与servlet Api 的集成
与servlet Api 的集成
流光韶逝 发表于6个月前
与servlet Api 的集成
  • 发表于 6个月前
  • 阅读 22
  • 收藏 0
  • 点赞 0
  • 评论 0

腾讯云 技术升级10大核心产品年终让利>>>   

摘要: 在servlet中调用spring security的组件

Servlet APi 集成

##Servlet 2.5+ Integration 15.1.1 HttpServletRequest.getRemoteUser()得到用户名.

###15.1.2 HttpServletRequest.getUserPrincipal() HttpServletRequest.getUserPrincipal()得到SecurityContextHolder.getContext().getAuthentication()的信息.

Authentication auth = httpServletRequest.getUserPrincipal();
// assume integrated custom UserDetails called MyCustomUserDetails
// by default, typically instance of UserDetails
MyCustomUserDetails userDetails = (MyCustomUserDetails) auth.getPrincipal();
String firstName = userDetails.getFirstName();
String lastName = userDetails.getLastName();

###15.1.3 HttpServletRequest.isUserInRole(String)

是否有角色

boolean isAdmin = httpServletRequest.isUserInRole("ADMIN");

##15.2 Servlet 3+ Integration

15.2.1 HttpServletRequest.authenticate(HttpServletRequest,HttpServletResponse)

HttpServletRequest.authenticate(HttpServletRequest,HttpServletResponse) 可以保证用户被认证.如果用户没被认证,AuthenticaitonEntryPoint触发认证.

###15.2.2 HttpServletRequest.login(String,String)

登陆

try {
httpServletRequest.login("user","password");
} catch(ServletException e) {
// fail to authenticate
}

###15.2.3 HttpServletRequest.logout() 登出

###AsyncContext.start(Runnable) 异步操作

final AsyncContext async = httpServletRequest.startAsync();
async.start(new Runnable() {
	public void run() {
		Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
		try {
			final HttpServletResponse asyncResponse = (HttpServletResponse) async.getResponse();
			asyncResponse.setStatus(HttpServletResponse.SC_OK);
			asyncResponse.getWriter().write(String.valueOf(authentication));
			async.complete();
		} catch(Exception e) {
			throw new RuntimeException(e);
		}
	}
});

异步输出用户信息 ###Async Servlet Support servlet至少是3.0

<web-app xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
version="3.0">

</web-app>

下一步添加DelegatingFilterProxy的异步支持

filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>
	org.springframework.web.filter.DelegatingFilterProxy
</filter-class>
<async-supported>true</async-supported>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>ASYNC</dispatcher>
</filter-mapping>

##15.3 Servlet 3.1+ Integration ###15.3.1 HttpServletRequest#changeSessionId() 可以用来对抗session固定攻击.

共有 人打赏支持
粉丝 18
博文 88
码字总数 124661
×
流光韶逝
如果觉得我的文章对您有用,请随意打赏。您的支持将鼓励我继续创作!
* 金额(元)
¥1 ¥5 ¥10 ¥20 其他金额
打赏人
留言
* 支付类型
微信扫码支付
打赏金额:
已支付成功
打赏金额: