SpringBoot 1.13 前端用户权限控制

1.13 前端用户权限

在用户登陆成功后将用户信息保存到session中，并在后续的访问过程中进行验证以及有针对用户和功能的权限过滤。

• (1) 用户授权

@ApiOperation(value = "登录接口", notes = "用户登录接口，登录之后才可访问其他接口")
@RequestMapping(value = "/login",method = RequestMethod.POST)
public ResponseData login(UserLoginVo userLoginVo, HttpSession session) {
    String username = userLoginVo.getUsername();
    String password = userLoginVo.getPassword();
    SysUser sysUser = sysUserService.findByKeyword(username);

    if (StringUtils.isBlank(username)) {
        return ResponseData.errorMessage("用户名不能为空");
    } else if (StringUtils.isBlank(password)) {
        return ResponseData.errorMessage("登陆密码不能为空");
    } else if (sysUser == null) {
        return ResponseData.errorMessage("查询不到指定用户");
    } else if (!sysUser.getPassword().equals(MD5Util.encode(password))) {
        return ResponseData.errorMessage("用户名或密码错误");
    } else if (sysUser.getState() != 1) {
        return ResponseData.errorMessage("用户已被冻结，请联系管理员");
    } else {    // LOGIN SUCCESS
        List<SysRole> roles = sysRoleUserService.getRoleListByUserId(sysUser.getId());
        List<SysAcl> acls = sysCoreService.getAclListByUserId(sysUser.getId());
        List<SysAcl> deniedAcls = sysCoreService.getDeniedAclListByUserId(sysUser.getId());
        UserVo userVo = new UserVo();
        BeanUtils.copyProperties(sysUser, userVo);

        userVo.setRoles(roles);
        userVo.setAcls(acls);
        userVo.setDeniedAcls(deniedAcls);

        session.setAttribute("user", userVo);
    }
    Map<String, String> tokenMap = new HashMap<String,String>();
    tokenMap.put("token", session.getId());
    tokenMap.put("userId", sysUser.getId());
    return ResponseData.success(tokenMap);
}

• (2) 安全过滤
  SpringBoot使用过滤器验证当前会话是否已经登陆过，并针对要访问的路径进行权限验证。

package com.zone7.admin.config.filter;

import com.alibaba.fastjson.JSON;
import com.google.common.collect.Sets;
import com.zone7.admin.commons.response.ResponseCode;
import com.zone7.admin.commons.response.ResponseData;
import com.zone7.admin.sys.common.RequestHolder;
import com.zone7.admin.sys.pojo.SysAcl;
import com.zone7.admin.sys.vo.UserVo;

import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.List;
import java.util.Set;

/**
 * RequestFilter
 * 请求过滤器
 * 安全认证
 * @author: zone7
 * @time: 2019.02.19
 */
@WebFilter(filterName = "RequestFilter", urlPatterns = "/*")
public class RequestFilter implements Filter {

    private static Set<String> URL_WHITE_LIST = Sets.newHashSet();

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        //忽略不过旅的路径
        URL_WHITE_LIST.add("/unauth");
        URL_WHITE_LIST.add("/login");
        URL_WHITE_LIST.add("/static");
        URL_WHITE_LIST.add("/actuator");
    }

    private boolean isWhiteUrl(String requestUrl){
        if (URL_WHITE_LIST.contains(requestUrl)){
            return true;
        }
        for(String str:URL_WHITE_LIST){

            if(requestUrl.startsWith(str)){
                return true;
            }

        }

        return false;
    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        HttpServletResponse response = (HttpServletResponse) servletResponse;
        String requestUrl = request.getRequestURI();
        if (isWhiteUrl(requestUrl)) {
            filterChain.doFilter(servletRequest, servletResponse);
            return;
        }
        UserVo userVo = (UserVo) request.getSession().getAttribute("user");
        if (userVo == null) {
            request.getRequestDispatcher("/unauth").forward(request, response);
            return;
        }

        RequestHolder.add(userVo);
        RequestHolder.add(request);

        //如果有配置按钮权限，就验证，没有配置表示可以使用
        //DeniedAcls为禁用的权限列表
        List<SysAcl> acls = userVo.getDeniedAcls();
        boolean hasPower=true;
        for(SysAcl acl:acls){
            if(acl.getUrl().equals(requestUrl) || ("/"+acl.getUrl()).equals(requestUrl)){
                hasPower = false;
                break;
            }
        }

        if(!hasPower){
            ResponseData res = ResponseData.error(ResponseCode.ERROR_LOGIN_NOAUTH_ACL);
            String json = JSON.toJSONString(res);
            response.setCharacterEncoding("UTF-8");
            response.setHeader("Content-type","application/json");
            response.getWriter().println(json);
            response.getWriter().flush();
            return;

        }

        filterChain.doFilter(servletRequest, servletResponse);
    }

    @Override
    public void destroy() {

    }
}