Spring Security 图片验证码功能的实例代码

package com.imooc.security.core.validate.code;
import java.awt.image.BufferedImage;
import java.time.LocalDateTime;
import java.time.LocalTime;
/**
 * 验证码
 * ClassName: ImageCode 
 * @Description: 验证码
 * @author lihaoyang
 * @date 2018年3月1日
 */
public class ImageCode {
 private BufferedImage image;
 private String code;
 private LocalDateTime expireTime;//过期时间点
 /**
 * 
 * <p>Description: </p>
 * @param image
 * @param code
 * @param expireTn 多少秒过期
 */
 public ImageCode(BufferedImage image, String code, int expireTn) {
 super();
 this.image = image;
 this.code = code;
 //过期时间=当前时间+过期秒数 
 this.expireTime = LocalDateTime.now().plusSeconds(expireTn);
 }
 public ImageCode(BufferedImage image, String code, LocalDateTime expireTime) {
 super();
 this.image = image;
 this.code = code;
 this.expireTime = expireTime;
 }
 /**
 * 验证码是否过期
 * @Description: 验证码是否过期
 * @param @return true 过期，false 没过期
 * @return boolean true 过期，false 没过期
 * @throws
 * @author lihaoyang
 * @date 2018年3月2日
 */
 public boolean isExpired(){
 return LocalDateTime.now().isAfter(expireTime);
 }
 public BufferedImage getImage() {
 return image;
 }
 public void setImage(BufferedImage image) {
 this.image = image;
 }
 public String getCode() {
 return code;
 }
 public void setCode(String code) {
 this.code = code;
 }
 public LocalDateTime getExpireTime() {
 return expireTime;
 }
 public void setExpireTime(LocalDateTime expireTime) {
 this.expireTime = expireTime;
 }
}

/** 
 * @Title: ValidateCodeException.java
 * @Package com.imooc.security.core.validate.code
 * @Description: TODO
 * @author lihaoyang
 * @date 2018年3月2日
 */
package com.imooc.security.core.validate.code;
import org.springframework.security.core.AuthenticationException;
/**
 * ClassName: ValidateCodeException 
 * @Description: 验证码错误异常，继承spring security的认证异常
 * @author lihaoyang
 * @date 2018年3月2日
 */
public class ValidateCodeException extends AuthenticationException {
 /**
 * @Fields serialVersionUID : TODO
 */
 private static final long serialVersionUID = 1L;
 public ValidateCodeException(String msg) {
 super(msg);
 }
}

package com.imooc.security.core.validate.code;
import java.io.IOException;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.lang.StringUtils;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.social.connect.web.HttpSessionSessionStrategy;
import org.springframework.social.connect.web.SessionStrategy;
import org.springframework.web.bind.ServletRequestBindingException;
import org.springframework.web.bind.ServletRequestUtils;
import org.springframework.web.context.request.ServletWebRequest;
import org.springframework.web.filter.OncePerRequestFilter;
/**
 * 处理登录验证码过滤器
 * ClassName: ValidateCodeFilter 
 * @Description:
 * OncePerRequestFilter：spring提供的工具，保证过滤器每次只会被调用一次
 * @author lihaoyang
 * @date 2018年3月2日
 */
public class ValidateCodeFilter extends OncePerRequestFilter{
 //认证失败处理器
 private AuthenticationFailureHandler authenticationFailureHandler;
 //获取session工具类
 private SessionStrategy sessionStrategy = new HttpSessionSessionStrategy();
 @Override
 protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
  throws ServletException, IOException {
 //如果是 登录请求 则执行
 if(StringUtils.equals("/authentication/form", request.getRequestURI())
  &&StringUtils.equalsIgnoreCase(request.getMethod(), "post")){
  try {
  validate(new ServletWebRequest(request));
  } catch (ValidateCodeException e) {
  //调用错误处理器，最终调用自己的
  authenticationFailureHandler.onAuthenticationFailure(request, response, e);
  return ;//结束方法，不再调用过滤器链
  }
 }
 //不是登录请求，调用其它过滤器链
 filterChain.doFilter(request, response);
 }
 /**
 * 校验验证码
 * @Description: 校验验证码
 * @param @param request
 * @param @throws ServletRequestBindingException 
 * @return void 
 * @throws ValidateCodeException
 * @author lihaoyang
 * @date 2018年3月2日
 */
 private void validate(ServletWebRequest request) throws ServletRequestBindingException {
 //拿出session中的ImageCode对象
 ImageCode imageCodeInSession = (ImageCode) sessionStrategy.getAttribute(request, ValidateCodeController.SESSION_KEY);
 //拿出请求中的验证码
 String imageCodeInRequest = ServletRequestUtils.getStringParameter(request.getRequest(), "imageCode");
 //校验
 if(StringUtils.isBlank(imageCodeInRequest)){
  throw new ValidateCodeException("验证码不能为空");
 }
 if(imageCodeInSession == null){
  throw new ValidateCodeException("验证码不存在，请刷新验证码");
 }
 if(imageCodeInSession.isExpired()){
  //从session移除过期的验证码
  sessionStrategy.removeAttribute(request, ValidateCodeController.SESSION_KEY);
  throw new ValidateCodeException("验证码已过期，请刷新验证码");
 }
 if(!StringUtils.equalsIgnoreCase(imageCodeInSession.getCode(), imageCodeInRequest)){
  throw new ValidateCodeException("验证码错误");
 }
 //验证通过，移除session中验证码
 sessionStrategy.removeAttribute(request, ValidateCodeController.SESSION_KEY);
 }
 public AuthenticationFailureHandler getAuthenticationFailureHandler() {
 return authenticationFailureHandler;
 }
 public void setAuthenticationFailureHandler(AuthenticationFailureHandler authenticationFailureHandler) {
 this.authenticationFailureHandler = authenticationFailureHandler;
 }
}

