SpringSecurity自定义成功失败处理器的示例代码

以下是关于“SpringSecurity自定义成功失败处理器的示例代码”的完整攻略。

1. 添加依赖

首先，需要在项目的pom.xml文件中添加SpringSecurity的依赖，示例代码如下：

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-web</artifactId>
    <version>5.5.2</version>
</dependency>
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-config</artifactId>
    <version>5.5.2</version>
</dependency>

2. 定义自定义处理器

接下来需要定义自定义的成功和失败处理器。示例代码如下：

@Service
public class CustomAuthenticationSuccessHandler implements AuthenticationSuccessHandler {

    private final ObjectMapper objectMapper;

    public CustomAuthenticationSuccessHandler(ObjectMapper objectMapper) {
        this.objectMapper = objectMapper;
    }

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request,
                                        HttpServletResponse response,
                                        Authentication authentication) throws IOException, ServletException {
        response.setStatus(HttpStatus.OK.value());
        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
        objectMapper.writeValue(response.getWriter(), "Authentication successful");
    }
}

@Service
public class CustomAuthenticationFailureHandler implements AuthenticationFailureHandler {

    private final ObjectMapper objectMapper;

    public CustomAuthenticationFailureHandler(ObjectMapper objectMapper) {
        this.objectMapper = objectMapper;
    }

    @Override
    public void onAuthenticationFailure(HttpServletRequest request,
                                        HttpServletResponse response,
                                        AuthenticationException exception) throws IOException, ServletException {
        response.setStatus(HttpStatus.UNAUTHORIZED.value());
        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
        objectMapper.writeValue(response.getWriter(), "Authentication failed");
    }
}

这里定义了两个自定义的处理器，分别是CustomAuthenticationSuccessHandler和CustomAuthenticationFailureHandler。这两个处理器都实现了SpringSecurity的AuthenticationSuccessHandler和AuthenticationFailureHandler接口，可以在认证成功和认证失败时，被SpringSecurity框架自动调用。

3. 添加自定义处理器到SpringSecurity配置中

在SpringSecurity的配置中，需要将自定义的处理器添加进去。示例代码如下：

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private final CustomAuthenticationSuccessHandler customAuthenticationSuccessHandler;
    private final CustomAuthenticationFailureHandler customAuthenticationFailureHandler;

    public SecurityConfig(CustomAuthenticationSuccessHandler customAuthenticationSuccessHandler,
                          CustomAuthenticationFailureHandler customAuthenticationFailureHandler) {
        this.customAuthenticationSuccessHandler = customAuthenticationSuccessHandler;
        this.customAuthenticationFailureHandler = customAuthenticationFailureHandler;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/public/**").permitAll()
                .antMatchers("/private/**").authenticated()
                .and()
                .formLogin()
                .successHandler(customAuthenticationSuccessHandler)
                .failureHandler(customAuthenticationFailureHandler);
    }
}

在上述代码中，SpringSecurity的配置类SecurityConfig中，将自定义的成功处理器CustomAuthenticationSuccessHandler和自定义的失败处理器CustomAuthenticationFailureHandler添加进了formLogin()方法中。

示例代码1：自定义登录页面并输出认证结果到日志中

以下示例代码展示了如何自定义登录页面以及如何输出认证结果到日志中。

1. 定义登录页面

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Login Page</title>
</head>
<body>
<h1>Login Page</h1>
<form method="post" action="/login">
    <table>
        <tr>
            <td>Username:</td>
            <td><input type="text" name="username"/></td>
        </tr>
        <tr>
            <td>Password:</td>
            <td><input type="password" name="password"/></td>
        </tr>
        <tr>
            <td colspan="2"><input type="submit" value="Login"/></td>
        </tr>
    </table>
</form>
</body>
</html>

2. 在SpringSecurity配置中引用登录页面

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private final CustomAuthenticationSuccessHandler customAuthenticationSuccessHandler;
    private final CustomAuthenticationFailureHandler customAuthenticationFailureHandler;

    public SecurityConfig(CustomAuthenticationSuccessHandler customAuthenticationSuccessHandler,
                          CustomAuthenticationFailureHandler customAuthenticationFailureHandler) {
        this.customAuthenticationSuccessHandler = customAuthenticationSuccessHandler;
        this.customAuthenticationFailureHandler = customAuthenticationFailureHandler;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/public/**").permitAll()
                .antMatchers("/private/**").authenticated()
                .and()
                .formLogin()
                .loginPage("/login.html")
                .successHandler(customAuthenticationSuccessHandler)
                .failureHandler(customAuthenticationFailureHandler);
    }
}

