问使用自定义Http报头实现基于权限的过滤的Spring安全性

EN

@Component
@Slf4j
public class CustomPreAuthProvider implements AuthenticationProvider {

  private boolean throwExceptionWhenTokenRejected;

  @Override
  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    if (!this.supports(authentication.getClass())) {
      return null;
    }  else {
      log.debug(String.valueOf(LogMessage.format("PreAuthenticated authentication request: %s", authentication)));
      if (authentication.getPrincipal() == null) {
        log.debug("No pre-authenticated principal found in request.");
        if (this.throwExceptionWhenTokenRejected) {
          throw new BadCredentialsException("No pre-authenticated principal found in request.");
        } else {
          return null;
        }
      } else if (authentication.getCredentials() == null) {
        log.debug("No pre-authenticated credentials found in request.");
        if (this.throwExceptionWhenTokenRejected) {
          throw new BadCredentialsException("No pre-authenticated credentials found in request.");
        } else {
          return null;
        }
      } else if (!authentication.isAuthenticated()) {
        throw new InsufficientAuthenticationException("Access token likely no longer valid.");
      }

      return authentication;
    }
  }

  @Override
  public boolean supports(Class<?> authentication) {
    return authentication.equals(PreAuthenticatedAuthenticationToken.class);
  }

  public void setThrowExceptionWhenTokenRejected(boolean throwExceptionWhenTokenRejected) {
    this.throwExceptionWhenTokenRejected = throwExceptionWhenTokenRejected;
  }
}

@Service
public class CustomUserDetails implements UserDetailsService {
  @Autowired
  private SessionRepository sessionRepository;

  @Autowired
  private RoleRepository roleRepository;

  @Autowired
  private AuthHelper authHelper;

  @Override
  public UserDetails loadUserByUsername(String sessionId) throws UsernameNotFoundException, IllegalStateException {
    var sessions = sessionRepository.getSession(sessionId);  // Database query for session information
    if (sessions == null || sessions.isEmpty()) {
      throw new UsernameNotFoundException("Session Not Found");
    } else if (sessions.size() > 1) {
      throw new IllegalStateException("More than one record with sessionId found");
    }

    var session = sessions.get(0);

    var authoritySet = new HashSet<String>();
    for (String role : session.getRoles()) {
      var authorities = roleRepository.getUserPrivilegesByRoleName(role);  // Database query for authorities
      for (UserRolePrivilege userRolePrivilege : authorities) {
        authoritySet.add(userRolePrivilege.getPermittedAction());
      }
    }

    var grantedAuthority = new ArrayList<GrantedAuthority>();
    for (String authority : authoritySet) {
      grantedAuthority.add(new SimpleGrantedAuthority(authority));
    }

    var introspect = authHelper.validateAccessToken(session.getSessionId(), session.getAccessToken(),
        session.getRefreshToken(), session.getExpirationTime());  // Code to verify token

    var user = new UserImpl();
    user.setUsername(session.getEmail());
    user.setPassword(session.getAccessToken());
    user.setEnabled(introspect.getIntrospect().isActive());
    user.setAccountNonExpired(introspect.getIntrospect().isActive());
    user.setAccountNonLocked(introspect.getIntrospect().isActive());
    user.setCredentialsNonExpired(introspect.getIntrospect().isActive());
    user.setAuthorities(grantedAuthority);

    return user;
  }
}

public class SessionAuthFilter extends AbstractAuthenticationProcessingFilter {
  private final CustomUserDetails customUserDetails;

  protected SessionAuthFilter(RequestMatcher requestMatcher, AuthenticationManager authenticationManager,
      CustomUserDetails customUserDetails) {
    super(requestMatcher, authenticationManager);
    this.customUserDetails = customUserDetails;
    this.setContinueChainBeforeSuccessfulAuthentication(true);
    this.setAuthenticationSuccessHandler((request, response, authentication) -> {});
  }

  @Override
  public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
      throws AuthenticationException {
    var sessionId = request.getHeader("sessionId") != null ? request.getHeader("sessionId").trim() : null;
    var user = customUserDetails.loadUserByUsername(sessionId);
    var authentication = new PreAuthenticatedAuthenticationToken(user.getUsername(), user.getPassword(),
        user.getAuthorities());
    authentication.setAuthenticated(user.isCredentialsNonExpired());
    authentication.setDetails(customUserDetails);

    SecurityContextHolder.getContext().setAuthentication(authentication);
    return this.getAuthenticationManager().authenticate(authentication);
  }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig {

  @Bean
  AuthenticationManager customAuthenticationManager(CustomPreAuthProvider preAuthProvider) {
    return new ProviderManager(List.of(preAuthProvider));
  }

  @Bean
  SessionAuthFilter customAuthFilter(AuthenticationManager authManager, CustomUserDetails customUserDetails) {
    return new SessionAuthFilter(
        new OrRequestMatcher(
            new AntPathRequestMatcher("/apples/**"),
        ),
        authManager,
        customUserDetails);
  }

  @Bean
  public SecurityFilterChain filterChain(HttpSecurity http, SessionAuthFilter authFilter) throws Exception {
    http.exceptionHandling()
        .authenticationEntryPoint(new Http403ForbiddenEntryPoint())
        .accessDeniedHandler(new AccessDeniedHandlerImpl())
        .and()
        .formLogin().disable()
        .httpBasic().disable()
        .authorizeRequests()
        .antMatchers(
            "/",
            "/error",
            "/v3/api-docs/**",
            "/swagger-ui/**",
            "/swagger-ui.html",
            "/actuator/**"
        ).permitAll()
        .antMatchers(HttpMethod.GET, "/apples").hasAuthority("viewApples")
        .antMatchers(HttpMethod.POST, "/apples").hasAuthority("createApples")
        .anyRequest().authenticated()
        .and()
        .addFilterBefore(authFilter, AbstractPreAuthenticatedProcessingFilter.class)
        .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

    return http.build();
  }
}