快捷導(dǎo)航

Spring?Security實(shí)現(xiàn)接口放通的方法詳解

更新時(shí)間：2022年05月20日 11:58:54 作者：北根娃

在用Spring?Security項(xiàng)目開(kāi)發(fā)中，有時(shí)候需要放通某一個(gè)接口時(shí)，我們需要在配置中把接口地址配置上，這樣做有時(shí)候顯得麻煩。本文將通過(guò)一個(gè)注解的方式快速實(shí)現(xiàn)接口放通，感興趣的可以了解一下

在用Spring Security項(xiàng)目開(kāi)發(fā)中，有時(shí)候需要放通某一個(gè)接口時(shí)，我們需要在配置中把接口地址配置上，這樣做有時(shí)候顯得麻煩，而且不夠優(yōu)雅。我們能不能通過(guò)一個(gè)注解的方式，在需要放通的接口上加上該注解，這樣接口就能放通了。答案肯定是可以的啦，今天我們一起來(lái)看看實(shí)現(xiàn)過(guò)程吧。

1.SpringBoot版本

本文基于的Spring Boot的版本是2.6.7

2.實(shí)現(xiàn)思路

新建一個(gè)AnonymousAccess注解，該注解是應(yīng)用于Controller方法上的

新建一個(gè)存放所有請(qǐng)求方式的枚舉類

通過(guò)判斷Controller方法上是否存在該注解

在SecurityConfig上進(jìn)行策略的配置

3.實(shí)現(xiàn)過(guò)程

3.1新建注解

@Inherited
@Documented
@Target({ElementType.METHOD,ElementType.ANNOTATION_TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface AnonymousAccess {
    
}

3.2新建請(qǐng)求枚舉類

該類是存放所有的請(qǐng)求類型的，代碼如下：

@Getter
@AllArgsConstructor
public enum RequestMethodEnum {
    /**
     * 搜尋 @AnonymousGetMapping
     */
    GET("GET"),

    /**
     * 搜尋 @AnonymousPostMapping
     */
    POST("POST"),

    /**
     * 搜尋 @AnonymousPutMapping
     */
    PUT("PUT"),

    /**
     * 搜尋 @AnonymousPatchMapping
     */
    PATCH("PATCH"),

    /**
     * 搜尋 @AnonymousDeleteMapping
     */
    DELETE("DELETE"),

    /**
     * 否則就是所有 Request 接口都放行
     */
    ALL("All");

    /**
     * Request 類型
     */
    private final String type;

    public static RequestMethodEnum find(String type) {
        for (RequestMethodEnum value : RequestMethodEnum.values()) {
            if (value.getType().equals(type)) {
                return value;
            }
        }
        return ALL;
    }
}

3.3判斷Controller方法上是否存在該注解

在SecurityConfig類中定義一個(gè)私有方法getAnonymousUrl，該方法主要作用是判斷controller那些方法加上了AnonymousAccess的注解

    private Map<String, Set<String>> getAnonymousUrl(Map<RequestMappingInfo, HandlerMethod> handlerMethodMap) {
        Map<String, Set<String>> anonymousUrls = new HashMap<>(8);
        Set<String> get = new HashSet<>();
        Set<String> post = new HashSet<>();
        Set<String> put = new HashSet<>();
        Set<String> patch = new HashSet<>();
        Set<String> delete = new HashSet<>();
        Set<String> all = new HashSet<>();
        for (Map.Entry<RequestMappingInfo, HandlerMethod> infoEntry : handlerMethodMap.entrySet()) {

            HandlerMethod handlerMethod = infoEntry.getValue();
            AnonymousAccess anonymousAccess = handlerMethod.getMethodAnnotation(AnonymousAccess.class);
            if (null != anonymousAccess) {
                List<RequestMethod> requestMethods = new ArrayList<>(infoEntry.getKey().getMethodsCondition().getMethods());
                RequestMethodEnum request = RequestMethodEnum.find(requestMethods.size() == 0 ? RequestMethodEnum.ALL.getType() : requestMethods.get(0).name());
                switch (Objects.requireNonNull(request)) {
                    case GET:
                        get.addAll(infoEntry.getKey().getPatternsCondition().getPatterns());
                        break;
                    case POST:
                        post.addAll(infoEntry.getKey().getPatternsCondition().getPatterns());
                        break;
                    case PUT:
                        put.addAll(infoEntry.getKey().getPatternsCondition().getPatterns());
                        break;
                    case PATCH:
                        patch.addAll(infoEntry.getKey().getPatternsCondition().getPatterns());
                        break;
                    case DELETE:
                        delete.addAll(infoEntry.getKey().getPatternsCondition().getPatterns());
                        break;
                    default:
                        all.addAll(infoEntry.getKey().getPatternsCondition().getPatterns());
                        break;
                }
            }
        }
        anonymousUrls.put(RequestMethodEnum.GET.getType(), get);
        anonymousUrls.put(RequestMethodEnum.POST.getType(), post);
        anonymousUrls.put(RequestMethodEnum.PUT.getType(), put);
        anonymousUrls.put(RequestMethodEnum.PATCH.getType(), patch);
        anonymousUrls.put(RequestMethodEnum.DELETE.getType(), delete);
        anonymousUrls.put(RequestMethodEnum.ALL.getType(), all);
        return anonymousUrls;
    }

