| commit | author | age | ||
| 9bcb19 | 1 | /* |
| I | 2 | Copyright [2020] [https://www.xiaonuo.vip] |
| 3 | ||
| 4 | Licensed under the Apache License, Version 2.0 (the "License"); | |
| 5 | you may not use this file except in compliance with the License. | |
| 6 | You may obtain a copy of the License at | |
| 7 | ||
| 8 | http://www.apache.org/licenses/LICENSE-2.0 | |
| 9 | ||
| 10 | Unless required by applicable law or agreed to in writing, software | |
| 11 | distributed under the License is distributed on an "AS IS" BASIS, | |
| 12 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| 13 | See the License for the specific language governing permissions and | |
| 14 | limitations under the License. | |
| 15 | ||
| 16 | Snowy采用APACHE LICENSE 2.0开源协议，您在使用过程中，需要注意以下几点： | |
| 17 | ||
| 18 | 1.请不要删除和修改根目录下的LICENSE文件。 | |
| 19 | 2.请不要删除和修改Snowy源码头部的版权声明。 | |
| 20 | 3.请保留源码和相关描述文件的项目出处，作者声明等。 | |
| 21 | 4.分发源码时候，请注明软件出处 https://gitee.com/xiaonuobase/snowy | |
| 22 | 5.在修改包名，模块名称，项目代码等时，请注明软件出处 https://gitee.com/xiaonuobase/snowy | |
| 23 | 6.若您的项目无法满足以上几点，可申请商业授权，获取Snowy商业授权许可，请在官网购买授权，地址为 https://www.xiaonuo.vip | |
| 24 | */ | |
| 25 | package vip.xiaonuo.sys.core.filter.security; | |
| 26 | ||
| 27 | import cn.hutool.core.util.ObjectUtil; | |
| 28 | import cn.hutool.core.util.StrUtil; | |
| 29 | import cn.hutool.log.Log; | |
| 30 | import org.springframework.beans.factory.annotation.Autowired; | |
| 31 | import org.springframework.stereotype.Component; | |
| 32 | import org.springframework.web.filter.OncePerRequestFilter; | |
| 33 | import vip.xiaonuo.core.context.requestno.RequestNoContext; | |
| 34 | import vip.xiaonuo.core.exception.AuthException; | |
| 35 | import vip.xiaonuo.core.exception.enums.ServerExceptionEnum; | |
| 36 | import vip.xiaonuo.core.pojo.login.SysLoginUser; | |
| 37 | import vip.xiaonuo.core.util.ResponseUtil; | |
| 38 | import vip.xiaonuo.sys.modular.auth.service.AuthService; | |
| 39 | ||
| 40 | import javax.servlet.FilterChain; | |
| 41 | import javax.servlet.ServletException; | |
| 42 | import javax.servlet.http.HttpServletRequest; | |
| 43 | import javax.servlet.http.HttpServletResponse; | |
| 44 | import java.io.IOException; | |
| 45 | ||
| 46 | /** | |
| 47 | * 这个过滤器，在所有请求之前，也在spring security filters之前 | |
| 48 | * <p>z | |
| 49 | * 这个过滤器的作用是：接口在进业务之前，添加登录上下文（SecurityContext） | |
| 50 | * <p> | |
| 51 | * 因为现在没有用session了，只能token来校验当前的登录人的身份，所以在进业务之前要给当前登录人设置登录状态 | |
| 52 | * | |
| 53 | * @author yubaoshan，xuyuxiang | |
| 54 | * @date 2020/4/11 13:02 | |
| 55 | */ | |
| 56 | @Component | |
| 57 | public class JwtAuthenticationTokenFilter extends OncePerRequestFilter { | |
| 58 | ||
| 59 | private static final Log log = Log.get(); | |
| 60 | ||
| 61 | @Autowired | |
| 62 | private AuthService authService; | |
| 63 | ||
| 64 | @Override | |
| 65 | protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException { | |
| 66 | try { | |
| 67 | doFilter(request, response, filterChain); | |
| 68 | } catch (Exception e) { | |
| 69 | log.error(">>> 服务器运行异常，请求号为：{}，具体信息为：{}", RequestNoContext.get(), e.getMessage()); | |
| 70 | ResponseUtil.responseExceptionError(response, ServerExceptionEnum.SERVER_ERROR.getCode(), | |
| 71 | ServerExceptionEnum.SERVER_ERROR.getMessage(), e.getStackTrace()[0].toString()); | |
| 72 | } | |
| 73 | } | |
| 74 | ||
| 75 | private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException, ServletException { | |
| 76 | ||
| 77 | // 1.如果当前请求带了token，判断token时效性，并获取当前登录用户信息 | |
| 78 | SysLoginUser sysLoginUser = null; | |
| 79 | try { | |
| 80 | String token = authService.getTokenFromRequest(request); | |
| 81 | if (StrUtil.isNotEmpty(token)) { | |
| 82 | sysLoginUser = authService.getLoginUserByToken(token); | |
| 83 | } | |
| 84 | } catch (AuthException ae) { | |
| 85 | //token过期或者token失效的情况，响应给前端 | |
| 86 | ResponseUtil.responseExceptionError(response, ae.getCode(), ae.getErrorMessage(), ae.getStackTrace()[0].toString()); | |
| 87 | return; | |
| 88 | } | |
| 89 | ||
| 90 | // 2.如果当前登录用户不为空，就设置spring security上下文 | |
| 91 | if (ObjectUtil.isNotNull(sysLoginUser)) { | |
| 92 | authService.setSpringSecurityContextAuthentication(sysLoginUser); | |
| 93 | } | |
| 94 | ||
| 95 | // 3.其他情况放开过滤 | |
| 96 | filterChain.doFilter(request, response); | |
| 97 | ||
| 98 | } | |
| 99 | ||
| 100 | } | |
