Spring Security实现两周内自动登录”记住我”功能

以下是详细的Spring Security实现两周内自动登录的攻略。

1. 添加相关依赖

首先，在项目中添加Spring Security的依赖：

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-core</artifactId>
    <version>5.2.5.RELEASE</version>
</dependency>

2. 配置Remember Me功能

在Spring Security配置文件中添加Remember Me的配置：

<http>
    ...
    <remember-me key="my_key" token-validity-seconds="1209600" />
</http>

其中，key为Remember Me的私钥，token-validity-seconds为Remember Me的有效时间，这里设置为1209600秒，即两周时间。

3. 实现UserDetailsService接口

要实现Spring Security自动登录的功能，需要实现UserDetailsService接口，用来从数据库中获取用户信息。示例如下：

@Service
public class UserDetailsServiceImpl implements UserDetailsService {

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException("user not found");
        }
        List<GrantedAuthority> authorities = new ArrayList<>();
        authorities.add(new SimpleGrantedAuthority("ROLE_USER"));
        return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(),
                authorities);
    }
}

其中，User是自己定义的用户实体类，userRepository是用户数据的操作类。

4. 实现RememberMeService接口

接下来，需要实现RememberMeService接口，用来将用户的登录信息保存在Cookie中。示例如下：

@Service
public class RememberMeServiceImpl implements RememberMeServices {

    private final String KEY = "my_key";

    @Override
    public UserDetails autoLogin(HttpServletRequest request, HttpServletResponse response) {
        Cookie[] cookies = request.getCookies();
        if (cookies == null) {
            return null;
        }
        Cookie rememberMeCookie = null;
        for (Cookie cookie : cookies) {
            if (KEY.equals(cookie.getName())) {
                rememberMeCookie = cookie;
                break;
            }
        }
        if (rememberMeCookie == null) {
            return null;
        }
        String[] tokens = new String[0];
        try {
            tokens = StringUtils.delimitedListToStringArray(
                    URLDecoder.decode(rememberMeCookie.getValue(), "UTF-8"), ":");
        } catch (UnsupportedEncodingException e) {
            e.printStackTrace();
        }
        if (tokens.length != 2) {
            return null;
        }
        long expires = Long.parseLong(tokens[1]);
        if (expires < System.currentTimeMillis()) {
            return null;
        }
        UserDetails userDetails = userDetailsService.loadUserByUsername(tokens[0]);
        String password = userDetails.getPassword();
        Authentication auth = new UsernamePasswordAuthenticationToken(userDetails, password,
                userDetails.getAuthorities());
        SecurityContextHolder.getContext().setAuthentication(auth);
        return userDetails;
    }

    @Override
    public void loginFail(HttpServletRequest request, HttpServletResponse response) {

    }

    @Override
    public void loginSuccess(HttpServletRequest request, HttpServletResponse response,
            Authentication successfulAuthentication) {
        String username = successfulAuthentication.getName();
        String token = username + ":" + (System.currentTimeMillis() + 1209600 * 1000);
        try {
            Cookie rememberMeCookie = new Cookie(KEY, URLEncoder.encode(token, "UTF-8"));
            rememberMeCookie.setHttpOnly(true);
            rememberMeCookie.setMaxAge(1209600);
            response.addCookie(rememberMeCookie);
        } catch (UnsupportedEncodingException e) {   
            e.printStackTrace();
        }
    }
}

其中，KEY为Remember Me的私钥，UserDetailsService是UserDetailsServiceImpl的实例。

示例

接下来，我们通过两个示例演示如何使用Spring Security实现两周内自动登录记住我功能。

示例1：登录成功后记住我

当用户勾选记住我选项，完成登录后，将在Cookie中保存用户信息。

@PostMapping("/login")
public String login(HttpServletRequest request, Authentication authentication) {
    if (authentication != null) {
        rememberMeServices.loginSuccess(request, response, authentication);
    }
    return "redirect:/index";
}

示例2：自动登录

当用户再次访问网站时，如果Cookie中保存了用户信息，并且未过期，则自动登录。

@GetMapping("/index")
public String index(HttpServletRequest request, HttpServletResponse response) {
    UserDetails userDetails = rememberMeServices.autoLogin(request, response);
    if (userDetails == null) {
        return "redirect:/login";
    }
    return "index";
}

以上就是使用Spring Security实现两周内自动登录“记住我”功能的完整攻略，同时提供了两个相关示例，希望能对您有所帮助。