JoyLau's Blog

@Override
   protected void configure(HttpSecurity http) throws Exception {
       http
               .sessionManagement()
               .invalidSessionStrategy(new InvalidSessionStrategyImpl())
               .maximumSessions(-1).expiredSessionStrategy(expiredSessionStrategy())//配置并发登录，-1表示不限制
               .sessionRegistry(sessionRegistry());
   }

public class ExpiredSessionStrategyImpl implements SessionInformationExpiredStrategy {

    @Override
    public void onExpiredSessionDetected(SessionInformationExpiredEvent event) throws IOException {
        event.getResponse().sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED,
                JSONObject.toJSONString(MessageBody.failure(405,"not login or login has been expired")));
    }
}

protected InterceptorStatusToken beforeInvocation(Object object) {
		Assert.notNull(object, "Object was null");
		final boolean debug = logger.isDebugEnabled();

		if (!getSecureObjectClass().isAssignableFrom(object.getClass())) {
			throw new IllegalArgumentException(
					"Security invocation attempted for object "
							+ object.getClass().getName()
							+ " but AbstractSecurityInterceptor only configured to support secure objects of type: "
							+ getSecureObjectClass());
		}

		Collection<ConfigAttribute> attributes = this.obtainSecurityMetadataSource()
				.getAttributes(object);

		if (attributes == null || attributes.isEmpty()) {
			if (rejectPublicInvocations) {
				throw new IllegalArgumentException(
						"Secure object invocation "
								+ object
								+ " was denied as public invocations are not allowed via this interceptor. "
								+ "This indicates a configuration error because the "
								+ "rejectPublicInvocations property is set to 'true'");
			}

			if (debug) {
				logger.debug("Public object - authentication not attempted");
			}

			publishEvent(new PublicInvocationEvent(object));

			return null; // no further work post-invocation
		}

		if (debug) {
			logger.debug("Secure object: " + object + "; Attributes: " + attributes);
		}

		if (SecurityContextHolder.getContext().getAuthentication() == null) {
			credentialsNotFound(messages.getMessage(
					"AbstractSecurityInterceptor.authenticationNotFound",
					"An Authentication object was not found in the SecurityContext"),
					object, attributes);
		}

		Authentication authenticated = authenticateIfRequired();

		// Attempt authorization
		try {
			this.accessDecisionManager.decide(authenticated, object, attributes);
		}
		catch (AccessDeniedException accessDeniedException) {
			publishEvent(new AuthorizationFailureEvent(object, attributes, authenticated,
					accessDeniedException));

			throw accessDeniedException;
		}

		if (debug) {
			logger.debug("Authorization successful");
		}

		if (publishAuthorizationSuccess) {
			publishEvent(new AuthorizedEvent(object, attributes, authenticated));
		}

		// Attempt to run as a different user
		Authentication runAs = this.runAsManager.buildRunAs(authenticated, object,
				attributes);

		if (runAs == null) {
			if (debug) {
				logger.debug("RunAsManager did not change Authentication object");
			}

			// no further work post-invocation
			return new InterceptorStatusToken(SecurityContextHolder.getContext(), false,
					attributes, object);
		}
		else {
			if (debug) {
				logger.debug("Switching to RunAs Authentication: " + runAs);
			}

			SecurityContext origCtx = SecurityContextHolder.getContext();
			SecurityContextHolder.setContext(SecurityContextHolder.createEmptyContext());
			SecurityContextHolder.getContext().setAuthentication(runAs);

