SpringBoot 項(xiàng)目鑒權(quán)的 4 種方式

點(diǎn)擊上方“碼農(nóng)突圍”，馬上關(guān)注
這里是碼農(nóng)充電第一站，回復(fù)“666”，獲取一份專屬大禮包
真愛，請?jiān)O(shè)置“星標(biāo)”或點(diǎn)個(gè)“在看”

前言

傳統(tǒng)AOP

實(shí)現(xiàn)

1. 使用?@Aspect?聲明一下切面類?WhitelistAspect；

2. 在切面類內(nèi)添加一個(gè)切點(diǎn)?whitelistPointcut()，為了實(shí)現(xiàn)此切點(diǎn)靈活可裝配的能力，這里不使用?execution?全部攔截，而是添加一個(gè)注解?@Whitelist，被注解的方法才會(huì)校驗(yàn)白名單。

3. 在切面類中使用 spring 的 AOP 注解?@Before?聲明一個(gè)通知方法?checkWhitelist()?在 Controller 方法被執(zhí)行之前校驗(yàn)白名單。

@Aspect??
public?class?WhitelistAspect?{??
?????
?@Before(value?=?"whitelistPointcut()?&&?@annotation(whitelist)")??
?public?void?checkAppkeyWhitelist(JoinPoint?joinPoint,?Whitelist?whitelist)?{??
?????checkWhitelist();??
?????//?可使用?joinPoint.getArgs()?獲取Controller方法的參數(shù)??
?????//?可以使用?whitelist?變量獲取注解參數(shù)??
?}??
?????
?????
?@Pointcut("@annotation(com.zhenbianshu.Whitelist)")??
?public?void?whitelistPointCut()?{??
?}??
}??

擴(kuò)展

Interceptor

實(shí)現(xiàn)

1. 定義攔截器類?AppkeyInterceptor?類并實(shí)現(xiàn) HandlerInterceptor 接口。

2. 實(shí)現(xiàn)其?preHandle()?方法；

3. 在 preHandle 方法內(nèi)通過注解和參數(shù)判斷是否需要攔截請求，攔截請求時(shí)接口返回?false；

4. 在自定義的?WebMvcConfigurerAdapter?類內(nèi)注冊此攔截器；

@Component??
public?class?WhitelistInterceptor?implements?HandlerInterceptor?{??
??
????@Override??
????public?boolean?preHandle(HttpServletRequest?request,?HttpServletResponse?response,?Object?handler)?throws?Exception?{??
????????Whitelist?whitelist?=?((HandlerMethod)?handler).getMethodAnnotation(Whitelist.class);??
????????//?whitelist.values();?通過?request?獲取請求參數(shù)，通過?whitelist?變量獲取注解參數(shù)??
????????return?true;??
????}??
??
????@Override??
????public?void?postHandle(HttpServletRequest?request,?HttpServletResponse?response,?Object?handler,?ModelAndView?modelAndView)?throws?Exception?{??
??//?方法在Controller方法執(zhí)行結(jié)束后執(zhí)行??
????}??
??
????@Override??
????public?void?afterCompletion(HttpServletRequest?request,?HttpServletResponse?response,?Object?handler,?Exception?ex)?throws?Exception?{??
??//?在view視圖渲染完成后執(zhí)行??
????}??
}??

擴(kuò)展

@Configuration??
public?class?MvcConfiguration?extends?WebMvcConfigurerAdapter?{??
????@Override??
????public?void?addInterceptors(InterceptorRegistry?registry)?{??
????????registry.addInterceptor(new?WhitelistInterceptor()).addPathPatterns("/*").order(1);??
????????//?這里可以配置攔截器啟用的?path?的順序，在有多個(gè)攔截器存在時(shí)，任一攔截器返回?false?都會(huì)使后續(xù)的請求方法不再執(zhí)行??
????}??
}??

ArgumentResolver

實(shí)現(xiàn)

1. 定義自定義參數(shù)類型?AuthParam，類內(nèi)有 appkey 相關(guān)字段；

2. 定義?AuthParamResolver?并實(shí)現(xiàn) HandlerMethodArgumentResolver 接口；

3. 實(shí)現(xiàn)?supportsParameter()?接口方法將 AuthParam 與 AuthParamResolver 適配起來；

4. 實(shí)現(xiàn)?resolveArgument()?接口方法解析 reqest 對象生成 AuthParam 對象，并在此校驗(yàn) AuthParam ，確認(rèn) appkey 是否在白名單內(nèi)；

5. 在 Controller Action 方法上簽名內(nèi)添加 AuthParam 參數(shù)以啟用此 Resolver;

@Component??
public?class?AuthParamResolver?implements?HandlerMethodArgumentResolver?{??
??
????@Override??
????public?boolean?supportsParameter(MethodParameter?parameter)?{??
????????return?parameter.getParameterType().equals(AuthParam.class);??
????}??
??
????@Override??
????public?Object?resolveArgument(MethodParameter?parameter,?ModelAndViewContainer?mavContainer,?NativeWebRequest?webRequest,?WebDataBinderFactory?binderFactory)?throws?Exception?{??
????????Whitelist?whitelist?=?parameter.getMethodAnnotation(Whitelist.class);??
????????//?通過?webRequest?和?whitelist?校驗(yàn)白名單??
????????return?new?AuthParam();??
????}??
}??

擴(kuò)展

@Configuration??
public?class?MvcConfiguration?extends?WebMvcConfigurerAdapter?{??
??
????@Override??
????public?void?addArgumentResolvers(List?argumentResolvers)?{??
????????argumentResolvers.add(new?AuthParamResolver());??
????}??
}??

Filter

public?class?WhitelistFilter?implements?javax.servlet.Filter?{??
??
????@Override??
????public?void?init(FilterConfig?filterConfig)?throws?ServletException?{??
??//?初始化后被調(diào)用一次??
????}??
??
????@Override??
????public?void?doFilter(ServletRequest?request,?ServletResponse?response,?FilterChain?chain)?throws?IOException,?ServletException?{??
?????//?判斷是否需要攔截??
???????chain.doFilter(request,?response);?//?請求通過要顯示調(diào)用??
????}??
??
????@Override??
????public?void?destroy()?{??
?????//?被銷毀時(shí)調(diào)用一次??
????}??
}??

擴(kuò)展

@Configuration??
public?class?FilterConfiguration?{??
??
????@Bean??
????public?FilterRegistrationBean?someFilterRegistration()?{??
????????FilterRegistrationBean?registration?=?new?FilterRegistrationBean();??
????????registration.setFilter(new?WhitelistFilter());??
????????registration.addUrlPatterns("/*");??
????????registration.setName("whitelistFilter");??
????????registration.setOrder(1);?//?設(shè)置過濾器被調(diào)用的順序??
????????return?registration;??
????}??
}??

小結(jié)

來源：https://zhenbianshu.github.io