Spring Security基于过滤器实现图形验证码功能

针对Spring Security基于过滤器实现图形验证码功能的完整攻略，我提供以下步骤：

Step 1. 添加依赖

在Maven或Gradle中添加以下依赖：

<!-- spring-security-web -->
<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-web</artifactId>
  <version>${spring-security.version}</version>
</dependency>

<!-- servlet-api -->
<dependency>
  <groupId>javax.servlet</groupId>
  <artifactId>javax.servlet-api</artifactId>
  <version>${servlet-api.version}</version>
</dependency>

<!-- kaptcha -->
<dependency>
  <groupId>com.google.code.kaptcha</groupId>
  <artifactId>kaptcha</artifactId>
  <version>${kaptcha.version}</version>
</dependency>

<!-- commons-io -->
<dependency>
  <groupId>commons-io</groupId>
  <artifactId>commons-io</artifactId>
  <version>${commons-io.version}</version>
</dependency>

Step 2. 创建验证码Controller

在Controller中创建一个URL，用于生成验证码图片。代码示例如下：

@RestController
@RequestMapping("/captcha")
public class CaptchaController {
    @Autowired
    private Producer captchaProducer;

    @GetMapping("/image")
    public void captchaImage(HttpServletRequest request, HttpServletResponse response) throws Exception {
        response.setContentType("image/jpeg");
        response.setHeader("Pragma", "No-cache");
        response.setHeader("Cache-Control", "no-cache");
        response.setDateHeader("Expires", 0);
        //生成验证码文本
        String text = captchaProducer.createText();
        //将验证码保存到Session中
        request.getSession().setAttribute("captcha", text);
        //生成验证码图片
        BufferedImage image = captchaProducer.createImage(text);
        ServletOutputStream out = response.getOutputStream();
        //输出图片流
        ImageIO.write(image, "JPEG", out);
        IOUtils.closeQuietly(out);
    }
}

Step 3. 创建验证码过滤器

创建一个实现javax.servlet.Filter接口的类CAPTCHAFilter, 过滤器只在登录时验证。代码示例如下：

public class CAPTCHAFilter extends OncePerRequestFilter {

    public void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain) throws IOException, ServletException {
        //检查是否是登录请求
        if ("/login".equals(req.getRequestURI()) && "POST".equalsIgnoreCase(req.getMethod())) {
            //从session中获取验证码
            String sessionCaptcha = (String)req.getSession().getAttribute("captcha");
            //获取输入的验证码
            String inputCaptcha = req.getParameter("captcha");
            if (StringUtils.isEmpty(inputCaptcha) || !inputCaptcha.equals(sessionCaptcha)) {
                // 验证码校验失败, 返回验证码错误信息
                res.setContentType("application/json;charset=UTF-8");
                res.getWriter().write("{\"code\":\"1002\", \"message\":\"验证码错误\"}");
                return;
            }
        }
        chain.doFilter(req, res);
    }
}

Step 4. 注册过滤器

在Web Security配置类中注册过滤器。代码示例如下：

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private CaptchaController captchaController;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
            //设置不拦截路径
            .antMatchers("/captcha/**", "/login").permitAll()
            .anyRequest().authenticated()
            .and()
            //注册Filter
            .addFilterBefore(getCAPTCHAFilter(), UsernamePasswordAuthenticationFilter.class)
            .formLogin()
            .loginPage("/login")
            .defaultSuccessUrl("/")
            .permitAll();
    }

    @Bean
    CAPTCHAFilter getCAPTCHAFilter() throws Exception {
        CAPTCHAFilter captchaFilter = new CAPTCHAFilter();
        captchaFilter.setAuthenticationManager(authenticationManager());
        return captchaFilter;
    }

    //其他安全配置
}

到这里，这个基于过滤器实现图形验证码功能的安全功能就完成了。下面提供两条示例供参考：

** 示例一： ** 当验证码校验失败时返回错误信息

$ curl --location --request POST 'http://localhost:8080/login' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'username=user' \
--data-urlencode 'password=password' \
--data-urlencode 'captcha=error'

{"code":"1002", "message":"验证码错误"}

** 示例二： ** 当验证码校验成功时，登录成功

$ curl --location --request POST 'http://localhost:8080/login' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'username=user' \
--data-urlencode 'password=password' \
--data-urlencode 'captcha=VWF3'

#登录成功

希望这个Spring Security基于过滤器实现图形验证码功能的攻略对你有帮助。