package com.imooc.security.core.validate.code;
import java.io.IOException;
import javax.imageio.ImageIO;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.social.connect.web.HttpSessionSessionStrategy;
import org.springframework.social.connect.web.SessionStrategy;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.context.request.ServletWebRequest;
/**
 * 验证码Control
 * ClassName: ValidateCodeController 
 * @Description: TODO
 * @author lihaoyang
 * @date 2018年3月1日
 */
@RestController
public class ValidateCodeController {
 public static final String SESSION_KEY = "SESSION_KEY_IMAGE_CODE"; 
 //获取session
 private SessionStrategy sessionStrategy = new HttpSessionSessionStrategy();
 @GetMapping("/verifycode/image")
 public void createCode(HttpServletRequest request,HttpServletResponse response) throws IOException{
 ImageCode imageCode = createImageCode(request, response);
 sessionStrategy.setAttribute(new ServletWebRequest(request), SESSION_KEY, imageCode);
 ImageIO.write(imageCode.getImage(), "JPEG", response.getOutputStream());
 }
 private ImageCode createImageCode(HttpServletRequest request, HttpServletResponse response) {
 VerifyCode verifyCode = new VerifyCode();
 return new ImageCode(verifyCode.getImage(),verifyCode.getText(),60);
 }
}

package com.imooc.security.browser;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import com.imooc.security.core.properties.SecurityProperties;
import com.imooc.security.core.validate.code.ValidateCodeFilter;
@Configuration //这是一个配置
public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter{
 //读取用户配置的登录页配置
 @Autowired
 private SecurityProperties securityProperties;
 //自定义的登录成功后的处理器
 @Autowired
 private AuthenticationSuccessHandler imoocAuthenticationSuccessHandler;
 //自定义的认证失败后的处理器
 @Autowired
 private AuthenticationFailureHandler imoocAuthenticationFailureHandler;
 //注意是org.springframework.security.crypto.password.PasswordEncoder
 @Bean
 public PasswordEncoder passwordencoder(){
 //BCryptPasswordEncoder implements PasswordEncoder
 return new BCryptPasswordEncoder();
 }
 //版本二：可配置的登录页
 @Override
 protected void configure(HttpSecurity http) throws Exception {
 //验证码过滤器
 ValidateCodeFilter validateCodeFilter = new ValidateCodeFilter();
 //验证码过滤器中使用自己的错误处理
 validateCodeFilter.setAuthenticationFailureHandler(imoocAuthenticationFailureHandler);
 //实现需要认证的接口跳转表单登录,安全=认证+授权
 //http.httpBasic() //这个就是默认的弹框认证
 //
 http.addFilterBefore(validateCodeFilter, UsernamePasswordAuthenticationFilter.class)//把验证码过滤器加载登录过滤器前边
  .formLogin() //表单认证
  .loginPage("/authentication/require") //处理用户认证BrowserSecurityController
  //登录过滤器UsernamePasswordAuthenticationFilter默认登录的url是"/login"，在这能改
  .loginProcessingUrl("/authentication/form") 
  .successHandler(imoocAuthenticationSuccessHandler)//自定义的认证后处理器
  .failureHandler(imoocAuthenticationFailureHandler) //登录失败后的处理
  .and()
  .authorizeRequests() //下边的都是授权的配置
  // /authentication/require：处理登录，securityProperties.getBrowser().getLoginPage():用户配置的登录页
  .antMatchers("/authentication/require",
   securityProperties.getBrowser().getLoginPage(),//放过登录页不过滤，否则报错
   "/verifycode/image").permitAll() //验证码
  .anyRequest() //任何请求
  .authenticated() //都需要身份认证
  .and()
  .csrf().disable() //关闭csrf防护
  ; 
 }
}

