security整合websocket

快速使用

@Configuration
@EnableWebSocketMessageBroker
public class WebSocketSecurityConfig
        extends AbstractSecurityWebSocketMessageBrokerConfigurer {
    @Autowired
    UserDetailsServiceImpl userDetailsService;

    @Autowired
    RedisTemplate<String,Object> redisTemplate;

    @Override
    public void registerStompEndpoints(StompEndpointRegistry registry) {
        registry.addEndpoint("/ws/chat").setAllowedOriginPatterns("*").withSockJS();
    }

    @Override
    public void configureMessageBroker(MessageBrokerRegistry registry) {
        registry.enableSimpleBroker("/queue");
    }
    @Override
    protected void configureInbound(MessageSecurityMetadataSourceRegistry messages) {
        messages.simpSubscribeDestMatchers("/queue").permitAll()
        .simpDestMatchers("/ws/chat").permitAll();
    }

    
    @Override
    protected boolean sameOriginDisabled() {
        return true; // 禁用 CSRF 验证
    }




}

一开始继承AbstractSecurityWebSocketMessageBrokerConfigurer类之后，发现无论如何都要经过CSRF拦截，建立连接总会被拦截。经过排查代码发现此类中重写的方法如下

@Override
public final void configureClientInboundChannel(ChannelRegistration registration) {
   ChannelSecurityInterceptor inboundChannelSecurity = this.context.getBean(ChannelSecurityInterceptor.class);
   registration.setInterceptors(this.context.getBean(SecurityContextChannelInterceptor.class));
    
   if (!sameOriginDisabled()) {
      registration.setInterceptors(this.context.getBean(CsrfChannelInterceptor.class));
   }
   if (this.inboundRegistry.containsMapping()) {
      registration.setInterceptors(inboundChannelSecurity);
   }
   customizeClientInboundChannel(registration);
}

发现sameOriginDisabled是默认写死

/**
 * <p>
 * Determines if a CSRF token is required for connecting. This protects against remote
 * sites from connecting to the application and being able to read/write data over the
 * connection. The default is false (the token is required).
 * </p>
 * <p>
 * Subclasses can override this method to disable CSRF protection
 * </p>
 * @return false if a CSRF token is required for connecting, else true
 */
/**
*该方法用于确定是否需要CSRF令牌进行连接。这样可以保护应用免受远程站点连接并能够通过连接读取/写入数据的攻击。默认值为false（需要令牌）。
*子类可以覆盖此方法以禁用CSRF保护。
*返回值：
*如果需要CSRF令牌进行连接，则返回false，否则返回true。
*/
protected boolean sameOriginDisabled() {
   return false;
}

所以要在子类中覆写这个方法 返回true，然后就绕过了同源策略

本人这里不懂为什么要继承这个类，网上搜是可以用来做身份默认校验，但是我如果用自定义的手段，这里的代码意义就不是很大了。比如我现在token是在请求头里传过来，然后要去redis里面去找。

@Configuration
@EnableWebSocketMessageBroker
public class WebScoketConfig implements WebSocketMessageBrokerConfigurer {
    @Autowired
    RedisTemplate<String,Object> redisTemplate;

    @Autowired
    UserDetailsServiceImpl userDetailsService;
    
    @Override
    public void configureClientInboundChannel(ChannelRegistration registration) {
        registration.interceptors(new ChannelInterceptor() {
            @Override
            public Message<?> preSend(Message<?> message, MessageChannel channel) {
                StompHeaderAccessor accessor = MessageHeaderAccessor.getAccessor(message, StompHeaderAccessor.class);
                if(StompCommand.CONNECT.equals(accessor.getCommand())){
                    System.out.println("进行验证----------------------------------------");
                    String token = accessor.getFirstNativeHeader("Authorization");
                    if (StrUtil.isBlank(token)) {
                        throw new PasswordExpiredException("未携带token");
                    }
                    Authentication authentication = (Authentication) redisTemplate.opsForValue().get(RedisConstant.AUTHENTICATION_CACHE_KEY_PREFIX + token);
                    if (ObjectUtil.isEmpty(authentication))
                        throw new PasswordExpiredException("token错误或失效，请重新登录");

                    userDetailsService.loadUserByUsername(authentication.getName());
                    accessor.setUser(authentication);
                }
                return message;
            }
        });
    }
}

然后就可以开一个controller接口用来建立链接了

@Controller
public class UserChatController {

    @Autowired
    SimpMessagingTemplate messagingTemplate;

    Logger logger = LoggerFactory.getLogger(UserChatController.class);
    @MessageMapping("/ws/chat")
    @SendTo("/queue")
    public void handleChat(Authentication authentication, ChatMsg msg) {
        System.out.println("执行到这里");
        String name = authentication.getName();
        msg.setFrom(name);
        System.out.println(name);
        System.out.println(msg.getTo());
        messagingTemplate.convertAndSendToUser(msg.getTo(),"/queue/chat",msg);
    }
}