			// need to revert to token.Authenticated post-invocation
			return new InterceptorStatusToken(origCtx, true, attributes, object);
		}
	}

private void handleSpringSecurityException(HttpServletRequest request,
			HttpServletResponse response, FilterChain chain, RuntimeException exception)
			throws IOException, ServletException {
		if (exception instanceof AuthenticationException) {
			logger.debug(
					"Authentication exception occurred; redirecting to authentication entry point",
					exception);

			sendStartAuthentication(request, response, chain,
					(AuthenticationException) exception);
		}
		else if (exception instanceof AccessDeniedException) {
			Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
			if (authenticationTrustResolver.isAnonymous(authentication) || authenticationTrustResolver.isRememberMe(authentication)) {
				logger.debug(
						"Access is denied (user is " + (authenticationTrustResolver.isAnonymous(authentication) ? "anonymous" : "not fully authenticated") + "); redirecting to authentication entry point",
						exception);

				sendStartAuthentication(
						request,
						response,
						chain,
						new InsufficientAuthenticationException(
								"Full authentication is required to access this resource"));
			}
			else {
				logger.debug(
						"Access is denied (user is not anonymous); delegating to AccessDeniedHandler",
						exception);

				accessDeniedHandler.handle(request, response,
						(AccessDeniedException) exception);
			}
		}
	}

protected void sendStartAuthentication(HttpServletRequest request,
			HttpServletResponse response, FilterChain chain,
			AuthenticationException reason) throws ServletException, IOException {
		// SEC-112: Clear the SecurityContextHolder's Authentication, as the
		// existing Authentication is no longer considered valid
		SecurityContextHolder.getContext().setAuthentication(null);
		requestCache.saveRequest(request, response);
		logger.debug("Calling Authentication entry point.");
		authenticationEntryPoint.commence(request, response, reason);
	}

public void commence(HttpServletRequest request, HttpServletResponse response,
			AuthenticationException authException) throws IOException, ServletException {

		String redirectUrl = null;

		if (useForward) {

			if (forceHttps && "http".equals(request.getScheme())) {
				// First redirect the current request to HTTPS.
				// When that request is received, the forward to the login page will be
				// used.
				redirectUrl = buildHttpsRedirectUrlForRequest(request);
			}

			if (redirectUrl == null) {
				String loginForm = determineUrlToUseForThisRequest(request, response,
						authException);

				if (logger.isDebugEnabled()) {
					logger.debug("Server side forward to: " + loginForm);
				}

				RequestDispatcher dispatcher = request.getRequestDispatcher(loginForm);

				dispatcher.forward(request, response);

				return;
			}
		}
		else {
			// redirect to login page. Use https if forceHttps true

			redirectUrl = buildRedirectUrlToLoginPage(request, response, authException);

		}

		redirectStrategy.sendRedirect(request, response, redirectUrl);
	}

@Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .sessionManagement()
                .invalidSessionStrategy(new InvalidSessionStrategyImpl())
                .maximumSessions(-1).expiredSessionStrategy(expiredSessionStrategy())//配置并发登录，-1表示不限制
                .sessionRegistry(sessionRegistry())
                .and()
                .and()
                .exceptionHandling()
                .authenticationEntryPoint(new UnauthenticatedEntryPoint())
                .accessDeniedHandler(new AuthorizationFailure());
    }

public class UnauthenticatedEntryPoint implements AuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException {
        if (!response.isCommitted()) {
            response.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED,"未认证的用户:" + authException.getMessage());
        }
    }
}

@EqualsAndHashCode(callSuper = true)
@Data
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
@ConfigurationProperties(prefix = "spring.security.ignore")
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    private List<String[]> marchers;

    @Bean
    public UserService userService(){
        return new UserService();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .anonymous().disable()
                .csrf().disable()
                .authorizeRequests()
//                .requestMatchers(CorsUtils::isPreFlightRequest).permitAll() //解决PreFlight请求问题
                .anyRequest().authenticated()//其他请求必须授权后访问
                .and()
                .formLogin()
//                .loginPage("/login")
                .loginProcessingUrl("/login")
                .successHandler(authenticationSuccessHandler())
                .failureHandler(authenticationFailureHandler())
                .permitAll()//登录请求可以直接访问
                .and()
                .logout()
                .invalidateHttpSession(true)
                .deleteCookies("JSESSIONID")
                .logoutSuccessHandler(new LogoutSuccess())
                .permitAll()//注销请求可直接访问
                .and()
                .sessionManagement()
                .invalidSessionStrategy(new InvalidSessionStrategyImpl())
                .maximumSessions(-1).expiredSessionStrategy(expiredSessionStrategy())//配置并发登录，-1表示不限制
                .sessionRegistry(sessionRegistry())
                .and()
                .and()
                .exceptionHandling()
                .authenticationEntryPoint(new UnauthenticatedEntryPoint())
                .accessDeniedHandler(new AuthorizationFailure())
                .and()
                .addFilterBefore(new AuthorizationFilter(new AuthorizationMetadataSource(), new
                AuthorizationAccessDecisionManager()), FilterSecurityInterceptor.class);

    }

    @Override
    public void configure(AuthenticationManagerBuilder auth) {
        auth.authenticationProvider(authenticationProvider());
    }

    @Bean
    public SessionRegistry sessionRegistry(){
        return new SessionRegistryImpl();
    }

    @Bean
    public ExpiredSessionStrategyImpl expiredSessionStrategy(){
        return new ExpiredSessionStrategyImpl();
    }

    @Bean
    public BCryptPasswordEncoder passwordEncoder() {
        return SecurityUtils.getPasswordEncoder();
    }

    @Override
    public void configure(WebSecurity web) {
        for (String[] marcher : marchers) {
            web.ignoring().antMatchers(marcher);
        }
    }

    @Bean
    public DaoAuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        /*不将UserNotFoundExceptions转换为BadCredentialsException*/
        provider.setHideUserNotFoundExceptions(false);
        provider.setUserDetailsService(userService());
        provider.setPasswordEncoder(passwordEncoder());
        return provider;
    }

    @Bean
    public AuthenticationSuccess authenticationSuccessHandler(){
        return new AuthenticationSuccess();
    }

    @Bean
    public AuthenticationFailureHandler authenticationFailureHandler(){
        return new AuthenticationFailure();
    }
}

public class UserService implements UserDetailsService {
    @Autowired
    private WebSecurityConfig securityConfig;

    @Autowired
    private SysUserMapper userMapper;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        if (StringUtils.isEmpty(username)) {
            throw new UsernameNotFoundException("用户名不能为空!");
        }
        SysUser user = new SysUser();
        user.setLoginName(username);
        SysUser queryUser = userMapper.selectOne(user);
        if (null == queryUser) {
            throw new UsernameNotFoundException("用户  " + username + " 不存在!");
        }
        if (!queryUser.getPermissionIpList().contains("0.0.0.0") && !queryUser.getPermissionIpList().contains
                (SecurityUtils.getRemoteAddress())) {
            throw new InvalidIpAddrException("登录 IP 地址不合法");
        }

        return new SecurityUser(queryUser);
    }

    /**
     * 重新授权
     */
    public void reAuthorization(){
        SecurityUser user = SecurityUtils.currentUser();
        assert user != null;
        String username = user.getUsername();
        user.setRoles(userMapper.findRolesByName(username));
        user.setMenus(userMapper.findMenusByName(username));
        user.setFunctions(userMapper.findFunctionsByName(username));

        List<GrantedAuthority> authorities = new ArrayList<>();
        for (Function function : user.getFunctions()) {
            for (String url : function.getFunctionUrl().split(",")) {
                authorities.add(new SimpleGrantedAuthority(url));
            }
        }
        user.setAuthorities(authorities.stream().distinct().collect(Collectors.toList()));
        // 得到当前的认证信息
        Authentication auth = SecurityUtils.getAuthentication();
        // 生成新的认证信息
        Authentication newAuth = new UsernamePasswordAuthenticationToken(auth.getPrincipal(), auth.getCredentials(), authorities);
        // 重置认证信息
        SecurityContextHolder.getContext().setAuthentication(newAuth);

    }


    /**
     * 根据用户名 将该用户登录的所有账户踢下线
     * @param userNames userNames
     */
    public void kickOutUser(String... userNames) {
        SessionRegistry sessionRegistry = securityConfig.sessionRegistry();
        for (Object o : sessionRegistry.getAllPrincipals()) {
            SecurityUser user = (SecurityUser) o;
            for (String username : userNames) {
                if (user.getLoginName().equals(username)) {
                    for (SessionInformation sessionInformation : sessionRegistry.getAllSessions(user, false)) {
                        sessionInformation.expireNow();
                    }
                }
            }
        }
    }
}

