forgetest5
/
ifffff
mirror of https://gitee.com/maxjhandsome/pig
1
0
Fork 0
Code Issues Releases Wiki Activity

♻️ Refactoring code. #I1H9V8 继承原有BearerTokenExtractor 【优化】 接口对外暴露，不校验 Authentication Header 头

This commit is contained in:
torvalds 2020-05-15 16:28:04 +08:00
parent c29b9ede93
commit 7860d648ab
1 changed files with 13 additions and 75 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

88
pig-common/pig-common-security/src/main/java/com/pig4cloud/pig/common/security/component/PigBearerTokenExtractor.java
View File

@ -19,19 +19,14 @@
package com.pig4cloud.pig.common.security.component;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import lombok.RequiredArgsConstructor;
import org.springframework.security.core.Authentication;
import org.springframework.security.oauth2.common.OAuth2AccessToken;
import org.springframework.security.oauth2.provider.authentication.BearerTokenExtractor;
import org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationDetails;
import org.springframework.security.oauth2.provider.authentication.TokenExtractor;
import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.mvc.condition.PatternsRequestCondition;
import org.springframework.util.AntPathMatcher;
import org.springframework.util.PathMatcher;
import javax.servlet.http.HttpServletRequest;
import java.util.Enumeration;
/**
* 改造 {@link BearerTokenExtractor} 对公开权限的请求不进行校验
@ -40,73 +35,16 @@ import java.util.Enumeration;
* @date 2020.05.15
*/
@Component
public class PigBearerTokenExtractor implements TokenExtractor {
private final static Log logger = LogFactory.getLog(PigBearerTokenExtractor.class);
@RequiredArgsConstructor
public class PigBearerTokenExtractor extends BearerTokenExtractor {
private final PathMatcher pathMatcher = new AntPathMatcher();
private final PermitAllUrlProperties urlProperties;
private final PatternsRequestCondition patternsRequestCondition;
public PigBearerTokenExtractor(PermitAllUrlProperties permitAllUrl) {
this.patternsRequestCondition = new PatternsRequestCondition(
permitAllUrl.getUrls().toArray(new String[0])
);
}
@Override
public Authentication extract(HttpServletRequest request) {
if (this.patternsRequestCondition.getMatchingPatterns(request.getRequestURI()).size() > 0) {
return null;
}
String tokenValue = extractToken(request);
if (tokenValue != null) {
return new PreAuthenticatedAuthenticationToken(tokenValue, "");
}
return null;
}
protected String extractToken(HttpServletRequest request) {
// first check the header...
String token = extractHeaderToken(request);
// bearer type allows a request parameter as well
if (token == null) {
logger.debug("Token not found in headers. Trying request parameters.");
token = request.getParameter(OAuth2AccessToken.ACCESS_TOKEN);
if (token == null) {
logger.debug("Token not found in request parameters. Not an OAuth2 request.");
} else {
request.setAttribute(OAuth2AuthenticationDetails.ACCESS_TOKEN_TYPE, OAuth2AccessToken.BEARER_TYPE);
}
}
return token;
}
/**
* Extract the OAuth bearer token from a header.
*
* @param request The request.
* @return The token, or null if no OAuth authorization header was supplied.
*/
protected String extractHeaderToken(HttpServletRequest request) {
Enumeration<String> headers = request.getHeaders("Authorization");
while (headers.hasMoreElements()) { // typically there is only one (most servers enforce that)
String value = headers.nextElement();
if ((value.toLowerCase().startsWith(OAuth2AccessToken.BEARER_TYPE.toLowerCase()))) {
String authHeaderValue = value.substring(OAuth2AccessToken.BEARER_TYPE.length()).trim();
// Add this here for the auth details later. Would be better to change the signature of this method.
request.setAttribute(OAuth2AuthenticationDetails.ACCESS_TOKEN_TYPE,
value.substring(0, OAuth2AccessToken.BEARER_TYPE.length()).trim());
int commaIndex = authHeaderValue.indexOf(',');
if (commaIndex > 0) {
authHeaderValue = authHeaderValue.substring(0, commaIndex);
}
return authHeaderValue;
}
}
return null;
}
@Override
public Authentication extract(HttpServletRequest request) {
boolean match = urlProperties.getUrls().stream()
.anyMatch(url -> pathMatcher.match(url, request.getRequestURI()));
return match ? null : super.extract(request);
}
}