redis+springsecurity+mybtais-plus+JWT

01 引入依賴

       <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-web</artifactId></dependency><dependency><groupId>com.mysql</groupId><artifactId>mysql-connector-j</artifactId><scope>runtime</scope></dependency>
<!--lombok依賴--><dependency><groupId>org.projectlombok</groupId><artifactId>lombok</artifactId><optional>true</optional></dependency><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-test</artifactId><scope>test</scope></dependency><!--    使用knife4j依賴 --><dependency><groupId>com.github.xiaoymin</groupId><artifactId>knife4j-spring-boot-starter</artifactId><version>2.0.9</version></dependency><!-- jwt依賴--><dependency><groupId>com.auth0</groupId><artifactId>java-jwt</artifactId><version>3.10.3</version></dependency><!--redis依賴--><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-data-redis</artifactId></dependency><!--mybatisplus依賴--><dependency><groupId>com.baomidou</groupId><artifactId>mybatis-plus-boot-starter</artifactId><version>3.5.1</version></dependency>
<!--        spring-security依賴--><dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-test</artifactId><scope>test</scope></dependency><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-security</artifactId></dependency>

02 配置系統文件

#配置redis的端口和mybatis—plus的數據源，swagger的配置信息
spring:redis:host: 127.0.0.1port: 6379datasource:driver-class-name: com.mysql.cj.jdbc.Driverurl: jdbc:mysql://localhost:3306/text012?userSSL=false;serverTimezone=Asia/Shanghaiusername: rootpassword: 1234mvc:pathmatch:matching-strategy: ant_path_matcher
#開啟駝峰轉化，mapper的xml文件夾掃描      
mybatis-plus:config-locations: classpath:mapper/*.xmlconfiguration:log-impl: org.apache.ibatis.logging.stdout.StdOutImpl

03 配置啟動類

@SpringBootApplication
@MapperScan("com.example.demo.mapper")
public class DemoApplication {public static void main(String[] args) {SpringApplication.run(DemoApplication.class, args);}
}

04 重寫UserDetailsService接口

@Service
public class UserDetailsServiceImpl implements UserDetailsService {//這是mybatis-plus所實現的數據操作層，不使用mybatis-plus就不寫@Autowiredprivate MsUserServiceImp msUserServiceImp;@Overridepublic UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {//使用mybatis-plus,獲取到賬號密碼數據LambdaQueryWrapper<MsUser> qw=new LambdaQueryWrapper<>();qw.eq(MsUser::getUsername,username);MsUser user = msUserServiceImp.getOne(qw);//下一步就是重寫UserDetails接口LoginUser loginUser = new LoginUser();loginUser.setMsUser(user);return loginUser;}
}

05 重寫UserDetails接口

//前三個是lombok的模塊化配置，第四個是redis的序列化配置
@Data
@NoArgsConstructor
@AllArgsConstructor
@JsonIgnoreProperties(ignoreUnknown = true)
public class LoginUser implements UserDetails {//首先要寫一個與數據庫內表對應的實體類private MsUser msUser;//重寫審核方法@Overridepublic Collection<? extends GrantedAuthority> getAuthorities() {return null;}//返回實體類MsUser中Password（密碼）和Username（賬號名對應的屬性），將判斷方法的返回值都改為true@Overridepublic String getPassword() {return msUser.getPassword();}@Overridepublic String getUsername() {return msUser.getUsername();}@Overridepublic boolean isAccountNonExpired() {return true;}@Overridepublic boolean isAccountNonLocked() {return true;}@Overridepublic boolean isCredentialsNonExpired() {return true;}@Overridepublic boolean isEnabled() {return true;}
}

四個關鍵點

1.UserDetails接口的實現類需要一個實體類屬性（類似MsUser）

2.getPassword和getUsername方法需要返回實體類（MsUser）中代表賬號名和密碼的屬性的值

3.五個判斷賬號使用的情況的方法需要返回true，不然無法正常使用

06 重寫springSecurity的配置類

• 實現WebSecurityConfigurerAdapter接口

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {//需要自定義JWT過濾器@Autowiredprivate JWTFilter jwtFilter;//設置密碼的加密方式@Beanpublic PasswordEncoder passwordEncoder(){return new BCryptPasswordEncoder();}//關閉原有的登錄接口和頁面，后端只完成接口即可，讓前端去畫登錄界面@Overrideprotected void configure(HttpSecurity http) throws Exception {http// 將自己定義的過濾器加到UsernamePasswordAuthenticationFilter之前.addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);http//關閉csrf.csrf().disable()//不通過Session獲取SecurityContext.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and().authorizeRequests()// 對于登錄接口 允許匿名訪問.antMatchers("/msUser/login").anonymous()// 除上面外的所有請求全部需要鑒權認證.anyRequest().authenticated();}//順便設置JWT的token驗證方式，這里我沒重寫，使用springsecurity原有的實現方式@Override@Beanpublic AuthenticationManager authenticationManagerBean() throws Exception {return super.authenticationManagerBean();}
}

五個關鍵點

1.自定義JWT過濾器

2.設置密碼的加密方式

3.addFilterBefore，把自定義的JWT的過濾器加到UsernamePasswordAuthenticationFilter過濾器前

4.關閉csrf（原有的登錄界面和接口）

5.設置JWT的token驗證方式

07 寫登錄實現類

• 我這里采用mybatis-plus實現從數據庫獲取數據，其他方式也可

@Service
public class MsUserServiceImp extends ServiceImpl<MsUserMapper, MsUser>implements IMsUserService {//注入AuthenticationManager對象@Autowiredprivate AuthenticationManager authenticationManager;//寫一個用于使用Redis工具類@Autowiredprivate RedisUtil redisUtil;//AjaxResult是我用于設置返回的工具類，不重要@Overridepublic AjaxResult login(MsUser user) {//token的驗證UsernamePasswordAuthenticationToken token=new UsernamePasswordAuthenticationToken(user.getUsername(),user.getPassword());Authentication authentication=authenticationManager.authenticate(token);if (Objects.isNull(authentication)){throw new RuntimeException("認證失敗");}//合格說明通過LoginUser loginUser=(LoginUser) authentication.getPrincipal();//使用JWT創建token，這里我封裝了一個JWT的工具類String jwt= JWTUtil.createToken(loginUser.getMsUser());try {redisUtil.setCacheObject("user:"+loginUser.getMsUser().getUserId(),loginUser);}catch (Exception e){e.printStackTrace();}return AjaxResult.success("登錄成功",jwt);}
}

三個關鍵點

1.調用springsecurity的工具類驗證前端參數

2.使用JWT工具類生成token

3.redis的數據儲存

08 測試

@RestController
@RequestMapping("/msUser")
public class MsUserController {@Autowiredprivate MsUserServiceImp userServiceImp;@PostMapping("/login")public AjaxResult<String> login(MsUser user) {System.out.println(user);return userServiceImp.login(user);}
}