详解Spring Security如何配置JSON登录

/**   * Enables subclasses to override the composition of the password, such as by   * including additional values and a separator.   * <p>   * This might be used for example if a postcode/zipcode was required in addition to   * the password. A delimiter such as a pipe (|) should be used to separate the   * password and extended value(s). The <code>AuthenticationDao</code> will need to   * generate the expected password in a corresponding manner.   * </p>   *   * @param request so that request attributes can be retrieved   *   * @return the password that will be presented in the <code>Authentication</code>   * request token to the <code>AuthenticationManager</code>   */  protected String obtainPassword(HttpServletRequest request) {    return request.getParameter(passwordParameter);  }  /**   * Enables subclasses to override the composition of the username, such as by   * including additional values and a separator.   *   * @param request so that request attributes can be retrieved   *   * @return the username that will be presented in the <code>Authentication</code>   * request token to the <code>AuthenticationManager</code>   */  protected String obtainUsername(HttpServletRequest request) {    return request.getParameter(usernameParameter);  }

/** * AuthenticationFilter that supports rest login(json login) and form login. * @author chenhuanming */public class CustomAuthenticationFilter extends UsernamePasswordAuthenticationFilter {  @Override  public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {    //attempt Authentication when Content-Type is json    if(request.getContentType().equals(MediaType.APPLICATION_JSON_UTF8_VALUE)        ||request.getContentType().equals(MediaType.APPLICATION_JSON_VALUE)){      //use jackson to deserialize json      ObjectMapper mapper = new ObjectMapper();      UsernamePasswordAuthenticationToken authRequest = null;      try (InputStream is = request.getInputStream()){        AuthenticationBean authenticationBean = mapper.readValue(is,AuthenticationBean.class);        authRequest = new UsernamePasswordAuthenticationToken(            authenticationBean.getUsername(), authenticationBean.getPassword());      }catch (IOException e) {        e.printStackTrace();        new UsernamePasswordAuthenticationToken(            "", "");      }finally {        setDetails(request, authRequest);        return this.getAuthenticationManager().authenticate(authRequest);      }    }    //transmit it to UsernamePasswordAuthenticationFilter    else {      return super.attemptAuthentication(request, response);    }  }}

@Getter@Setterpublic class AuthenticationBean {  private String username;  private String password;}

@Overrideprotected void configure(HttpSecurity http) throws Exception {  http      .cors().and()      .antMatcher("/**").authorizeRequests()      .antMatchers("/", "/login**").permitAll()      .anyRequest().authenticated()      //这里必须要写formLogin()，不然原有的UsernamePasswordAuthenticationFilter不会出现，也就无法配置我们重新的UsernamePasswordAuthenticationFilter      .and().formLogin().loginPage("/")      .and().csrf().disable();  //用重写的Filter替换掉原有的UsernamePasswordAuthenticationFilter  http.addFilterAt(customAuthenticationFilter(),  UsernamePasswordAuthenticationFilter.class);}//注册自定义的UsernamePasswordAuthenticationFilter@BeanCustomAuthenticationFilter customAuthenticationFilter() throws Exception {  CustomAuthenticationFilter filter = new CustomAuthenticationFilter();  filter.setAuthenticationSuccessHandler(new SuccessHandler());  filter.setAuthenticationFailureHandler(new FailureHandler());  filter.setFilterProcessesUrl("/login/self");  //这句很关键，重用WebSecurityConfigurerAdapter配置的AuthenticationManager，不然要自己组装AuthenticationManager  filter.setAuthenticationManager(authenticationManagerBean());  return filter;}

@Override@Bean // share AuthenticationManager for web and oauthpublic AuthenticationManager authenticationManagerBean() throws Exception {  return super.authenticationManagerBean();}