SpringSecurity的RememberMe实现

本文链接https://www.jianshu.com/p/d619bb0909b

RememberMeAuthenticationFilter位于过滤器如下图位置

image.png

当所有的认证都不通过的时候，我们会调用这个过滤器进行身份验证

1.记住密码时候，将认证信息保存到session，并且持久化到数据库中

AbstractAuthenticationProcessingFilter是认证类的入口，在认证成功之后，将执行successfulAuthentication(request, response, chain, authResult);方法
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {

        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;

        if (!requiresAuthentication(request, response)) {
            chain.doFilter(request, response);

            return;
        }

        if (logger.isDebugEnabled()) {
            logger.debug("Request is to process authentication");
        }

        Authentication authResult;

        try {
            authResult = attemptAuthentication(request, response);
            if (authResult == null) {
                // return immediately as subclass has indicated that it hasn't completed
                // authentication
                return;
            }
            sessionStrategy.onAuthentication(authResult, request, response);
        }
        catch (InternalAuthenticationServiceException failed) {
            logger.error(
                    "An internal error occurred while trying to authenticate the user.",
                    failed);
            unsuccessfulAuthentication(request, response, failed);

            return;
        }
        catch (AuthenticationException failed) {
            // Authentication failed
            unsuccessfulAuthentication(request, response, failed);

            return;
        }

        // Authentication success
        if (continueChainBeforeSuccessfulAuthentication) {
            chain.doFilter(request, response);
        }

        successfulAuthentication(request, response, chain, authResult);
    }
successfulAuthentication(request, response, chain, authResult)这个方法具体实现如下：
    protected void successfulAuthentication(HttpServletRequest request,
            HttpServletResponse response, FilterChain chain, Authentication authResult)
            throws IOException, ServletException {

        if (logger.isDebugEnabled()) {
            logger.debug("Authentication success. Updating SecurityContextHolder to contain: "
                    + authResult);
        }

        SecurityContextHolder.getContext().setAuthentication(authResult);

        rememberMeServices.loginSuccess(request, response, authResult);

        // Fire event
        if (this.eventPublisher != null) {
            eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(
                    authResult, this.getClass()));
        }

        successHandler.onAuthenticationSuccess(request, response, authResult);
    }
（1）SecurityContextHolder.getContext().setAuthentication(authResult)将验证信息存入Spring的上下文中。
（2）rememberMeServices.loginSuccess(request, response, authResult)处理记住密码选项。他的具体实现在AbstractRememberMeServices这个抽象类中，当然这个类中的loginSuccess(request, response, authResult)也是什么都没干具体看如下代码;他讲要做的事情放在了onLoginSuccess(request, response, successfulAuthentication)方法里去做，这个方法在AbstractRememberMeServices的父类里PersistentTokenBasedRememberMeServices，我们接下来看看onLoginSuccess(request, response, successfulAuthentication)做了什么？
public final void loginSuccess(HttpServletRequest request,
            HttpServletResponse response, Authentication successfulAuthentication) {

        if (!rememberMeRequested(request, parameter)) {
            logger.debug("Remember-me login not requested.");
            return;
        }

        onLoginSuccess(request, response, successfulAuthentication);
    }
（3）PersistentTokenBasedRememberMeServices中的onLoginSuccess方法
    protected void onLoginSuccess(HttpServletRequest request,
            HttpServletResponse response, Authentication successfulAuthentication) {
        String username = successfulAuthentication.getName();

        logger.debug("Creating new persistent login for user " + username);

        PersistentRememberMeToken persistentToken = new PersistentRememberMeToken(
                username, generateSeriesData(), generateTokenData(), new Date());
        try {
            tokenRepository.createNewToken(persistentToken);
            addCookie(persistentToken, request, response);
        }
        catch (Exception e) {
            logger.error("Failed to save persistent token ", e);
        }
    }
（4）从验证信息里获取用户名，然后构造token以便持久化到数据库
PersistentRememberMeToken persistentToken = new PersistentRememberMeToken(
                username, generateSeriesData(), generateTokenData(), new Date());
（5）其中generateSeriesData()和generateTokenData()生成的是cookie的key和value
（6）tokenRepository.createNewToken(persistentToken);是将生成的token写入到数据库
（7）addCookie(persistentToken, request, response);将token写到浏览器客户端

2.记住密码后认证，Fileter入口是验证的入口

（1）SecurityContextHolder.getContext().getAuthentication() 这个是从上下文去获得验证，如果验证为null的时候，将会从数据库中获取认证
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;

        if (SecurityContextHolder.getContext().getAuthentication() == null) {
            Authentication rememberMeAuth = rememberMeServices.autoLogin(request,
                    response);

            if (rememberMeAuth != null) {
                // Attempt authenticaton via AuthenticationManager
                try {
                    rememberMeAuth = authenticationManager.authenticate(rememberMeAuth);

