SpringSecurity实现图形验证码功能

⒈封装验证码类

 package cn.coreqi.security.validate;

 import java.awt.image.BufferedImage;
 import java.time.LocalDateTime;

 public class ImageCode {
     private BufferedImage image;
     private String code;
     private LocalDateTime expireTime;   //过期时间

     public ImageCode(BufferedImage image, String code, Integer expireIn) {
         this.image = image;
         this.code = code;
         this.expireTime = LocalDateTime.now().plusSeconds(expireIn);
     }

     public ImageCode(BufferedImage image, String code, LocalDateTime expireTime) {
         this.image = image;
         this.code = code;
         this.expireTime = expireTime;
     }

     public boolean isExpried(){
         return LocalDateTime.now().isAfter(expireTime);
     }

     public BufferedImage getImage() {
         return image;
     }

     public void setImage(BufferedImage image) {
         this.image = image;
     }

     public String getCode() {
         return code;
     }

     public void setCode(String code) {
         this.code = code;
     }

     public LocalDateTime getExpireTime() {
         return expireTime;
     }

     public void setExpireTime(LocalDateTime expireTime) {
         this.expireTime = expireTime;
     }
 }

⒉封装验证码控制器

 package cn.coreqi.security.controller;

 import cn.coreqi.security.validate.ImageCode;
 import com.sun.image.codec.jpeg.JPEGCodec;
 import com.sun.image.codec.jpeg.JPEGImageEncoder;
 import org.springframework.social.connect.web.HttpSessionSessionStrategy;
 import org.springframework.social.connect.web.SessionStrategy;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.context.request.ServletWebRequest;

 import javax.imageio.ImageIO;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.awt.*;
 import java.awt.image.BufferedImage;
 import java.io.IOException;
 import java.util.Random;

 @RestController
 public class ValidateController {

     public static final String SESSION_KEY = "SESSION_KEY_IMAGE_CODE";
     private SessionStrategy sessionStrategy = new HttpSessionSessionStrategy();

     @GetMapping("code/image")
     public void createCode(HttpServletRequest request, HttpServletResponse response) throws IOException {
         ImageCode imageCode = createImageCode(request);
         sessionStrategy.setAttribute(new ServletWebRequest(request),SESSION_KEY,imageCode);

         response.setHeader("Pragma","No-cache");
         response.setHeader("Cache-Control","no-cache");
         //response.setDateHeader("Expires", 0);

         JPEGImageEncoder encoder = JPEGCodec.createJPEGEncoder(response.getOutputStream());
         encoder.encode(imageCode.getImage());

         //ImageIO.write(imageCode.getImage(),"JPEG",response.getOutputStream());    //当tomcat下temp文件夹不存在则"Can't create output stream"
     }

     private ImageCode createImageCode(HttpServletRequest request) {
         int width = 67;
         int height = 23;
         BufferedImage image = new BufferedImage(width,height,BufferedImage.TYPE_INT_RGB);

         Graphics g = image.getGraphics();

         Random random = new Random();

         g.setColor(getRandColor(200,250));
         g.fillRect(0,0,width,height);
         g.setFont(new Font("Times New Roman",Font.ITALIC,20));
         g.setColor(getRandColor(160,200));
         for (int i = 0;i < 155; i++){
             int x = random.nextInt(width);
             int y = random.nextInt(height);
             int xl = random.nextInt(12);
             int yl = random.nextInt(12);
             g.drawLine(x,y,x+xl,y+yl);
         }
         String sRand = "";
         for(int i = 0;i < 4; i++){
             String rand = String.valueOf(random.nextInt(10));
             sRand += rand;
             g.setColor(new Color(20 + random.nextInt(110),20 + random.nextInt(110),20 + random.nextInt(110)));
             g.drawString(rand,13 * i + 6,16);
         }
         g.dispose();
         return new ImageCode(image,sRand,60);
     }

     /**
      * 生成随机背景条纹
      * @param fc
      * @param bc
      * @return
      */
     private Color getRandColor(int fc, int bc) {
         Random random = new Random();
         if(fc > 255){
             fc = 255;
         }
         if(bc > 255){
             bc = 255;
         }
         int r = fc + random.nextInt(bc - fc);
         int g = fc + random.nextInt(bc - fc);
         int b = fc + random.nextInt(bc - fc);
         return new Color(r,g,b);
     }
 }

⒊放行验证码的Rest地址

⒋表单添加验证码

             <tr>
                 <td>图形验证码：</td>
                 <td>
                     <input type="text" name="imageCode">
                     <img src="/code/image">
                 </td>
             </tr>

⒌声明一个验证码异常，用于抛出特定的验证码异常

 package cn.coreqi.security.validate;

 import org.springframework.security.core.AuthenticationException;

 public class ValidateCodeException extends AuthenticationException {
     public ValidateCodeException(String msg) {
         super(msg);
     }
 }

