SpringSecurity5-教程4-Cookie单点登录

原创已于 2023-03-24 19:54:28 修改 · 636 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#spring

于 2023-03-23 15:03:45 首次发布

spring-security 专栏收录该内容

5 篇文章

订阅专栏

该代码段展示了一个基于Cookie的单点登录（SSO）过滤器，用于从cookie中获取token，解析并设置用户的登录状态。如果cookie存在有效token，它会避免重定向到登录页面。过滤器检查token是否改变，更新用户信息，并使用SpringSecurity进行认证和授权。

/**
 * 从cookie获取 token，解析并设置登录态
 * 当cookie有token时，处理/oauth/authorize将不会再跳入登录页
 */
@Slf4j
@Getter
@Setter
@WebFilter("/*")
public class CookieSsoFilter extends OncePerRequestFilter {
    @Autowired
    private UserService userService;

    @Autowired
    private HttpSession session;

    private SecurityContextRepository securityContextRepository = new HttpSessionSecurityContextRepository();

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        if (request.getCookies() == null) {
            filterChain.doFilter(request, response);
            return;
        }
        String userToken = getUserToken(request);
        if (Strings.isBlank(userToken)) {
            filterChain.doFilter(request, response);
            return;
        }
        boolean tokenNotChanged = userToken.equals(session.getAttribute("usertoken"));
        if (tokenNotChanged) {
            filterChain.doFilter(request, response);
            return;
        }

        // 更新用户
        User user = userService.find(userToken);
        if (user == null) {
            filterChain.doFilter(request, response);
            return;
        }
        session.setAttribute("usertoken", usertoken);
        // 保存认证结果
        saveAuthentication(request, response, user);
        filterChain.doFilter(request, response);
    }

    private void saveAuthentication(HttpServletRequest request, HttpServletResponse response, user user) {
        List<SimpleGrantedAuthority> authorities = Lists.newArrayList();
        authorities.add(new SimpleGrantedAuthority("ROLE_USER")); // /oauth/authorize等接口需要这个权限
        UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(user, user.getPassword(), authorities);
        authentication.setDetails(new WebAuthenticationDetails(request));
        HttpRequestResponseHolder holder = new HttpRequestResponseHolder(request, response);
        SecurityContext securityContext = securityContextRepository.loadContext(holder);
        securityContext.setAuthentication(authentication);
        SecurityContextHolder.setContext(securityContext);
        securityContextRepository.saveContext(securityContext, holder.getRequest(), holder.getResponse());
    }
}

public String getUserToken(HttpServletRequest request) {
        return  Arrays.stream(request.getCookies())
                .filter(c -> c.getName().equals("userToken"))
                .findAny().map(Cookie::getValue).orElse(null);
}