《Spring Security3》第三章第三部分翻译上（Remember me安全吗？）

最新推荐文章于 2024-10-07 21:24:38 发布

neveremind158

最新推荐文章于 2024-10-07 21:24:38 发布

阅读量645

点赞数

CC 4.0 BY-SA版权

本文链接：https://blog.youkuaiyun.com/neveremind158/article/details/26608905

本文介绍了一种在SpringSecurity中使用自定义IP地址绑定的RememberMe服务实现方式，通过扩展TokenBasedRememberMeServices来增强安全性，确保记住登录状态的同时验证用户的IP地址。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

《Spring Security3》第三章第三 部分翻译下（Remember me 安全吗？）

<intercept-url pattern="/account/*.do"
   access="hasRole('ROLE_USER') and fullyAuthenticated"/>
<intercept-url pattern="/*" access="hasRole('ROLE_USER')"/>

public class IPTokenBasedRememberMeServices extends
    TokenBasedRememberMeServices {

private static final ThreadLocal<HttpServletRequest> requestHolder = 
new ThreadLocal<HttpServletRequest>();
public HttpServletRequest getContext() {
    return requestHolder.get();
}
public void setContext(HttpServletRequest context) {
    requestHolder.set(context);
}

protected String getUserIPAddress(HttpServletRequest request) {
  return request.getRemoteAddr();
}

@Override
public void onLoginSuccess(HttpServletRequest request,
    HttpServletResponse response,
    Authentication successfulAuthentication) {
  try
  {
    setContext(request);
    super.onLoginSuccess(request, response, successfulAuthentication
  }
  finally
  {    setContext(null);
  }
}

@Override
protected String makeTokenSignature(long tokenExpiryTime, 
    String username, String password) {
    return DigestUtils.md5DigestAsHex((username + ":" + 
tokenExpiryTime + ":" + password + ":" + getKey() + ":" + getUserIPAdd
ress(getContext())).getBytes()); 
}

@Override
protected void setCookie(String[] tokens, int maxAge,
  HttpServletRequest request, HttpServletResponse response) {
  // append the IP adddress to the cookie
  String[] tokensWithIPAddress = 
      Arrays.copyOf(tokens, tokens.length+1);
  tokensWithIPAddress[tokensWithIPAddress.length-1] = 
      getUserIPAddress(request);
  super.setCookie(tokensWithIPAddress, maxAge, 
      request, response);
}

@Override
protected UserDetails processAutoLoginCookie(
  String[] cookieTokens,
  HttpServletRequest request, HttpServletResponse response) 
{
  try
  {
    setContext(request);
  // take off the last token
    String ipAddressToken = cookieTokens[cookieTokens.length-1];
    if(!getUserIPAddress(request).equals(ipAddressToken))
    {
          throw new InvalidCookieException("Cookie IP Address did not 
contain a matching IP (contained '" + ipAddressToken + "')");
    }
      
    return super.processAutoLoginCookie(Arrays.copyOf(cookieTokens, 
cookieTokens.length-1), request, response);
  }
  finally
  {
    setContext(null);
  }
}

<bean class="com.packtpub.springsecurity.security.IPTokenBasedRememberMeServices" id="ipTokenBasedRememberMeServicesBean">
  <property name="key"><value>jbcpPetStore</value></property>
  <property name="userDetailsService" ref="userService"/>
</bean>

<remember-me key="jbcpPetStore" 
   services-ref="ipTokenBasedRememberMeServicesBean"/>

<user-service  id="userService">

<bean class="com.packtpub.springsecurity.web.custom.
IPTokenBasedRememberMeServices" id="ipTokenBasedRememberMeServicesBean">
<property name="key"><value>jbcpPetStore</value></property>
  <property name="userDetailsService" ref="userService"/>
  <property name="parameter" value="_remember_me"/>
  <property name="cookieName" value="REMEMBER_ME"/>
</bean>

1 楼 tywo45 2012-07-03

这个适用于spring security3.1.0吗？好像不适用。

2 楼 tywo45 2012-07-03

适用，刚才我有个setCookie方法没有copy进去。

详细请点击：http://www.verydemo.com/demo_c143_i13501.html