Token驗證及自定義注解攔截注入

Token驗證實現步驟：

 1. 實現自定義注解

　　1.0. @Login(攔截請求驗證token，結合token實現單點登錄，掛機時限) 與 @LoginUser(前台傳入token轉換為userID)

       圖片示例：

　　　　     

 2. 攔截器的注冊類

　　2.0. extends(繼承)WebMvcConfigurerAdapter類 (繼承WebMvcConfigurationSupport 類，implements(實現) WebMvcConfigurer接口，根據不同的開發環境選擇不同方式)

　　WebMvcConfigurerAdapter : Spring內部的一種配置方式采用JavaBean的形式來代替傳統的xml配置文件形式進行針對框架個性化定制

package com.shengwei.businessschoolapi.config;

import com.shengwei.businessschoolapi.interceptor.AuthorizationInterceptor;
import com.shengwei.businessschoolapi.resolver.LoginUserHandlerMethodArgumentResolver;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.method.support.HandlerMethodArgumentResolver;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;

import java.util.List;

@Configuration
public  class WebLoginHandlerConfig extends WebMvcConfigurerAdapter {

    @Autowired
    private AuthorizationInterceptor authorizationInterceptor;

    @Autowired
    private LoginUserHandlerMethodArgumentResolver loginUserHandlerMethodArgumentResolver;
   /*
    *重寫攔截器：添加攔截請求方法 excludePathPatterns(不攔截請求) addPathPatterns(攔截的請求)
    *authorizationInterceptor：作用：攔截器實現   實現功能：用於每次請求驗證Token（結合自定義注解@Login實現）
    */
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(authorizationInterceptor).excludePathPatterns("/api/wxUser/login").addPathPatterns("/api/**");
    }
    /*
     *添加參數解析器
     *loginUserHandlerMethodArgumentResolver 實現功能如：不傳參數情況下可通過@LoginUser實現數據注入（結合自定義注解@LoginUser實現）
     */
    @Override
    public void addArgumentResolvers(List<HandlerMethodArgumentResolver> argumentResolvers) {
        argumentResolvers.add(loginUserHandlerMethodArgumentResolver);
    }
}

3. 攔截器實現

package com.shengwei.businessschoolapi.interceptor;

import com.shengwei.businessschoolapi.annotation.Login;
import com.shengwei.businessschoolapi.exception.RRException;
import com.shengwei.businessschoolapi.model.TokenEntity;
import com.shengwei.businessschoolapi.service.TokenService;
import org.apache.commons.lang.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

@Component
public class AuthorizationInterceptor extends HandlerInterceptorAdapter {

    @Autowired
    private TokenService tokenService;

    //統一設置userId的 KEY值
    public static final String USER_KEY = "userId";

    //前台統一token的 KEY值
    public static final String LOGIN_TOKEN_KEY = "WM-SHOP-TOKEN";

    /*
     * preHandle()作用:在業務處理器處理請求之前被調用 預處理 可以進行編碼 安全控制等處理
     *
     */
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        Login annotation;
        if(handler instanceof HandlerMethod) {
            annotation = ((HandlerMethod) handler).getMethodAnnotation(Login.class);
        }else{
            return true;
        }
        if(annotation == null){
            return true;
        }
        //從header中獲取token
        String token = request.getHeader(LOGIN_TOKEN_KEY);
        //如果header中不存在token，則從參數中獲取token
        if(StringUtils.isBlank(token)){
            token = request.getParameter("token");
        }
        //token為空
        if(StringUtils.isBlank(token)){
            throw new RRException("token不能為空");
        }
        //查詢token信息
        TokenEntity tokenEntity = tokenService.queryByToken(token);
        if(tokenEntity == null || tokenEntity.getExpirationTime().getTime() < System.currentTimeMillis()){
            throw new RRException("token失效，請重新登錄");
        }
        //設置userId到request里，后續根據userId，獲取用戶信息
        request.setAttribute(USER_KEY, tokenEntity.getUserid());
        return true;
    }
}

 

自定義注解攔截注入步驟：

 1. 實現自定義注解(這里我們用（@LoginUser）

 2. 添加參數解析器(這里我們用 LoginUserHandlerMethodArgumentResolver實現類)

 3. 實現參數解析器

package com.shengwei.businessschoolapi.resolver;

import com.shengwei.businessschoolapi.annotation.LoginUser;
import com.shengwei.businessschoolapi.exception.RRException;
import com.shengwei.businessschoolapi.service.TokenService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.core.MethodParameter;
import org.springframework.stereotype.Component;
import org.springframework.web.bind.support.WebDataBinderFactory;
import org.springframework.web.context.request.NativeWebRequest;
import org.springframework.web.method.support.HandlerMethodArgumentResolver;
import org.springframework.web.method.support.ModelAndViewContainer;

@Component
public class LoginUserHandlerMethodArgumentResolver implements HandlerMethodArgumentResolver {
    @Autowired
    private TokenService tokenService;

    //前台統一token的 KEY值
    public static final String LOGIN_TOKEN_KEY = "WM-SHOP-TOKEN";

    /*
     *getParameterType().isAssignableFrom(Long.class):為參數注入類型判斷  hasParameterAnnotation(LoginUser.class)為當前注解名稱判斷
     *當 retuer返回為true時 執行resolveArgument()方法
     */
    @Override
    public boolean supportsParameter(MethodParameter methodParameter) {
       return  methodParameter.getParameterType().isAssignableFrom(Long.class) &&  methodParameter.hasParameterAnnotation(LoginUser.class);
    }
    /*
     * 注入數據方法
     */
    @Override
    public Object resolveArgument(MethodParameter methodParameter, ModelAndViewContainer modelAndViewContainer, NativeWebRequest nativeWebRequest, WebDataBinderFactory webDataBinderFactory) {
        //獲取用戶token
        String token = nativeWebRequest.getHeader(LOGIN_TOKEN_KEY);
        if (token == null || token.isEmpty()) {
            new RRException("沒有token");
        }
        //獲取用戶Id
        Long userId = tokenService.getUserId(token);
        if (userId == null) {

            new RRException("請登錄");
        }
        return userId;
    }
}

 提示：使用環境springboot(1.5.8)