@Data
public class SecurityUser extends SysUser implements UserDetails{

    /*角色*/
    private List<SysRole> roles;

    /*菜单*/
    private List<Menu> menus;

    /*功能权限*/
    private List<Function> functions;

    private Collection<? extends GrantedAuthority> authorities;

    SecurityUser(SysUser user) {
        this.setUserId(user.getUserId());
        this.setGlbm(user.getGlbm());
        this.setXh(user.getXh());
        this.setLoginName(user.getLoginName());
        this.setLoginPassword(user.getLoginPassword());
        this.setPermissionIpList(user.getPermissionIpList());
        this.setLatestLoginTime(user.getLatestLoginTime());
        this.setTotalLoginCounts(user.getTotalLoginCounts());
        this.setName(user.getName());
        this.setCreateTime(user.getCreateTime());
        this.setUpdateTime(user.getUpdateTime());
    }


    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return authorities;
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }

    @Override
    public String getPassword() {
        return super.getLoginPassword();
    }

    @Override
    public String getUsername() {
        return super.getLoginName();
    }

    @Override
    public int hashCode() {
        return this.getLoginName().hashCode();
    }

    @Override
    public boolean equals(Object obj) {
        return obj instanceof SecurityUser && ((SecurityUser) obj).getLoginName().equals(this.getLoginName());
    }
}

public class AuthorizationFilter extends AbstractSecurityInterceptor implements Filter {

    private AuthorizationMetadataSource metadataSource;

    public AuthorizationFilter(AuthorizationMetadataSource metadataSource, AuthorizationAccessDecisionManager
            accessDecisionManager) {
        this.metadataSource = metadataSource;
        this.setAccessDecisionManager(accessDecisionManager);
    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
            throws IOException, ServletException {
        FilterInvocation fi = new FilterInvocation(servletRequest, servletResponse, filterChain);
        invoke(fi);
    }

    private void invoke(FilterInvocation fi) throws IOException, ServletException {
        InterceptorStatusToken token = super.beforeInvocation(fi);
        try {
            fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
        } finally {
            super.afterInvocation(token, null);
        }
    }


    @Override
    public Class<?> getSecureObjectClass() {
        return FilterInvocation.class;
    }

    @Override
    public SecurityMetadataSource obtainSecurityMetadataSource() {
        return metadataSource;
    }

    @Override
    public void destroy() {
    }

    @Override
    public void init(FilterConfig filterConfig) {
    }
}

public class AuthorizationAccessDecisionManager implements AccessDecisionManager {

    /**
     * 认证用户是否具有权限访问该url地址
     */
    @Override
    public void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes)
            throws AccessDeniedException, InsufficientAuthenticationException {
        HttpServletRequest request = ((FilterInvocation) object).getRequest();
        String url = ((FilterInvocation) object).getRequestUrl();
        for (GrantedAuthority grantedAuthority : authentication.getAuthorities()) {
            SimpleGrantedAuthority authority = (SimpleGrantedAuthority) grantedAuthority;
            if (matches(authority.getAuthority(), request)) {
                return;
            }
        }
        throw new AccessDeniedException("uri: " + url + ",无权限访问！");
    }

    /**
     * 当前AccessDecisionManager是否支持对应的ConfigAttribute
     */
    @Override
    public boolean supports(ConfigAttribute attribute) {
        return true;
    }

    /**
     * 当前AccessDecisionManager是否支持对应的受保护对象类型
     */
    @Override
    public boolean supports(Class<?> clazz) {
        return true;
    }

    private boolean matches(String url, HttpServletRequest request) {
        AntPathRequestMatcher matcher = new AntPathRequestMatcher(url);
        return matcher.matches(request);
    }
}

public class AuthorizationMetadataSource implements FilterInvocationSecurityMetadataSource {

    /**
     * 加载 请求的url资源所需的权限
     * @param object object
     * @return Collection
     * @throws IllegalArgumentException Exception
     */
    @Override
    public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
        String url = ((FilterInvocation) object).getRequestUrl();
        Collection<ConfigAttribute> configAttributes = new ArrayList<>();
        configAttributes.add(new SecurityConfig(url));
        return configAttributes;
    }

