCrypt進行密碼的hash
 .passwordEncoder(passwordEncoder());
 }
 // 裝載BCrypt密碼編碼器
 @Bean
 public PasswordEncoder passwordEncoder() {
 return new BCryptPasswordEncoder();
 }
 @Override
 protected void configure(HttpSecurity httpSecurity) throws Exception {
 httpSecurity
 // 由于使用的是JWT，我們這里不需要csrf
 .csrf().disable()
 // 基于token，所以不需要session
 .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
 .authorizeRequests()
 //.antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
 // 允許對于網(wǎng)站靜態(tài)資源的無授權(quán)訪問
 .antMatchers(
  HttpMethod.GET,
  "/",
  "/*.html",
  "/favicon.ico",
  "/**/*.html",
  "/**/*.css",
  "/**/*.js"
 ).permitAll()
 // 對于獲取token的rest api要允許匿名訪問
 .antMatchers("/auth/**").permitAll()
 // 除上面外的所有請求全部需要鑒權(quán)認證
 .anyRequest().authenticated();
 // 禁用緩存
 httpSecurity.headers().cacheControl();
 }
}

/**
 * 在 @PreAuthorize 中我們可以利用內(nèi)建的 SPEL 表達式：比如 'hasRole()' 來決定哪些用戶有權(quán)訪問。
 * 需注意的一點是 hasRole 表達式認為每個角色名字前都有一個前綴 'ROLE_'。所以這里的 'ADMIN' 其實在
 * 數(shù)據(jù)庫中存儲的是 'ROLE_ADMIN' 。這個 @PreAuthorize 可以修飾Controller也可修飾Controller中的方法。
 **/
@RestController
@RequestMapping("/users")
@PreAuthorize("hasRole('ADMIN')")
public class UserController {
 @Autowired
 private UserRepository repository;

 @RequestMapping(method = RequestMethod.GET)
 public List<User> getUsers() {
 return repository.findAll();
 }
 // 略去其它部分
}

@RestController
@RequestMapping("/todos")
@PreAuthorize("hasRole('USER')")
public class TodoController {
 // 略去
}

# Server configuration
server:
 port: 8090
 contextPath:
# Spring configuration
spring:
 jackson:
 serialization:
 INDENT_OUTPUT: true
 data.mongodb:
 host: localhost
 port: 27017
 database: springboot
# Logging configuration
logging:
 level:
 org.springframework:
 data: DEBUG
 security: DEBUG

2017-03-10 15:51:53.351 DEBUG 57599 --- [nio-8090-exec-4] o.s.s.w.a.ExceptionTranslationFilter : Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
 at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) ~[spring-security-core-4.2.1.RELEASE.jar:4.2.1.RELEASE]

@Component
public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
 @Autowired
 private UserDetailsService userDetailsService;
 @Autowired
 private JwtTokenUtil jwtTokenUtil;
 @Value("${jwt.header}")
 private String tokenHeader;
 @Value("${jwt.tokenHead}")
 private String tokenHead;
 @Override
 protected void doFilterInternal(
  HttpServletRequest request,
  HttpServletResponse response,
  FilterChain chain) throws ServletException, IOException {
 String authHeader = request.getHeader(this.tokenHeader);
 if (authHeader != null && authHeader.startsWith(tokenHead)) {
  final String authToken = authHeader.substring(tokenHead.length()); // The part after "Bearer "
  String username = jwtTokenUtil.getUsernameFromToken(authToken);
  logger.info("checking authentication " + username);
  if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
  UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
  if (jwtTokenUtil.validateToken(authToken, userDetails)) {
   UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(
    userDetails, null, userDetails.getAuthorities());
   authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(
    request));
   logger.info("authenticated user " + username + ", setting security context");
   SecurityContextHolder.getContext().setAuthentication(authentication);
  }
  }
 }
 chain.doFilter(request, response);
 }
}

public class WebSecurityConfig extends WebSecurityConfigurerAdapter{
 // 省略其它部分
 @Bean
 public JwtAuthenticationTokenFilter authenticationTokenFilterBean() throws Exception {
 return new JwtAuthenticationTokenFilter();
 }
 @Override
 protected void configure(HttpSecurity httpSecurity) throws Exception {
 // 省略之前寫的規(guī)則部分，具體看前面的代碼
 // 添加JWT filter
 httpSecurity
  .addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
 }
}

public interface AuthService {
 User register(User userToAdd);
 String login(String username, String password);
 String refresh(String oldToken);
}