在上述代码中，重点是formLogin()方法的loginPage()属性，它可以指定登录页面的路径。这里指定了路径为“/login.html”。

3. 在自定义处理器中输出认证结果到日志中

@Service
public class CustomAuthenticationSuccessHandler implements AuthenticationSuccessHandler {

    private final Logger logger = LoggerFactory.getLogger(getClass());
    private final ObjectMapper objectMapper;

    public CustomAuthenticationSuccessHandler(ObjectMapper objectMapper) {
        this.objectMapper = objectMapper;
    }

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request,
                                        HttpServletResponse response,
                                        Authentication authentication) throws IOException, ServletException {
        logger.info("Authentication successful: {}", objectMapper.writeValueAsString(authentication));
        response.sendRedirect("/");
    }
}

@Service
public class CustomAuthenticationFailureHandler implements AuthenticationFailureHandler {

    private final Logger logger = LoggerFactory.getLogger(getClass());
    private final ObjectMapper objectMapper;

    public CustomAuthenticationFailureHandler(ObjectMapper objectMapper) {
        this.objectMapper = objectMapper;
    }

    @Override
    public void onAuthenticationFailure(HttpServletRequest request,
                                        HttpServletResponse response,
                                        AuthenticationException exception) throws IOException, ServletException {
        logger.warn("Authentication failed: {}", exception.getMessage());
        response.sendRedirect("/login.html?error");
    }
}

在上述代码中，CustomAuthenticationSuccessHandler和CustomAuthenticationFailureHandler的定义方式和之前是一样的。唯一的不同是在onAuthenticationSuccess()和onAuthenticationFailure()方法中，分别输出了认证成功和认证失败的信息到日志中。

示例代码2：自定义登录后的跳转页面

以下示例代码展示了如何自定义登录后的跳转页面。

1. 定义跳转页面

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Welcome Page</title>
</head>
<body>
<h1>Welcome Page</h1>
<p>Welcome, ${username}!</p>
<form method="post" action="/logout">
    <input type="submit" value="Logout"/>
</form>
</body>
</html>

2. 在SpringSecurity配置中引用跳转页面

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private final CustomAuthenticationSuccessHandler customAuthenticationSuccessHandler;
    private final CustomAuthenticationFailureHandler customAuthenticationFailureHandler;

    public SecurityConfig(CustomAuthenticationSuccessHandler customAuthenticationSuccessHandler,
                          CustomAuthenticationFailureHandler customAuthenticationFailureHandler) {
        this.customAuthenticationSuccessHandler = customAuthenticationSuccessHandler;
        this.customAuthenticationFailureHandler = customAuthenticationFailureHandler;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/public/**").permitAll()
                .antMatchers("/private/**").authenticated()
                .and()
                .formLogin()
                .loginPage("/login.html")
                .successHandler(customAuthenticationSuccessHandler)
                .failureHandler(customAuthenticationFailureHandler)
                .defaultSuccessURL("/welcome.html", true);
    }
}

在上述代码中，重点是formLogin()方法的defaultSuccessURL()属性，它可以指定登录成功后的跳转页面。这里指定了路径为“/welcome.html”。

3. 在自定义处理器中传递用户名到跳转页面中

@Service
public class CustomAuthenticationSuccessHandler implements AuthenticationSuccessHandler {

    private final ObjectMapper objectMapper;

    public CustomAuthenticationSuccessHandler(ObjectMapper objectMapper) {
        this.objectMapper = objectMapper;
    }

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request,
                                        HttpServletResponse response,
                                        Authentication authentication) throws IOException, ServletException {
        request.getSession().setAttribute("username", authentication.getName());
        response.sendRedirect("/");
    }
}

@Controller
public class WelcomeController {

    @GetMapping("/welcome.html")
    public String welcome(HttpServletRequest request, Model model) {
        String username = (String) request.getSession().getAttribute("username");
        model.addAttribute("username", username);
        return "welcome";
    }
}

在上述代码中，在CustomAuthenticationSuccessHandler的onAuthenticationSuccess()方法中，将用户名存储在Session中；在WelcomeController中，通过Session中的用户名，将其传递到跳转页面中。

本站文章如无特殊说明，均为本站原创，如若转载，请注明出处：SpringSecurity自定义成功失败处理器的示例代码 - Python技术站