拦截器以及自定义注解的使用

最新推荐文章于 2024-03-28 20:21:34 发布

原创最新推荐文章于 2024-03-28 20:21:34 发布 · 1k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#json #java #restful

java基础专栏收录该内容

7 篇文章

订阅专栏

本文介绍如何在Spring Boot应用中配置UserTokenInterceptor和SecurityInterceptor，实现请求拦截，校验用户权限和Token有效性。涉及路径排除、Token解析与验证，以及@SecurityGrade注解的使用。

1，设置预处理，设置不需要拦截的请求

@Component
public class MyWebConfig implements WebMvcConfigurer {
  private final UserTokenInterceptor userTokenInterceptor;
  private final SecurityInterceptor securityInterceptor;

  public MyWebConfig(
      UserTokenInterceptor userTokenInterceptor, SecurityInterceptor securityInterceptor) {
    this.userTokenInterceptor = userTokenInterceptor;
    this.securityInterceptor = securityInterceptor;
  }

  @Override
  public void addInterceptors(InterceptorRegistry registry) {
    // 定义排除swagger访问的路径配置
    String[] swaggerExcludes =
        new String[] {"/swagger-ui.html", "/swagger-resources/**", "/webjars/**"};
    registry
        .addInterceptor(userTokenInterceptor)
        .addPathPatterns("/**")
        .excludePathPatterns(
            "/user/login", "/static/**", "/*.html", "/*.ico", "/*.json", "/*.png", "/heartbeat/**")
        .excludePathPatterns(swaggerExcludes);
    registry
        .addInterceptor(securityInterceptor)
        .addPathPatterns("/maintain/**", "/user/**")
        .excludePathPatterns("/user/login");
  }
}

2.UserTokenInterceptor ，securityInterceptor分别处理不同的请求拦截，执行不同的拦截逻辑。

2个处理的类请求上可以有交集，2个处理类都执行。

@Component
public class UserTokenInterceptor implements HandlerInterceptor {
  private final EmpInfoService empInfoService;

  public UserTokenInterceptor(EmpInfoService empInfoService) {
    this.empInfoService = empInfoService;
  }

  @Override
  public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
      throws Exception {
    // 校验handler是否是HandlerMethod
    if (!(handler instanceof HandlerMethod)) {
      return true;
    }
    // 从请求头中获取token
    String token = request.getHeader("Authorization");
    /**
     * update:2021/11/30 ShengJieLi
     * 增加逻辑：Authorization的值不为本系统生成的token时，解密Authorization，获取token并验证
     */
    if (StrUtil.isNotEmpty(token)) {
      EmpInfo securityEmployee = empInfoService.queryToken(token);
      if(securityEmployee != null){
        // token有效
        String ref = empInfoService.isRef(token);
        if (StrUtil.isNotBlank(ref)) {
          response.setHeader("Access-Control-Expose-Headers", "token");
          response.addHeader("token", ref);
        }
      }else{
        //Authorization为PBE加密数据
        securityEmployee = empInfoService.analyticQueryToken(token,response);
      }
      if (securityEmployee != null) {
        // token有效
        // 将User对象放入到ThreadLocal中
        UserLocal.set(securityEmployee);
        return true;
      }
      return false;
    }
//    String s = JSONUtil.toJsonStr(ResponseResult.error(ErrorCode.TOKEN_ERROR));
//    response.setContentType("text/html;charset=UTF-8");
//    JSONUtil.toJsonStr(s, response.getWriter());
//    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
    InterceptorExceptionResolver.interceptorError(response,ErrorCode.TOKEN_ERROR);
    //update 结束
    return false;
  }

  @Override
  public void afterCompletion(
      HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)
      throws Exception {
    // 响应结束后刪除對象
    UserLocal.remove();
  }
}

@Component
public class SecurityInterceptor implements HandlerInterceptor {
  @Override
  public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
      throws Exception {
    // 校验handler是否是HandlerMethod
    if (!(handler instanceof HandlerMethod)) {
      return true;
    }
    HandlerMethod method = (HandlerMethod) handler;
    // 判断是否包含@NoAuthorization注解，如果包含，直接放行
    if (method.hasMethodAnnotation(NoAuthorization.class)) {
      return true;
    }
    SecurityGrade methodAnnotation = method.getMethodAnnotation(SecurityGrade.class);
    if (methodAnnotation == null) {
      methodAnnotation = method.getMethod().getDeclaringClass().getAnnotation(SecurityGrade.class);
    }
    // 權限等級 用戶對象
    EmpInfo info = UserLocal.get();
    if (info == null) {
      retError(response);
      return false;
    }

    List<String> value = List.of(methodAnnotation.value());
    // 權限等級
    List<Role> roles = info.getRoles();
    boolean isRelease = false;
    for (Role role : roles) {
      String permission = role.getRolePermission();
      if (value.contains(permission)) {
        isRelease = true;
        break;
      }
    }
    if (isRelease) {
      return true;
    } else {
      retError(response);
      return false;
    }
  }

  private void retError(HttpServletResponse response) throws IOException {
    String s = JSONUtil.toJsonStr(ResponseResult.error(ErrorCode.ROLE_ERROR));
    response.setContentType("text/html;charset=UTF-8");
    JSONUtil.toJsonStr(s, response.getWriter());
  }
}

3.关于注解的使用

@SecurityGrade({"SUPER_ADMIN", "SYSTEM_ADMIN"})
public class SecurityController {
  private final EmpInfoService empInfoService;

  public SecurityController(EmpInfoService empInfoService) {
    this.empInfoService = empInfoService;
  }

  @GetMapping("getUserInformation")
  @ApiOperation("登陸用户信息")
  @NoAuthorization
  public ResponseResult getUserInformation(@ApiIgnore HttpServletResponse response) {
    return empInfoService.getUserInformation(response);
  }
}

method.getMethodAnnotation(SecurityGrade.class) 获得注解信息，methodAnnotation.value()获得注解内容"SUPER_ADMIN", "SYSTEM_ADMIN"。