Spring Boot API认证：会话管理与JWT令牌策略

// 不推荐的会话验证方式
public ResponseEntity<?> createMessage(@RequestBody MessageCreateRequest messageCreateRequest, HttpSession session) {
    if (session.getAttribute("valid") != null && (Boolean) session.getAttribute("valid")) {
        // 业务逻辑
        return new ResponseEntity<>("Message created!", HttpStatus.OK);
    }
    return new ResponseEntity<>("Invalid Session", HttpStatus.UNAUTHORIZED);
}

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.config.http.SessionCreationPolicy;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            // 配置请求授权
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/online").permitAll() // 允许所有人访问登录接口
                .anyRequest().authenticated() // 其他所有请求都需要认证
            )
            // 配置会话管理
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.ALWAYS) // 总是创建会话
            )
            // 禁用CSRF保护，因为REST API通常不使用会话，或者通过其他方式处理
            // 如果你的API会话敏感，请考虑启用并妥善处理CSRF
            .csrf(csrf -> csrf.disable())
            // 启用HTTP Basic认证或表单登录，根据需要选择
            // .httpBasic(Customizer.withDefaults()); // 启用HTTP Basic认证
            // .formLogin(Customizer.withDefaults()); // 启用表单登录
            ;
        return http.build();
    }

    // 你可能还需要一个UserDetailsService和PasswordEncoder来处理用户认证
    // @Bean
    // public UserDetailsService userDetailsService() {
    //     UserDetails user = User.withDefaultPasswordEncoder()
    //         .username("user")
    //         .password("password")
    //         .roles("USER")
    //         .build();
    //     return new InMemoryUserDetailsManager(user);
    // }
}

import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.http.ResponseEntity;
import org.springframework.http.HttpStatus;
import jakarta.servlet.http.HttpSession; // 注意：此处的HttpSession在实际认证后会被Spring Security管理

@RestController
public class OnlineMapping {
    // @Autowired
    // private UserRepository userRepository; // 假设有一个用户仓库

    @PostMapping(path = "/online")
    public ResponseEntity<?> onlineRequest(@RequestBody OnlineRequest onlineRequest, HttpSession session) {
        // 实际应用中，这里会通过Spring Security的认证管理器进行认证
        // 例如，通过AuthenticationManager.authenticate(new UsernamePasswordAuthenticationToken(...))
        // 如果认证成功，Spring Security会自动创建或更新会话，并设置JSESSIONID
        // 如果认证失败，则返回401

        // 简化示例：假设认证成功
        if ("user".equals(onlineRequest.username) && "password".equals(onlineRequest.password)) {
            // Spring Security会处理会话的创建和JSESSIONID的设置
            // 你无需手动设置session.setAttribute("valid", true);
            return new ResponseEntity<>("You are now online, Enjoy!", HttpStatus.OK);
        } else {
            // 认证失败，Spring Security会处理会话的无效化
            return new ResponseEntity<>("Invalid login", HttpStatus.valueOf(401));
        }
    }
}

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.config.http.SessionCreationPolicy;

@Configuration
@EnableWebSecurity
public class JwtSecurityConfig {

    // 假设你有一个JWK Set URI或者一个静态的公钥
    // private final String jwkSetUri = "http://localhost:8080/oauth2/jwks"; // 示例

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/online").permitAll() // 登录接口可能不需要JWT
                .anyRequest().authenticated() // 其他所有请求都需要JWT认证
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt.decoder(jwtDecoder())) // 配置JWT解码器
            )
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS) // JWT通常是无状态的
            )
            .csrf(csrf -> csrf.disable()); // REST API通常禁用CSRF
        return http.build();
    }

    @Bean
    public JwtDecoder jwtDecoder() {
        // 这里需要配置你的JWT解码逻辑
        // 如果你使用授权服务器，通常会配置JWK Set URI
        // return NimbusJwtDecoder.withJwkSetUri(this.jwkSetUri).build();

        // 如果你使用对称密钥，可以这样配置
        // SecretKey secretKey = Keys.hmacShaKeyFor("your-secret-key-that-is-at-least-32-bytes-long".getBytes());
        // return NimbusJwtDecoder.withSecretKey(secretKey).build();

        // 这是一个占位符，实际应用中需要根据你的JWT提供方进行配置
        throw new UnsupportedOperationException("JWT Decoder must be configured with a valid JWK Set URI or Secret Key.");
    }
}