微服务之间的通讯安全(四)-JWT优化之日志、错误处理、限流及JWT改造后执行流程梳理

/**
 * 审计过滤器
 *
 * @author caofanqi
 * @date 2020/2/9 22:06
 */
@Slf4j
public class GatewayAuditLogFilter extends OncePerRequestFilter {


    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {

        String username = (String) SecurityContextHolder.getContext().getAuthentication().getPrincipal();

        log.info("1、create log for :{}",username);

        filterChain.doFilter(request,response);

        log.info("2、update log to success");

    }

}

/**
 * 网关资源服务器配置
 *
 * @author caofanqi
 * @date 2020/2/8 22:30
 */
@Configuration
@EnableResourceServer
public class GatewayResourceServerConfig extends ResourceServerConfigurerAdapter {


    @Resource
    private GatewayWebSecurityExpressionHandler gatewayWebSecurityExpressionHandler;

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources
                .resourceId("gateway")
                //表达式处理器
                .expressionHandler(gatewayWebSecurityExpressionHandler);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
                .addFilterBefore(new GatewayAuditLogFilter(), ExceptionTranslationFilter.class)
                .authorizeRequests()
                //放过申请令牌的请求不需要身份认证
                .antMatchers("/token/**").permitAll()
                //其他所有请求是否有权限，要通过permissionService的hasPermission方法进行判断
                .anyRequest().access("#permissionService.hasPermission(request,authentication)");
    }

}

/**
 * 403 拒绝访问处理器
 *
 * @author caofanqi
 * @date 2020/2/9 22:37
 */
@Slf4j
@Component
public class GatewayAccessDeniedHandler extends OAuth2AccessDeniedHandler {

    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException authException) throws IOException, ServletException {

        log.info("2、update log to 403");
        //做一个标记，让日志过滤器知道已经更新日志了
        request.setAttribute("updateLog","yes");
        //这里可以自定义返回内容，我们就不改了，使用OAuth2AccessDeniedHandler默认的
        super.handle(request, response, authException);

    }
}

/**
 * 权限控制实现类
 *
 * @author caofanqi
 * @date 2020/2/9 14:51
 */
@Slf4j
@Service
public class PermissionServiceImpl implements PermissionService {

    /**
     * 在这里可以去安全中心，获取该请求是否具有相应的权限
     *
     * @param request        请求
     * @param authentication 认证相关信息
     */
    @Override
    public boolean hasPermission(HttpServletRequest request, Authentication authentication) {

        //这里我们就不写具体的权限判断了，采用随机数模拟,百分之50的机率可以访问
        log.info("request uri : {}", request.getRequestURI());
        log.info("authentication : {}", ReflectionToStringBuilder.toString(authentication));

        /*
         * 如果是没传令牌的话，Authentication 是 AnonymousAuthenticationToken
         * 如果传入令牌经过身份认证 Authentication 是 OAuth2Authentication
         */
        if (authentication instanceof AnonymousAuthenticationToken){
            //要求必须通过身份认证
            throw new AccessTokenRequiredException(null);
        }

        boolean  hasPermission =  RandomUtils.nextInt() % 2 == 0;
        log.info("hasPermission is :{}",hasPermission);
        return hasPermission;
    }

}

/**
 * 401身份验证处理
 *
 * @author caofanqi
 * @date 2020/2/9 23:13
 */
@Slf4j
@Component
public class GatewayAuthenticationEntryPoint extends OAuth2AuthenticationEntryPoint {


    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {

        if(authException instanceof AccessTokenRequiredException){
            //是我们抛出的必须经过身份认证，说明没有传令牌，此时是匿名用户，请求经过了日志过滤器
            log.info("2、update log to 401");
        }else {
            //说明令牌是错误的，认证那里就不对，没有经过日志过滤器
            log.info("1、create log to 401");
        }

        //做一个标记，让日志过滤器知道已经更新日志了
        request.setAttribute("updateLog","yes");
        super.commence(request, response, authException);
    }
}

        <dependency>
            <groupId>com.google.guava</groupId>
            <artifactId>guava</artifactId>
            <version>28.0-jre</version>
        </dependency>

/**
 * 限流过滤器
 *
 * @author caofanqi
 * @date 2020/2/9 23:54
 */
public class GatewayRateLimitFilter extends OncePerRequestFilter {

    private RateLimiter rateLimiter = RateLimiter.create(1);

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {

        if (rateLimiter.tryAcquire()) {
            filterChain.doFilter(request, response);
        } else {
            response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());
            response.setContentType(MediaType.APPLICATION_JSON_VALUE);
            response.getWriter().write("{\"error\":\"too many request\"}");
            response.getWriter().flush();
        }

    }
}