@Service
public class AuthServiceImpl implements AuthService {
 private AuthenticationManager authenticationManager;
 private UserDetailsService userDetailsService;
 private JwtTokenUtil jwtTokenUtil;
 private UserRepository userRepository;
 @Value("${jwt.tokenHead}")
 private String tokenHead;
 @Autowired
 public AuthServiceImpl(
  AuthenticationManager authenticationManager,
  UserDetailsService userDetailsService,
  JwtTokenUtil jwtTokenUtil,
  UserRepository userRepository) {
 this.authenticationManager = authenticationManager;
 this.userDetailsService = userDetailsService;
 this.jwtTokenUtil = jwtTokenUtil;
 this.userRepository = userRepository;
 }
 @Override
 public User register(User userToAdd) {
 final String username = userToAdd.getUsername();
 if(userRepository.findByUsername(username)!=null) {
  return null;
 }
 BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
 final String rawPassword = userToAdd.getPassword();
 userToAdd.setPassword(encoder.encode(rawPassword));
 userToAdd.setLastPasswordResetDate(new Date());
 userToAdd.setRoles(asList("ROLE_USER"));
 return userRepository.insert(userToAdd);
 }
 @Override
 public String login(String username, String password) {
 UsernamePasswordAuthenticationToken upToken = new UsernamePasswordAuthenticationToken(username, password);
 final Authentication authentication = authenticationManager.authenticate(upToken);
 SecurityContextHolder.getContext().setAuthentication(authentication);
 final UserDetails userDetails = userDetailsService.loadUserByUsername(username);
 final String token = jwtTokenUtil.generateToken(userDetails);
 return token;
 }
 @Override
 public String refresh(String oldToken) {
 final String token = oldToken.substring(tokenHead.length());
 String username = jwtTokenUtil.getUsernameFromToken(token);
 JwtUser user = (JwtUser) userDetailsService.loadUserByUsername(username);
 if (jwtTokenUtil.canTokenBeRefreshed(token, user.getLastPasswordResetDate())){
  return jwtTokenUtil.refreshToken(token);
 }
 return null;
 }
}

# JWT
jwt:
 header: Authorization
 secret: mySecret
 expiration: 604800
 tokenHead: "Bearer "
 route:
 authentication:
 path: auth
 refresh: refresh
 register: "auth/register"

@RestController
public class AuthController {
 @Value("${jwt.header}")
 private String tokenHeader;
 @Autowired
 private AuthService authService;
 @RequestMapping(value = "${jwt.route.authentication.path}", method = RequestMethod.POST)
 public ResponseEntity<?> createAuthenticationToken(
  @RequestBody JwtAuthenticationRequest authenticationRequest) throws AuthenticationException{
 final String token = authService.login(authenticationRequest.getUsername(), authenticationRequest.getPassword());
 // Return the token
 return ResponseEntity.ok(new JwtAuthenticationResponse(token));
 }
 @RequestMapping(value = "${jwt.route.authentication.refresh}", method = RequestMethod.GET)
 public ResponseEntity<?> refreshAndGetAuthenticationToken(
  HttpServletRequest request) throws AuthenticationException{
 String token = request.getHeader(tokenHeader);
 String refreshedToken = authService.refresh(token);
 if(refreshedToken == null) {
  return ResponseEntity.badRequest().body(null);
 } else {
  return ResponseEntity.ok(new JwtAuthenticationResponse(refreshedToken));
 }
 }
 @RequestMapping(value = "${jwt.route.authentication.register}", method = RequestMethod.POST)
 public User register(@RequestBody User addedUser) throws AuthenticationException{
 return authService.register(addedUser);
 }
}

@PostAuthorize("returnObject.username == principal.username or hasRole('ROLE_ADMIN')")
 @RequestMapping(value = "/",method = RequestMethod.GET)
 public User getUserByUsername(@RequestParam(value="username") String username) {
 return repository.findByUsername(username);
 }