                    // Store to SecurityContextHolder
                    SecurityContextHolder.getContext().setAuthentication(rememberMeAuth);

                    onSuccessfulAuthentication(request, response, rememberMeAuth);

                    if (logger.isDebugEnabled()) {
                        logger.debug("SecurityContextHolder populated with remember-me token: '"
                                + SecurityContextHolder.getContext().getAuthentication()
                                + "'");
                    }

                    // Fire event
                    if (this.eventPublisher != null) {
                        eventPublisher
                                .publishEvent(new InteractiveAuthenticationSuccessEvent(
                                        SecurityContextHolder.getContext()
                                                .getAuthentication(), this.getClass()));
                    }

                    if (successHandler != null) {
                        successHandler.onAuthenticationSuccess(request, response,
                                rememberMeAuth);

                        return;
                    }

                }
                catch (AuthenticationException authenticationException) {
                    if (logger.isDebugEnabled()) {
                        logger.debug(
                                "SecurityContextHolder not populated with remember-me token, as "
                                        + "AuthenticationManager rejected Authentication returned by RememberMeServices: '"
                                        + rememberMeAuth
                                        + "'; invalidating remember-me token",
                                authenticationException);
                    }

                    rememberMeServices.loginFail(request, response);

                    onUnsuccessfulAuthentication(request, response,
                            authenticationException);
                }
            }

            chain.doFilter(request, response);
        }
        else {
            if (logger.isDebugEnabled()) {
                logger.debug("SecurityContextHolder not populated with remember-me token, as it already contained: '"
                        + SecurityContextHolder.getContext().getAuthentication() + "'");
            }

            chain.doFilter(request, response);
        }
    }
（2） 在doFilter中，如下下面代码中，是将用request取出cookie，用来验证；他的具体实现在AbstractRememberMeServices类里
Authentication rememberMeAuth = rememberMeServices.autoLogin(request,
                    response);
（3）AbstractRememberMeServices里autoLogin(request,response);具体实现如下代码。在函数的开始，extractRememberMeCookie(request)是获取cookie。String[] cookieTokens = decodeCookie(rememberMeCookie);是将cookie解码，传入user = processAutoLoginCookie(cookieTokens, request, response);中获取user；接下来我们看看是如何通过processAutoLoginCookie(cookieTokens, request, response)获取user的。
public final Authentication autoLogin(HttpServletRequest request,
            HttpServletResponse response) {
        String rememberMeCookie = extractRememberMeCookie(request);

        if (rememberMeCookie == null) {
            return null;
        }

        logger.debug("Remember-me cookie detected");

        if (rememberMeCookie.length() == 0) {
            logger.debug("Cookie was empty");
            cancelCookie(request, response);
            return null;
        }

        UserDetails user = null;

        try {
            String[] cookieTokens = decodeCookie(rememberMeCookie);
            user = processAutoLoginCookie(cookieTokens, request, response);
            userDetailsChecker.check(user);

            logger.debug("Remember-me cookie accepted");

            return createSuccessfulAuthentication(request, user);
        }
        catch (CookieTheftException cte) {
            cancelCookie(request, response);
            throw cte;
        }
        catch (UsernameNotFoundException noUser) {
            logger.debug("Remember-me login was valid but corresponding user not found.",
                    noUser);
        }
        catch (InvalidCookieException invalidCookie) {
            logger.debug("Invalid remember-me cookie: " + invalidCookie.getMessage());
        }
        catch (AccountStatusException statusInvalid) {
            logger.debug("Invalid UserDetails: " + statusInvalid.getMessage());
        }
        catch (RememberMeAuthenticationException e) {
            logger.debug(e.getMessage());
        }

        cancelCookie(request, response);
        return null;
    }
（4）他的具体实现没有在AbstractRememberMeServices类里，仅仅定义了processAutoLoginCookie(cookieTokens, request, response)的抽象方法，他的实现方法在他的子类PersistentTokenBasedRememberMeServices;

final String presentedSeries = cookieTokens[0]; final String presentedToken = cookieTokens[1]; 获取cookie的key和value

PersistentRememberMeToken token = tokenRepository .getTokenForSeries(presentedSeries); 将key传入，到数据库查询到对应的key的value

if (token == null) {
            // No series match, so we can't authenticate using this cookie
            throw new RememberMeAuthenticationException(
                    "No persistent token found for series id: " + presentedSeries);
}

如果token是空，抛出异常

将信息组成一个token，然后更新token，并将cookie写到浏览器

    PersistentRememberMeToken newToken = new PersistentRememberMeToken(
                token.getUsername(), token.getSeries(), generateTokenData(), new Date());

        try {
            tokenRepository.updateToken(newToken.getSeries(), newToken.getTokenValue(),
                    newToken.getDate());
            addCookie(newToken, request, response);
        }

