spring gateway
分布式開發時，微服務會有很多，但是網關是請求的第一入口，所以一般會把客戶端請求的權限驗證統一放在網關進行認證與鑒權。SpringCloud Gateway 作為 Spring Cloud 生態系統中的網關，目標是替代 Zuul，為了提升網關的性能，SpringCloud Gateway是基於WebFlux框架實現的，而WebFlux框架底層則使用了高性能的Reactor模式通信框架Netty。
注意:
由於web容器不同，在gateway項目中使用的webflux，是不能和spring-web混合使用的。
Spring MVC和WebFlux的區別
11772383-b70d80a3893f3a04.png
依賴:
<dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-starter-security</artifactId> </dependency> <dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-starter-gateway</artifactId> </dependency> 配置spring security
spring security設置要采用響應式配置，基於WebFlux中WebFilter實現，與Spring MVC的Security是通過Servlet的Filter實現類似，也是一系列filter組成的過濾鏈。
- 部分概念是對應的：
| Reactive | Web |
|---|---|
| @EnableWebFluxSecurity | @EnableWebSecurity |
| ReactiveSecurityContextHolder | SecurityContextHolder |
| AuthenticationWebFilter | FilterSecurityInterceptor |
| ReactiveAuthenticationManager | AuthenticationManager |
| ReactiveUserDetailsService | UserDetailsService |
| ReactiveAuthorizationManager | AccessDecisionManager |
- 首先需要配置@EnableWebFluxSecurity注解，開啟Spring WebFlux Security的支持
import java.util.LinkedList; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.DelegatingReactiveAuthenticationManager; import org.springframework.security.authentication.ReactiveAuthenticationManager; import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity; import org.springframework.security.config.web.server.ServerHttpSecurity; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.web.server.SecurityWebFilterChain; import org.springframework.security.web.server.authentication.AuthenticationWebFilter; /** * @Author: pilsy * @Date: 2020/6/29 0029 16:54 */ @Configuration @EnableWebFluxSecurity public class SecurityConfig { @Autowired private AuthenticationConverter authenticationConverter; @Autowired private AuthorizeConfigManager authorizeConfigManager; @Autowired private AuthEntryPointException serverAuthenticationEntryPoint; @Autowired private JsonServerAuthenticationSuccessHandler jsonServerAuthenticationSuccessHandler; @Autowired private JsonServerAuthenticationFailureHandler jsonServerAuthenticationFailureHandler; @Autowired private JsonServerLogoutSuccessHandler jsonServerLogoutSuccessHandler; @Autowired private AuthenticationManager authenticationManager; private static final String[] AUTH_WHITELIST = new String[]{"/login", "/logout"}; @Bean public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) { SecurityWebFilterChain chain = http.formLogin() .loginPage("/login") // 登錄成功handler .authenticationSuccessHandler(jsonServerAuthenticationSuccessHandler) // 登陸失敗handler .authenticationFailureHandler(jsonServerAuthenticationFailureHandler) // 無訪問權限handler .authenticationEntryPoint(serverAuthenticationEntryPoint) .and() .logout() // 登出成功handler .logoutSuccessHandler(jsonServerLogoutSuccessHandler) .and() .csrf().disable() .httpBasic().disable() .authorizeExchange() // 白名單放行 .pathMatchers(AUTH_WHITELIST).permitAll() // 訪問權限控制 .anyExchange().access(authorizeConfigManager) .and().build