Spring Security 使用 OncePerRequestFilter 过滤器校验登录过期、请求日志等操作_Java

前言

onceperrequestfilter 是一个过滤器，每个请求都会执行一次；一般开发中主要是做检查是否已登录、token是否过期和授权等操作，而每个操作都是一个过滤器，下面演示一下。

onceperrequestfilter 使用

检查是否登录过期过滤器

import lombok.extern.slf4j.slf4j;
import org.springframework.stereotype.component;
import org.springframework.web.filter.onceperrequestfilter;
import javax.servlet.filterchain;
import javax.servlet.servletexception;
import javax.servlet.http.httpservletrequest;
import javax.servlet.http.httpservletresponse;
import java.io.ioexception;
/**
 * 检查是否登录过期
 *
 * @author francis
 * @create: 2023-08-30 16:45
 **/
@component
@slf4j
public class jwtauthenticationtokenfilter extends onceperrequestfilter {
    @override
    protected void dofilterinternal(httpservletrequest request, httpservletresponse response, filterchain filterchain) throws servletexception, ioexception {
        log.info("进入 jwtauthenticationtokenfilter ...");
        /**
         * 从 request 的 header 中拿出来 token
         */
        string token = request.getheader("token");
        if (token == null || token.isempty()) {
            // 没有携带 token 则 放行
            filterchain.dofilter(request, response);
            return;
        }
        /**
         * 检查 token 是否过期逻辑 .....
         */
        // 放行
        filterchain.dofilter(request, response);
    }
}

检查是否登录过期过滤器

import lombok.extern.slf4j.slf4j;
import org.springframework.stereotype.component;
import org.springframework.web.filter.onceperrequestfilter;
import javax.servlet.filterchain;
import javax.servlet.servletexception;
import javax.servlet.http.httpservletrequest;
import javax.servlet.http.httpservletresponse;
import java.io.ioexception;
/**
 * 请求日志
 *
 * @author francis
 * @create: 2023-08-31 10:15
 **/
@component
@slf4j
public class operationlogfilter extends onceperrequestfilter {
    @override
    protected void dofilterinternal(httpservletrequest request, httpservletresponse response, filterchain filterchain) throws servletexception, ioexception {
        log.info("operationlogfilter ...");
        /**
         * 操作日志记录 ...
         */
        // 放行
        filterchain.dofilter(request, response);
    }
}

securityconfiguration 配置

import com.security.filter.jwtauthenticationtokenfilter;
import com.security.filter.operationlogfilter;
import org.springframework.beans.factory.annotation.autowired;
import org.springframework.context.annotation.bean;
import org.springframework.context.annotation.configuration;
import org.springframework.security.authentication.authenticationmanager;
import org.springframework.security.config.annotation.web.builders.httpsecurity;
import org.springframework.security.config.annotation.web.configuration.enablewebsecurity;
import org.springframework.security.config.annotation.web.configuration.websecurityconfigureradapter;
import org.springframework.security.config.http.sessioncreationpolicy;
import org.springframework.security.web.authentication.usernamepasswordauthenticationfilter;
/**
 * security 配置类
 *
 * @author francis
 * @create: 2023-08-30 14:19
 **/
@configuration
@enablewebsecurity
public class securityconfiguration extends websecurityconfigureradapter {
    @autowired
    private jwtauthenticationtokenfilter jwtauthenticationtokenfilter;
    @autowired
    private operationlogfilter operationlogfilter;
    @override
    protected void configure(httpsecurity http) throws exception {
        http
                // 关闭csrf
                .csrf().disable()
                // 不通过 session 获取 securitycontext
                .sessionmanagement().sessioncreationpolicy(sessioncreationpolicy.stateless)
                .and()
                    .authorizerequests()
                        // 对于登录接口 允许匿名访问
                        .antmatchers("/login")
                            .permitall()
                        // 除上面外的所有请求全部需要鉴权认证
                        .anyrequest()
                            .authenticated();
        // 在 usernamepasswordauthenticationfilter（验证用户） 之前执行
        // todo 需要注意的是下面过滤器的顺序就是执行的顺序，使用 @order 也没办法改变
        http
        		// 登录是否过期
                .addfilterbefore(jwtauthenticationtokenfilter, usernamepasswordauthenticationfilter.class)
                // 请求日志
                .addfilterbefore(operationlogfilter, usernamepasswordauthenticationfilter.class);
    }
    @bean
    @override
    public authenticationmanager authenticationmanagerbean() throws exception {
        return super.authenticationmanagerbean();
    }
}

到此这篇关于spring security 使用 onceperrequestfilter 过滤器校验登录过期、请求日志等操作的文章就介绍到这了,更多相关spring security onceperrequestfilter 过滤器内容请搜索代码网以前的文章或继续浏览下面的相关文章希望大家以后多多支持代码网！