com.yishuifengxiao.common.security.autoconfigure

Class HttpSecurityAutoConfiguration

java.lang.Object

com.yishuifengxiao.common.security.autoconfigure.HttpSecurityAutoConfiguration

@Configuration
 @ConditionalOnBean(value=AbstractSecurityConfig.class)
 @ConditionalOnClass(value={org.springframework.security.authentication.DefaultAuthenticationEventPublisher.class,org.springframework.security.config.annotation.web.configuration.EnableWebSecurity.class,org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.class,AbstractSecurityConfig.class})
 @ConditionalOnProperty(prefix="yishuifengxiao.security",
                       name="enable",
                       havingValue="true",
                       matchIfMissing=true)
public class HttpSecurityAutoConfiguration
extends Object

配置系统中的资源授权拦截器HttpSecurityInterceptor

功能如下： 1 配置需要拦截哪些资源 2 配置异常处理方式

Since:

1.0.0

Version:

1.0.0

Author:

yishui

Constructor Summary

Constructors

Constructor and Description
HttpSecurityAutoConfiguration()

Method Summary

Modifier and Type	Method and Description
HttpSecurityInterceptor	authorizeResourceInterceptor(PropertyResource propertyResource) 配置需要拦截哪些资源
WebSecurityProvider	firewallWebSecurityProvider() 默认实现的HttpFirewall，主要是解决路径里包含 // 路径报错的问题
WebSecurityProvider	ignoreResourceProvider(SecurityProperties securityProperties) 忽视资源授权器
SecurityTokenExtractor	securityTokenExtractor()
HttpSecurityInterceptor	smsLoginInterceptor(org.springframework.security.web.authentication.AuthenticationSuccessHandler authenticationFailureHandler, org.springframework.security.web.authentication.AuthenticationFailureHandler authenticationSuccessHandler, SmsUserDetailsService smsUserDetailsService, SecurityProperties securityProperties) 注入短信登录配置
TokenBuilder	tokenBuilder(TokenHolder tokenHolder) 注入一个TokenBuilder
TokenHolder	tokenHolder() 注入一个基于内存的token存取工具
SecurityRequestFilter	userAuthServiceFilter(PropertyResource propertyResource, HandlerProcessor handlerProcessor, SecurityTokenExtractor securityTokenExtractor, SecurityHelper securityHelper)
SecurityRequestFilter	usernamePasswordAuthFilter(HandlerProcessor handlerProcessor, SecurityHelper securityHelper, PropertyResource propertyResource, SecurityExtractor securityExtractor)
SecurityRequestFilter	validateCodeFilter(CodeProcessor codeProcessor, SecurityProperties securityProperties, HandlerProcessor handlerProcessor) 注入一个验证码过滤器

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

HttpSecurityAutoConfiguration

public HttpSecurityAutoConfiguration()

Method Detail

tokenHolder

@Bean
 @ConditionalOnMissingBean(name="redisTemplate",
                          value=TokenHolder.class)
public TokenHolder tokenHolder()

注入一个基于内存的token存取工具

Returns:

token存取工具

tokenBuilder

@Bean
 @ConditionalOnMissingBean(value=TokenBuilder.class)
public TokenBuilder tokenBuilder(TokenHolder tokenHolder)

注入一个TokenBuilder

Parameters:

tokenHolder - token存取工具

Returns:

TokenBuilder实例

authorizeResourceInterceptor

@Bean(value="authorizeResourceInterceptor")
 @ConditionalOnMissingBean(name="authorizeResourceInterceptor")
public HttpSecurityInterceptor authorizeResourceInterceptor(PropertyResource propertyResource)

配置需要拦截哪些资源

Parameters:

propertyResource - 资源管理器

Returns:

资源授权拦截器

usernamePasswordAuthFilter

@Bean(value="usernamePasswordAuthFilter")
 @ConditionalOnMissingBean(name="usernamePasswordAuthFilter")
public SecurityRequestFilter usernamePasswordAuthFilter(HandlerProcessor handlerProcessor,
                                                                                                                                                                SecurityHelper securityHelper,
                                                                                                                                                                PropertyResource propertyResource,
                                                                                                                                                                SecurityExtractor securityExtractor)

securityTokenExtractor

@Bean
 @ConditionalOnMissingBean(value=SecurityTokenExtractor.class)
public SecurityTokenExtractor securityTokenExtractor()

userAuthServiceFilter

@Bean(value="userAuthServiceFilter")
 @ConditionalOnMissingBean(name="userAuthServiceFilter")
public SecurityRequestFilter userAuthServiceFilter(PropertyResource propertyResource,
                                                                                                                                                 HandlerProcessor handlerProcessor,
                                                                                                                                                 SecurityTokenExtractor securityTokenExtractor,
                                                                                                                                                 SecurityHelper securityHelper)
                                                                                                                                          throws javax.servlet.ServletException

Throws:

javax.servlet.ServletException

validateCodeFilter

@Bean(value="validateCodeFilter")
 @ConditionalOnMissingBean(name="validateCodeFilter")
 @ConditionalOnBean(value=CodeRepository.class)
public SecurityRequestFilter validateCodeFilter(CodeProcessor codeProcessor,
                                                                                                                                                                                        SecurityProperties securityProperties,
                                                                                                                                                                                        HandlerProcessor handlerProcessor)

注入一个验证码过滤器

Parameters:

codeProcessor - 验证码处理器

securityProperties - 安全属性配置

handlerProcessor - 协助处理器

Returns:

验证码过滤器

smsLoginInterceptor

@Bean(value="smsLoginInterceptor")
 @ConditionalOnProperty(prefix="yishuifengxiao.security.code",
                       name="sms-login-url")
 @ConditionalOnMissingBean(name="smsLoginInterceptor")
 @ConditionalOnBean(value=SmsUserDetailsService.class)
public HttpSecurityInterceptor smsLoginInterceptor(org.springframework.security.web.authentication.AuthenticationSuccessHandler authenticationFailureHandler,
                                                                                                                                                                                                                                                                                                                org.springframework.security.web.authentication.AuthenticationFailureHandler authenticationSuccessHandler,
                                                                                                                                                                                                                                                                                                                SmsUserDetailsService smsUserDetailsService,
                                                                                                                                                                                                                                                                                                                SecurityProperties securityProperties)

注入短信登录配置

配置短信验证码登陆功能

要想使短信验证码功能生效，需要配置： 1 先配置一个短信登陆地址属性(yishuifengxiao.security.code.sms-login-url), 2 再配置一个名为 smsUserDetailsService 的 UserDetailsService 实例

Parameters:

authenticationFailureHandler - 认证失败处理器

authenticationSuccessHandler - 认证成功处理器

smsUserDetailsService - 短信登陆逻辑

securityProperties - 安全属性配置

Returns:

资源授权拦截器实例

ignoreResourceProvider

@Bean(name="ignoreResourceProvider")
 @ConditionalOnMissingBean(name="ignoreResourceProvider")
public WebSecurityProvider ignoreResourceProvider(SecurityProperties securityProperties)

忽视资源授权器

Parameters:

securityProperties - 安全属性配置

Returns:

web安全授权器实例

firewallWebSecurityProvider

@Bean(value="firewallWebSecurityProvider")
 @ConditionalOnMissingBean(name="firewallWebSecurityProvider")
public WebSecurityProvider firewallWebSecurityProvider()

默认实现的HttpFirewall，主要是解决路径里包含 // 路径报错的问题

Returns:

web安全授权器实例