四、用JSON作前后端分离的交互

在Spring Reactive Security中，Security过滤器是通过类ServerHttpSecurity配置的，用户认证过滤器是AuthenticationWebFilter，相当于SpringSecurity中的UsernamePasswordAuthenticationFilter。

在AuthenticationWebFilter中，用户名和密码的解析是通过 ServerAuthenticationConverter实现的。但是在ServerHttpSecurity的内部类表单配置类FormLoginSpec没有ServerAuthenticationConverter的配置属性：

	private final RedirectServerAuthenticationSuccessHandler defaultSuccessHandler = new RedirectServerAuthenticationSuccessHandler(
			"/");

	private RedirectServerAuthenticationEntryPoint defaultEntryPoint;

	private ReactiveAuthenticationManager authenticationManager;

	private ServerSecurityContextRepository securityContextRepository;

	private ServerAuthenticationEntryPoint authenticationEntryPoint;

	private boolean isEntryPointExplicit;

	private ServerWebExchangeMatcher requiresAuthenticationMatcher;

	private ServerAuthenticationFailureHandler authenticationFailureHandler;

	private ServerAuthenticationSuccessHandler authenticationSuccessHandler = this.defaultSuccessHandler;

	private FormLoginSpec() {
	}

同时在ServerHttpSecurity没有替换过滤器的方法，只有添加过滤器的方法。所以要想解析JSON参数，必须要自定义AuthenticationWebFilter。

修改配置类MyReactiveSecurityConfig：

@Configuration
@Slf4j
public class MyReactiveSecurityConfig {
    @Autowired
    private ReactiveUserDetailsService reactiveUserDetailsService;

    @Autowired(required = false)
    private ReactiveUserDetailsPasswordService userDetailsPasswordService;


    private final static String LOGIN_PAGE="/doLogin";

//    @Bean
//    public ReactiveUserDetailsService reactiveUserDetailsService() {
//        UserDetails user = User.withUsername("user")
//                .password("12345")
//                .roles("USER")
//                .build();
//        return new MapReactiveUserDetailsService(user);
//    }

//    @Bean
//    public PasswordEncoder passwordEncoder() {
//        return NoOpPasswordEncoder.getInstance();
//    }

    @Bean
    public PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }

    @Bean
    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        http
                .authorizeExchange(exchanges -> exchanges
                        .pathMatchers(LOGIN_PAGE).permitAll()
                        .anyExchange().authenticated()
                )
                .httpBasic().disable()
                .formLogin().disable()
                .csrf().disable();

        http.addFilterAt(authenticationManager(), SecurityWebFiltersOrder.FORM_LOGIN);
        return http.build();
    }


    @Bean
    public ReactiveAuthenticationManager userDetailsRepositoryReactiveAuthenticationManager() {
        UserDetailsRepositoryReactiveAuthenticationManager manager = new UserDetailsRepositoryReactiveAuthenticationManager(this.reactiveUserDetailsService);
        manager.setPasswordEncoder(passwordEncoder());
        manager.setUserDetailsPasswordService(this.userDetailsPasswordService);
        return manager;
    }

    @Bean
    public AuthenticationWebFilter authenticationManager() {
        AuthenticationWebFilter authenticationFilter = new AuthenticationWebFilter(userDetailsRepositoryReactiveAuthenticationManager());
        authenticationFilter.setRequiresAuthenticationMatcher(ServerWebExchangeMatchers.pathMatchers(HttpMethod.POST, LOGIN_PAGE));
        authenticationFilter.setAuthenticationFailureHandler((webFilterExchange, exception) -> {
            log.info("认证异常",exception);
            ServerWebExchange exchange = webFilterExchange.getExchange();

            exchange.getResponse().getHeaders().add("Content-type", MediaType.APPLICATION_JSON_UTF8_VALUE);

            Flux<DataBuffer> dataBufferFlux = DataBufferUtils.read(new ByteArrayResource("认证失败".getBytes(StandardCharsets.UTF_8)), exchange.getResponse().bufferFactory(), 1024 * 8);

            return exchange.getResponse().writeAndFlushWith(t -> {
                t.onNext(dataBufferFlux);
                t.onComplete();
            });
        });
        authenticationFilter.setAuthenticationConverter(new JsonServerAuthenticationConverter());
        authenticationFilter.setAuthenticationSuccessHandler((webFilterExchange, authentication) -> {
            log.info("认证成功:{}",authentication);
            ServerWebExchange exchange = webFilterExchange.getExchange();

            exchange.getResponse().getHeaders().add("Content-type", MediaType.APPLICATION_JSON_UTF8_VALUE);

            Flux<DataBuffer> dataBufferFlux = DataBufferUtils.read(new ByteArrayResource("认证成功".getBytes(StandardCharsets.UTF_8)), exchange.getResponse().bufferFactory(), 1024 * 8);

            return exchange.getResponse().writeAndFlushWith(t -> {
                t.onNext(dataBufferFlux);
                t.onComplete();
            });
        });
        authenticationFilter.setSecurityContextRepository(new WebSessionServerSecurityContextRepository());
        return authenticationFilter;
    }
}

配置SecurityWebFilterChain时将httpBasic，formLogin，csrf全部禁止了。禁用csrf是为了演示方便。禁用httpBasic，formLogin这两个是为了只能用JSON格式参数才能登陆。同时要自定义AuthenticationWebFilter。增加的ReactiveAuthenticationManager是为了配置AuthenticationWebFilter的authenticationManagerResolver属性。同时重定义JsonServerAuthenticationConverter解析JSON参数。setAuthenticationFailureHandler处理认证失败的场景。setAuthenticationSuccessHandler处理认证成功的场景。都是返回JSON数据。

@Slf4j
public class JsonServerAuthenticationConverter extends ServerFormLoginAuthenticationConverter {

    private ObjectMapper objectMapper = new ObjectMapper();

    private String usernameParameter = "username";

    private String passwordParameter = "password";


    public JsonServerAuthenticationConverter() {

    }

    public JsonServerAuthenticationConverter(String usernameParameter,String passwordParameter) {
        this.usernameParameter = usernameParameter;
        this.passwordParameter = passwordParameter;
    }

    public Mono<Authentication> apply(ServerWebExchange exchange) {
        Flux<DataBuffer> body = exchange.getRequest().getBody();

        return body.map(t -> {
            String s = t.toString(StandardCharsets.UTF_8);
            log.info("参数:{}",s);
            Map<String , Object> map = null;
            try {
                map = objectMapper.readValue(s, Map.class);
            } catch (JsonProcessingException e) {
               log.info("解析JSON参数异常",e);
               map = null;
            }

            if (map != null && !map.isEmpty()) {
               String username = (String) map.get(usernameParameter);
               String password = (String) map.get(passwordParameter);

                Authentication unauthenticated = UsernamePasswordAuthenticationToken.unauthenticated(username, password);
                return unauthenticated;
            }

            return null;
        }).next();
    }
}

从请求中获取JSON数据，解析成Map，根据用户名参数和密码参数构造Authentication。最后的next是为了将Flux转成Mono。因为返回值是Mono类型。ServerFormLoginAuthenticationConverter是org.springframework.security.web.server.authentication.ServerFormLoginAuthenticationConverter。

Authentication unauthenticated = UsernamePasswordAuthenticationToken.unauthenticated(username, password);

这个是必须的。不然在我的IDEA上一直提示类型不同。

用Postman演示：
 

 

在访问其他接口：
 

 

在演示认证失败：
 

 

还可以试下用浏览器是否可以登录。