⒍创建一个过滤器，用于验证请求中的验证码是否正确

 package cn.coreqi.security.Filter;

 import cn.coreqi.security.validate.ImageCode;
 import cn.coreqi.security.validate.ValidateCodeException;
 import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.social.connect.web.HttpSessionSessionStrategy;
 import org.springframework.social.connect.web.SessionStrategy;
 import org.springframework.util.StringUtils;
 import org.springframework.web.bind.ServletRequestBindingException;
 import org.springframework.web.bind.ServletRequestUtils;
 import org.springframework.web.context.request.ServletWebRequest;
 import org.springframework.web.filter.OncePerRequestFilter;
 import cn.coreqi.security.controller.*;

 import javax.servlet.FilterChain;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;

 public class ValidateCodeFilter extends OncePerRequestFilter {

     private AuthenticationFailureHandler authenticationFailureHandler;

     private SessionStrategy sessionStrategy = new HttpSessionSessionStrategy();

     public AuthenticationFailureHandler getAuthenticationFailureHandler() {
         return authenticationFailureHandler;
     }

     public void setAuthenticationFailureHandler(AuthenticationFailureHandler authenticationFailureHandler) {
         this.authenticationFailureHandler = authenticationFailureHandler;
     }

     public SessionStrategy getSessionStrategy() {
         return sessionStrategy;
     }

     public void setSessionStrategy(SessionStrategy sessionStrategy) {
         this.sessionStrategy = sessionStrategy;
     }

     @Override
     protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {
         if (httpServletRequest.equals("/authentication/form") && httpServletRequest.getMethod().equals("post")) {
             try {
                 validate(new ServletWebRequest(httpServletRequest));

             }catch (ValidateCodeException e){
                 authenticationFailureHandler.onAuthenticationFailure(httpServletRequest,httpServletResponse,e);
                 return;
             }
         }
         filterChain.doFilter(httpServletRequest,httpServletResponse);   //如果不是登录请求，直接调用后面的过滤器链
     }

     private void validate(ServletWebRequest request) throws ServletRequestBindingException {
         ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(request,ValidateController.SESSION_KEY);
         String codeInRequest = ServletRequestUtils.getStringParameter(request.getRequest(),"imageCode");
         if(!StringUtils.hasText(codeInRequest)){
             throw new ValidateCodeException("验证码的值不能为空！");
         }
         if(codeInSession == null){
             throw new ValidateCodeException("验证码不存在！");
         }
         if(codeInSession.isExpried()){
             sessionStrategy.removeAttribute(request,ValidateController.SESSION_KEY);
             throw new ValidateCodeException("验证码已过期！");
         }
         if(!codeInSession.getCode().equals(codeInRequest)){
             throw new ValidateCodeException("验证码不正确！");
         }
         sessionStrategy.removeAttribute(request,ValidateController.SESSION_KEY);
     }
 }

⒎在SpringSecurity过滤器链中注册我们的过滤器

 package cn.coreqi.security.config;

 import cn.coreqi.security.Filter.ValidateCodeFilter;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.crypto.password.NoOpPasswordEncoder;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

 @Configuration
 public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

     @Autowired
     private AuthenticationSuccessHandler coreqiAuthenticationSuccessHandler;

     @Autowired
     private AuthenticationFailureHandler coreqiAuthenticationFailureHandler;

     @Bean
     public PasswordEncoder passwordEncoder(){
         return NoOpPasswordEncoder.getInstance();
     }

     @Override
     protected void configure(HttpSecurity http) throws Exception {
         ValidateCodeFilter validateCodeFilter = new ValidateCodeFilter();
         validateCodeFilter.setAuthenticationFailureHandler(coreqiAuthenticationFailureHandler);

         //http.httpBasic()    //httpBasic登录 BasicAuthenticationFilter
         http.addFilterBefore(validateCodeFilter, UsernamePasswordAuthenticationFilter.class)    //加载用户名密码过滤器的前面
                 .formLogin()    //表单登录 UsernamePasswordAuthenticationFilter
                 .loginPage("/coreqi-signIn.html")  //指定登录页面
                 //.loginPage("/authentication/require")
                 .loginProcessingUrl("/authentication/form") //指定表单提交的地址用于替换UsernamePasswordAuthenticationFilter默认的提交地址
                 .successHandler(coreqiAuthenticationSuccessHandler) //登录成功以后要用我们自定义的登录成功处理器，不用Spring默认的。
                 .failureHandler(coreqiAuthenticationFailureHandler) //自己体会把
                 .and()
                 .authorizeRequests()    //对授权请求进行配置
                 .antMatchers("/coreqi-signIn.html","/code/image").permitAll() //指定登录页面不需要身份认证
                 .anyRequest().authenticated()  //任何请求都需要身份认证
                 .and().csrf().disable();    //禁用CSRF
             //FilterSecurityInterceptor 整个SpringSecurity过滤器链的最后一环
     }
 }