3.4在SecurityConfig上進(jìn)行策略的配置

通過(guò)一個(gè)SpringUtil工具類獲取到requestMappingHandlerMapping的Bean,然后通過(guò)getAnonymousUrl方法把標(biāo)注AnonymousAccess接口找出來(lái)。最后，通過(guò)antMatchers細(xì)膩化到每個(gè) Request 類型。

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        // 搜尋匿名標(biāo)記 url： @AnonymousAccess
        RequestMappingHandlerMapping requestMappingHandlerMapping = (RequestMappingHandlerMapping) SpringUtil.getBean("requestMappingHandlerMapping");
        Map<RequestMappingInfo, HandlerMethod> handlerMethodMap = requestMappingHandlerMapping.getHandlerMethods();
        // 獲取匿名標(biāo)記
        Map<String, Set<String>> anonymousUrls = getAnonymousUrl(handlerMethodMap);
        httpSecurity
                //禁用CSRF
                .csrf().disable()
                .authorizeRequests()
                // 自定義匿名訪問(wèn)所有url放行：細(xì)膩化到每個(gè) Request 類型
                // GET
                .antMatchers(HttpMethod.GET,anonymousUrls.get(RequestMethodEnum.GET.getType()).toArray(new String[0])).permitAll()
                // POST
                .antMatchers(HttpMethod.POST,anonymousUrls.get(RequestMethodEnum.POST.getType()).toArray(new String[0])).permitAll()
                // PUT
                .antMatchers(HttpMethod.PUT,anonymousUrls.get(RequestMethodEnum.PUT.getType()).toArray(new String[0])).permitAll()
                // PATCH
                .antMatchers(HttpMethod.PATCH,anonymousUrls.get(RequestMethodEnum.PATCH.getType()).toArray(new String[0])).permitAll()
                // DELETE
                .antMatchers(HttpMethod.DELETE,anonymousUrls.get(RequestMethodEnum.DELETE.getType()).toArray(new String[0])).permitAll()
                // 所有類型的接口都放行
                .antMatchers(anonymousUrls.get(RequestMethodEnum.ALL.getType()).toArray(new String[0])).permitAll()
                // 所有請(qǐng)求都需要認(rèn)證
                .anyRequest().authenticated();
        
    }

3.5在Controller方法上應(yīng)用

在Controller上把需要的放通的接口上加上注解，即可不需要認(rèn)證就可以訪問(wèn)了，是不是很方便呢。例如，驗(yàn)證碼不需要認(rèn)證訪問(wèn)的，代碼如下：

    @ApiOperation(value = "獲取驗(yàn)證碼", notes = "獲取驗(yàn)證碼")
    @AnonymousAccess
    @GetMapping("/code")
    public Object getCode(){

        Captcha captcha = loginProperties.getCaptcha();
        String uuid = "code-key-"+IdUtil.simpleUUID();
        //當(dāng)驗(yàn)證碼類型為 arithmetic時(shí)且長(zhǎng)度 >= 2 時(shí)，captcha.text()的結(jié)果有幾率為浮點(diǎn)型
        String captchaValue = captcha.text();
        if(captcha.getCharType()-1 == LoginCodeEnum.ARITHMETIC.ordinal() && captchaValue.contains(".")){
            captchaValue = captchaValue.split("\\.")[0];
        }
        // 保存
        redisUtils.set(uuid,captchaValue,loginProperties.getLoginCode().getExpiration(), TimeUnit.MINUTES);
        // 驗(yàn)證碼信息
        Map<String,Object> imgResult = new HashMap<String,Object>(2){{
            put("img",captcha.toBase64());
            put("uuid",uuid);
        }};
        return imgResult;

    }