最后将 UserDetails类型的对象返回！

protected UserDetails processAutoLoginCookie(String[] cookieTokens,
            HttpServletRequest request, HttpServletResponse response) {

        if (cookieTokens.length != 2) {
            throw new InvalidCookieException("Cookie token did not contain " + 2
                    + " tokens, but contained '" + Arrays.asList(cookieTokens) + "'");
        }

        final String presentedSeries = cookieTokens[0];
        final String presentedToken = cookieTokens[1];

        PersistentRememberMeToken token = tokenRepository
                .getTokenForSeries(presentedSeries);

        if (token == null) {
            // No series match, so we can't authenticate using this cookie
            throw new RememberMeAuthenticationException(
                    "No persistent token found for series id: " + presentedSeries);
        }

        // We have a match for this user/series combination
        if (!presentedToken.equals(token.getTokenValue())) {
            // Token doesn't match series value. Delete all logins for this user and throw
            // an exception to warn them.
            tokenRepository.removeUserTokens(token.getUsername());

            throw new CookieTheftException(
                    messages.getMessage(
                            "PersistentTokenBasedRememberMeServices.cookieStolen",
                            "Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack."));
        }

        if (token.getDate().getTime() + getTokenValiditySeconds() * 1000L < System
                .currentTimeMillis()) {
            throw new RememberMeAuthenticationException("Remember-me login has expired");
        }

        // Token also matches, so login is valid. Update the token value, keeping the
        // *same* series number.
        if (logger.isDebugEnabled()) {
            logger.debug("Refreshing persistent login token for user '"
                    + token.getUsername() + "', series '" + token.getSeries() + "'");
        }

        PersistentRememberMeToken newToken = new PersistentRememberMeToken(
                token.getUsername(), token.getSeries(), generateTokenData(), new Date());

        try {
            tokenRepository.updateToken(newToken.getSeries(), newToken.getTokenValue(),
                    newToken.getDate());
            addCookie(newToken, request, response);
        }
        catch (Exception e) {
            logger.error("Failed to update token: ", e);
            throw new RememberMeAuthenticationException(
                    "Autologin failed due to data access problem");
        }

        return getUserDetailsService().loadUserByUsername(token.getUsername());
    }
（5）我们再次回到AbstractRememberMeServices类，来看看autoLogin(HttpServletRequest request,HttpServletResponse response)中，返回的user对象；

user = processAutoLoginCookie(cookieTokens, request, response);
userDetailsChecker.check(user);校验，校验不成功，会抛出异常

return createSuccessfulAuthentication(request, user);验证成功，返回验证信息

       public final Authentication autoLogin(HttpServletRequest request,
            HttpServletResponse response) {
        String rememberMeCookie = extractRememberMeCookie(request);

        if (rememberMeCookie == null) {
            return null;
        }

        logger.debug("Remember-me cookie detected");

        if (rememberMeCookie.length() == 0) {
            logger.debug("Cookie was empty");
            cancelCookie(request, response);
            return null;
        }

        UserDetails user = null;

        try {
            String[] cookieTokens = decodeCookie(rememberMeCookie);
            user = processAutoLoginCookie(cookieTokens, request, response);
            userDetailsChecker.check(user);

            logger.debug("Remember-me cookie accepted");

            return createSuccessfulAuthentication(request, user);
        }
最后编辑于 ：
©著作权归作者所有,转载或内容合作请联系作者
【社区内容提示】社区部分内容疑似由AI辅助生成，浏览时请结合常识与多方信息审慎甄别。
平台声明：文章内容（如有图片或视频亦包括在内）由作者上传并发布，文章内容仅代表作者本人观点，简书系信息发布平台，仅提供信息存储服务。

相关阅读更多精彩内容

  • Mobile BI 移动商务智能的身份认证
    这篇文章介绍了Mobile BI(移动商务智能)使用过程中涉及的各种身份认证的方式，主要目的是对这些方式的原理进行...
    雨_树阅读 2,258评论 1赞 2
  • 理解Cookie和Session机制
    会话（Session）跟踪是Web程序中常用的技术，用来跟踪用户的整个会话。常用的会话跟踪技术是Cookie与Se...
    chinariver阅读 5,769评论 1赞 49
  • Django
    利用HTTP协议向服务器传参的几种途径、响应、Cookie、Session、类视图、中间件 注意： 1>Dja...
    Cestine阅读 1,462评论 0赞 2
  • Find_Sec_Bugs检测项
    1、不安全的随机数生成，在CSRF TOKEN生成、password reset token生成等，会造成toke...
    nightmare丿阅读 3,970评论 0赞 1
  • CSRF漏洞详细说明--转
    http://www.91ri.org/tag/fuzz-bug 通常情况下，有三种方法被广泛用来防御CSRF攻击...
    jdyzm阅读 4,371评论 0赞 5

友情链接更多精彩内容