(资料图片)

登录接口实现细节分析

登陆接口　　　

接下我们需要自定义登陆接口，然后让SpringSecurity对这个接口放行,让用户访问这个接口的时候不用登录也能访问。

​在接口中我们通过AuthenticationManager的authenticate方法来进行用户认证,所以需要在SecurityConfig中配置把AuthenticationManager注入容器。

​　　认证成功的话要生成一个jwt，放入响应中返回。并且为了让用户下回请求时能通过jwt识别出具体的是哪个用户，我们需要把用户信息存入redis，可以把用户id作为key。

登录接口代码实现

package com.example.qinghuatokendemo.Controller;import com.example.qinghuatokendemo.Domain.ResponseResult;import com.example.qinghuatokendemo.Domain.User;import com.example.qinghuatokendemo.Service.LoginServcie;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.web.bind.annotation.*;@RestControllerpublic class LoginController {    @Autowired    private LoginServcie loginServcie;    @PostMapping("/user/login")    public ResponseResult login(@RequestBody User user){        //登录        return loginServcie.login(user);    }}

package com.example.qinghuatokendemo.Config;import org.springframework.context.annotation.Bean;import org.springframework.context.annotation.Configuration;import org.springframework.security.authentication.AuthenticationManager;import org.springframework.security.config.annotation.web.builders.HttpSecurity;import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;import org.springframework.security.config.http.SessionCreationPolicy;import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;import org.springframework.security.crypto.password.PasswordEncoder;@Configurationpublic class SecurityConfig extends WebSecurityConfigurerAdapter {      //创建BCryptPasswordEncoder注入容器    @Bean    public PasswordEncoder passwordEncoder(){        return new BCryptPasswordEncoder();    }    @Bean    @Override    public AuthenticationManager authenticationManagerBean() throws Exception {        return super.authenticationManagerBean();    }    @Override    protected void configure(HttpSecurity http) throws Exception {        http                //关闭csrf                .csrf().disable()                //不通过Session获取SecurityContext                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)                .and()                .authorizeRequests()                // 对于登录接口 允许匿名访问                .antMatchers("/user/login").anonymous()                // 除上面外的所有请求全部需要鉴权认证                .anyRequest().authenticated();    }}

package com.example.qinghuatokendemo.Service.impl;import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;import com.example.qinghuatokendemo.Domain.LoginUser;import com.example.qinghuatokendemo.Domain.User;import com.example.qinghuatokendemo.Mapper.UserMapper;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.security.core.userdetails.UserDetails;import org.springframework.security.core.userdetails.UserDetailsService;import org.springframework.security.core.userdetails.UsernameNotFoundException;import org.springframework.stereotype.Service;import java.util.Objects;@Servicepublic class UserDetailsServiceImpl implements UserDetailsService {    @Autowired    private UserMapper userMapper;    @Override    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {        //查询用户信息        LambdaQueryWrapper queryWrapper = new LambdaQueryWrapper<>();        queryWrapper.eq(User::getUserName,username);        User user = userMapper.selectOne(queryWrapper);        //如果没有查询到用户就抛出异常        if (Objects.isNull(user)){            throw new RuntimeException("用户名或者密码错误");        }        //查询对应的权限信息        //把数据封装成UserDetails返回        return new LoginUser(user);    }}

打开redis以后

测试接口

关键词：