    /**
     * 会在启动时加载所有 ConfigAttribute 集合
     * @return Collection
     */
    @Override
    public Collection<ConfigAttribute> getAllConfigAttributes() {
        return null;
    }

    @Override
    public boolean supports(Class<?> clazz) {
        return true;
    }
}

public class SecurityUtils {

    public static Authentication getAuthentication(){
        return SecurityContextHolder.getContext().getAuthentication();
    }

    /**
     * 用户是否登录
     * @return boolean
     */
    public static boolean isAuthenticated(){
        return getAuthentication() != null || !(getAuthentication() instanceof AnonymousAuthenticationToken);
    }

    /**
     * 获取当前用户
     * @return user
     */
    public static SecurityUser currentUser(){
        if (isAuthenticated()) {
            return (SecurityUser) getAuthentication().getPrincipal();
        }
        return null;
    }

    /**
     * 获取 webAuthenticationDetails
     */
    private static WebAuthenticationDetails webAuthenticationDetails(){
        return (WebAuthenticationDetails)getAuthentication().getDetails();
    }

    /**
     * 获取session id
     */
    public static String getSessionId(){
        return webAuthenticationDetails().getSessionId();
    }

    /**
     * 获取远程访问地址
     */
    public static String getRemoteAddress(){
        return webAuthenticationDetails().getRemoteAddress();
    }

    /**
     * 获取密码编译器
     * @return BCryptPasswordEncoder
     */
    public static BCryptPasswordEncoder getPasswordEncoder(){
        return new BCryptPasswordEncoder(4);
    }

    /**
     * 根据明文加密 返回密文
     * @param rawPassword 明文
     * @return 密文
     */
    public static String createPassword(String rawPassword){
        return getPasswordEncoder().encode(rawPassword.trim());
    }

    /**
     * 传入明文和密文 检查是否匹配
     * @param rawPassword 明文
     * @param encodedPassword 密文
     * @return boolean
     */
    public static boolean isMatching(String rawPassword,String encodedPassword){
        return getPasswordEncoder().matches(rawPassword,encodedPassword);
    }

}

Example example = new Example(XXX.class);

/**
 * 带exists参数的构造方法，默认notNull为false，允许为空
 *
 * @param entityClass
 * @param exists      - true时，如果字段不存在就抛出异常，false时，如果不存在就不使用该字段的条件
 */
public Example(Class<?> entityClass, boolean exists) {
   ...
}
    
/**
 * 带exists参数的构造方法
 *
 * @param entityClass
 * @param exists      - true时，如果字段不存在就抛出异常，false时，如果不存在就不使用该字段的条件
 * @param notNull     - true时，如果值为空，就会抛出异常，false时，如果为空就不使用该字段的条件
 */
public Example(Class<?> entityClass, boolean exists, boolean notNull) {
   ...
}

Example example = new Example(XXX.class);
example.createCriteria().andGreaterThan("id", 100).andLessThan("id",151);
example.or().andLessThan("id", 41);
List<XXX> list = mapper.selectByExample(example);

Example example = new Example(XXX.class);
example.createCriteria().andCondition("id > 100 and id <151 or id < 41");

// andCondition() 方法可以叠加使用，像这样
example.createCriteria().andCondition("id > 100 and id <151").orCondition("id <41");

// 在baseMapper 里封装一个接口
PageInfo selectPageByExample(int pageNum, int pageSize, Object example);

//这样实现上面的接口
@Override
public PageInfo selectPageByExample(int pageNum, int pageSize, Object example) {
    PageHelper.startPage(pageNum, pageSize);
    List<T> list = selectByExample(example);
    return new PageInfo<>(list);
}

//java 8 的lamda 用法
@Override
public PageInfo selectPageByExample(int pageNum, int pageSize, Object example) {
    return PageHelper.startPage(pageNum, pageSize).doSelectPageInfo(()->baseMapper.selectByExample(example));
}