解析SpringSecurity+JWT认证流程实现

public interface SecurityContext extends Serializable {
 // 获取Authentication对象
 Authentication getAuthentication();

 // 放入Authentication对象
 void setAuthentication(Authentication authentication);
}

public class SecurityContextHolder {

 public static void clearContext() {
 strategy.clearContext();
 }

 public static SecurityContext getContext() {
 return strategy.getContext();
 }
  
  public static void setContext(SecurityContext context) {
 strategy.setContext(context);
 }

}

public interface Authentication extends Principal, Serializable {
 
 Collection<? extends GrantedAuthority> getAuthorities();
 Object getCredentials();
 Object getDetails();
 Object getPrincipal();
 boolean isAuthenticated();
 void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException;
}

public interface AuthenticationManager {
 // 认证方法
 Authentication authenticate(Authentication authentication)
  throws AuthenticationException;
}

  <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-security</artifactId>
    </dependency>

    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-web</artifactId>
    </dependency>

    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-validation</artifactId>
    </dependency>
    
    <dependency>
      <groupId>io.jsonwebtoken</groupId>
      <artifactId>jjwt</artifactId>
      <version>0.9.0</version>
    </dependency>
    
    <dependency>
      <groupId>com.baomidou</groupId>
      <artifactId>mybatis-plus-boot-starter</artifactId>
      <version>3.3.0</version>
    </dependency>
    
    <dependency>
      <groupId>mysql</groupId>
      <artifactId>mysql-connector-java</artifactId>
      <version>5.1.47</version>
    </dependency>

 @Bean
  public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
  }

@Bean
  public AuthenticationManager authenticationManager() throws Exception {
    return super.authenticationManager();
  }

public class CustomUserDetailsService implements UserDetailsService {
  @Autowired
  private UserService userService;
  @Autowired
  private RoleInfoService roleInfoService;
  @Override
  public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
    log.debug("开始登陆验证，用户名为: {}",s);

    // 根据用户名验证用户
    QueryWrapper<UserInfo> queryWrapper = new QueryWrapper<>();
    queryWrapper.lambda().eq(UserInfo::getLoginAccount,s);
    UserInfo userInfo = userService.getOne(queryWrapper);
    if (userInfo == null) {
      throw new UsernameNotFoundException("用户名不存在，登陆失败。");
    }

    // 构建UserDetail对象
    UserDetail userDetail = new UserDetail();
    userDetail.setUserInfo(userInfo);
    List<RoleInfo> roleInfoList = roleInfoService.listRoleByUserId(userInfo.getUserId());
    userDetail.setRoleInfoList(roleInfoList);
    return userDetail;
  }
}

@Override
  public ApiResult login(String loginAccount, String password) {
    // 1 创建UsernamePasswordAuthenticationToken
    UsernamePasswordAuthenticationToken usernameAuthentication = new UsernamePasswordAuthenticationToken(loginAccount, password);
    // 2 认证
    Authentication authentication = this.authenticationManager.authenticate(usernameAuthentication);
    // 3 保存认证信息
    SecurityContextHolder.getContext().setAuthentication(authentication);
    // 4 生成自定义token
    UserDetail userDetail = (UserDetail) authentication.getPrincipal();
    AccessToken accessToken = jwtProvider.createToken((UserDetails) authentication.getPrincipal());

    // 5 放入缓存
    caffeineCache.put(CacheName.USER, userDetail.getUsername(), userDetail);
    return ApiResult.ok(accessToken);
  }

// AbstractUserDetailsAuthenticationProvider

public Authentication authenticate(Authentication authentication){

 // 校验未认证的Authentication对象里面有没有用户名
 String username = (authentication.getPrincipal() == null) ? "NONE_PROVIDED"
  : authentication.getName(); 
  
   boolean cacheWasUsed = true;
   // 从缓存中去查用户名为XXX的对象
 UserDetails user = this.userCache.getUserFromCache(username);

   // 如果没有就进入到这个方法
 if (user == null) {
  cacheWasUsed = false;

  try {
        // 调用我们重写UserDetailsService的loadUserByUsername方法
        // 拿到我们自己组装好的UserDetails对象
  user = retrieveUser(username,
   (UsernamePasswordAuthenticationToken) authentication);
  }
  catch (UsernameNotFoundException notFound) {
  logger.debug("User '" + username + "' not found");

  if (hideUserNotFoundExceptions) {
   throw new BadCredentialsException(messages.getMessage(
    "AbstractUserDetailsAuthenticationProvider.badCredentials",
    "Bad credentials"));
  }
  else {
   throw notFound;
  }
  }

  Assert.notNull(user,
   "retrieveUser returned null - a violation of the interface contract");
 }
  
  try {
     // 校验账号是否禁用
  preAuthenticationChecks.check(user);
     // 校验数据库查出来的密码，和我们传入的密码是否一致
  additionalAuthenticationChecks(user,
   (UsernamePasswordAuthenticationToken) authentication);
 }


}

@Bean
  public JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter() {
    return new JwtAuthenticationTokenFilter();
  }

@Override
  protected void configure(HttpSecurity http) throws Exception {
    http.addFilterBefore(jwtAuthenticationTokenFilter(),
            UsernamePasswordAuthenticationFilter.class);
  }

@Override
  protected void doFilterInternal(@NotNull HttpServletRequest request,
                  @NotNull HttpServletResponse response,
                  @NotNull FilterChain chain) throws ServletException, IOException {
    log.info("JWT过滤器通过校验请求头token进行自动登录...");

    // 拿到Authorization请求头内的信息
    String authToken = jwtProvider.getToken(request);

    // 判断一下内容是否为空且是否为(Bearer )开头
    if (StrUtil.isNotEmpty(authToken) && authToken.startsWith(jwtProperties.getTokenPrefix())) {
      // 去掉token前缀(Bearer )，拿到真实token
      authToken = authToken.substring(jwtProperties.getTokenPrefix().length());

      // 拿到token里面的登录账号
      String loginAccount = jwtProvider.getSubjectFromToken(authToken);

      if (StrUtil.isNotEmpty(loginAccount) && SecurityContextHolder.getContext().getAuthentication() == null) {
        // 缓存里查询用户，不存在需要重新登陆。
        UserDetail userDetails = caffeineCache.get(CacheName.USER, loginAccount, UserDetail.class);

        // 拿到用户信息后验证用户信息与token
        if (userDetails != null && jwtProvider.validateToken(authToken, userDetails)) {

          // 组装authentication对象，构造参数是Principal Credentials 与 Authorities
          // 后面的拦截器里面会用到 grantedAuthorities 方法
          UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, userDetails.getPassword(), userDetails.getAuthorities());

          // 将authentication信息放入到上下文对象中
          SecurityContextHolder.getContext().setAuthentication(authentication);

          log.info("JWT过滤器通过校验请求头token自动登录成功, user : {}", userDetails.getUsername());
        }
      }
    }

    chain.doFilter(request, response);
  }