SpringSecurity实战教程（八）Remember-Me实现原理：持久化令牌与安全存储方案

1
@Configuration
2
public class RememberSecurityConfig {
3

4
    // 手动配置用户信息
5
    @Bean
6
    public UserDetailsService users() {
7
        UserDetails user = User.withUsername("user")
8
                .password("{noop}user") // {noop}表示不加密
9
                .roles("USER")
10
                .build();
11

12
        UserDetails admin = User.withUsername("admin")
13
                .password("{noop}admin") // {noop}表示不加密
14
                .roles("ADMIN")
15
                .build();
16

17
        UserDetails anonymous = User.withUsername("anonymous")
18
                .password("{noop}anonymous")
19
                .roles("ANONYMOUS")
20
                .build();
21

22
        return new InMemoryUserDetailsManager(user, admin, anonymous);
23
    }
24

25
    // 配置安全策略
26
    @Bean
27
    SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
28
        http
29
            .authorizeHttpRequests(authorize -> authorize
30
                .requestMatchers("/admin/**").hasRole("ADMIN")
31
                .anyRequest().authenticated()
32
            )
33
            .formLogin(withDefaults())
34
            .logout(withDefaults())
35
            .rememberMe(rememberMe -> rememberMe
36
                .key("mySecretKey") // 服务器端密钥
37
                .tokenValiditySeconds(7 * 24 * 60 * 60) // 7天有效期
38
                .userDetailsService(users()) // 认证用户信息
39
            );
40
        return http.build();
41
    }
42
}

1
@Controller
2
public class DemoRememberController {
3

4
    @GetMapping("/")
5
    public ResponseEntity<Map<String, Object>> index(Authentication authentication) {
6

7
        String username = authentication.getName(); // 用户名
8
        Object principal = authentication.getPrincipal(); // 身份
9

10
        // 获取用户拥有的权限列表
11
        List<String> roles = authentication.getAuthorities().stream()
12
                .map(GrantedAuthority::getAuthority)
13
                .collect(Collectors.toList());
14

15
        // 返回用户信息
16
        return ResponseEntity.ok(Map.of(
17
                "username", username,
18
                "principal", principal,
19
                "roles", roles));
20
    }
21

22
    @GetMapping("/admin/view")
23
    public ResponseEntity<String> admin() {
24
        return ResponseEntity.ok("管理员ADMIN角色访问ok");
25
    }
26
}

1
<dependencies>
2
    <!--使用 HikariCP 连接池-->
3
    <dependency>
4
        <groupId>org.springframework.boot</groupId>
5
        <artifactId>spring-boot-starter-data-jpa</artifactId>
6
    </dependency>
7
    <!-- mysql驱动 -->
8
    <dependency>
9
        <groupId>mysql</groupId>
10
        <artifactId>mysql-connector-java</artifactId>
11
        <version>8.0.30</version>
12
    </dependency>
13
    <!-- mybatis-plus -->
14
    <dependency>
15
        <groupId>com.baomidou</groupId>
16
        <artifactId>mybatis-plus-spring-boot3-starter</artifactId>
17
        <version>3.5.9</version>
18
    </dependency>
19
    <!-- jdk 11+ 引入可选模块 -->
20
    <dependency>
21
        <groupId>com.baomidou</groupId>
22
        <artifactId>mybatis-plus-jsqlparser</artifactId>
23
        <version>3.5.9</version>
24
    </dependency>
25
</dependencies>

1
@Configuration
2
@EnableWebSecurity
3
@RequiredArgsConstructor
4
public class SecurityConfig {
5

6
    // 注入数据源
7
    private final DataSource dataSource;
8

9
    // 手动配置用户信息
10
    @Bean
11
    public UserDetailsService users() {
12
        UserDetails user = User.withUsername("user")
13
                .password("{noop}user") // {noop}表示不加密
14
                .roles("USER")
15
                .build();
16

17
        UserDetails admin = User.withUsername("admin")
18
                .password("{noop}admin") // {noop}表示不加密
19
                .roles("ADMIN")
20
                .build();
21

22
        UserDetails anonymous = User.withUsername("anonymous")
23
                .password("{noop}anonymous")
24
                .roles("ANONYMOUS")
25
                .build();
26

27
        return new InMemoryUserDetailsManager(user, admin, anonymous);
28
    }
29

30
    @Bean
31
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
32
        http
33
            .authorizeHttpRequests(auth -> auth
34
                .requestMatchers("/admin").hasRole("ADMIN")
35
                .anyRequest().authenticated()
36
            )
37
            .formLogin(withDefaults())
38
            .rememberMe(rememberMe -> rememberMe
39
                .key("myPersistentKey")
40
                .tokenRepository(persistentTokenRepository()) // 采用数据库存储
41
                .tokenValiditySeconds(14 * 24 * 60 * 60) // 14天有效期
42
                .userDetailsService(users())
43
            );
44
        return http.build();
45
    }
46

47
    @Bean
48
    public PersistentTokenRepository persistentTokenRepository() {
49
        JdbcTokenRepositoryImpl repo = new JdbcTokenRepositoryImpl();
50
        repo.setDataSource(dataSource);
51
        return repo;
52
    }
53
}

1
public class CustomPersistentTokenRepository extends JdbcTokenRepositoryImpl {
2

3
    @Override
4
    public void createNewToken(PersistentRememberMeToken token) {
5
        String encryptedToken = BCrypt.hashpw(token.getTokenValue(), BCrypt.gensalt());
6
        super.createNewToken(
7
            new PersistentRememberMeToken(
8
                token.getUsername(),
9
                token.getSeries(),
10
                encryptedToken,
11
                token.getDate()
12
            )
13
        );
14
    }
15
}