<body>
 demo 登录页. <br>
 <form action="/authentication/form" method="post">
 <table>
  <tr>
  <td>用户名：</td>
  <td><input type="text" name="username"/></td>
  <td></td>
  </tr>
  <tr>
  <td>密码：</td>
  <td><input type="password" name="password"/></td>
  <td></td>
  </tr>
  <tr>
  <td>验证码：</td>
  <td>
   <input width="100" type="text" name="imageCode"/>
  </td>
  <td>
   <img src="/verifycode/image"/>
  </td>
  </tr>
  <tr>
  <td colspan="2" align="right"><button type="submit">登录</button></td>
  </tr>
 </table>
 </form>
 </body>

#验证码 图片宽、高、字符个数
imooc.security.code.image.width = 100
imooc.security.code.image.height = 30
imooc.security.code.image.length = 6

package com.imooc.security.core.properties;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.context.annotation.Configuration;
/**
 * 自定义配置项
 * ClassName: SecurityProperties 
 * @Description: 自定义配置项
 * 这个类会读取application.properties里所有以imooc.security开头的配置项
 * 
 * imooc.security.browser.loginPage = /demo-login.html
 * 其中的browser的配置会读取到BrowserProperties中去
 * 这是以点分割的，一级一级的和类的属性对应
 * @author lihaoyang
 * @date 2018年2月28日
 */
@ConfigurationProperties(prefix="imooc.security")
public class SecurityProperties {
 private BrowserProperties browser = new BrowserProperties();
 private ValidateCodeProperties code = new ValidateCodeProperties();
 public BrowserProperties getBrowser() {
 return browser;
 }
 public void setBrowser(BrowserProperties browser) {
 this.browser = browser;
 }
 public ValidateCodeProperties getCode() {
 return code;
 }
 public void setCode(ValidateCodeProperties code) {
 this.code = code;
 }
}

package com.imooc.security.core.properties;
/**
 * 验证码配置
 * ClassName: ValidateCodeProperties 
 * @Description: 验证码配置,验证码有图片验证码、短信验证码等，所以再包一层
 * @author lihaoyang
 * @date 2018年3月2日
 */
public class ValidateCodeProperties {
 //默认配置
 private ImageCodeProperties image = new ImageCodeProperties();
 public ImageCodeProperties getImage() {
 return image;
 }
 public void setImage(ImageCodeProperties image) {
 this.image = image;
 }
}

package com.imooc.security.core.properties;
/**
 * 图片验证码配置类
 * ClassName: ImageCodeProperties 
 * @Description: 图片验证码配置类
 * @author lihaoyang
 * @date 2018年3月2日
 */
public class ImageCodeProperties {
 //图片宽
 private int width = 67;
 //图片高
 private int height = 23;
 //验证码字符个数
 private int length = 4;
 //过期时间
 private int expireIn = 60;
 public int getWidth() {
 return width;
 }
 public void setWidth(int width) {
 this.width = width;
 }
 public int getHeight() {
 return height;
 }
 public void setHeight(int height) {
 this.height = height;
 }
 public int getLength() {
 return length;
 }
 public void setLength(int length) {
 this.length = length;
 }
 public int getExpireIn() {
 return expireIn;
 }
 public void setExpireIn(int expireIn) {
 this.expireIn = expireIn;
 }
}

private ImageCode createImageCode(HttpServletRequest request, HttpServletResponse response) {
 //先从request里读取有没有长、宽、字符个数参数，有的话就用，没有用默认的
 int width = ServletRequestUtils.getIntParameter(request, "width",securityProperties.getCode().getImage().getWidth());
 int height = ServletRequestUtils.getIntParameter(request, "height",securityProperties.getCode().getImage().getHeight());
 int charLength = this.securityProperties.getCode().getImage().getLength();
 VerifyCode verifyCode = new VerifyCode(width,height,charLength);
 return new ImageCode(verifyCode.getImage(),verifyCode.getText(),this.securityProperties.getCode().getImage().getExpireIn());
 }

public VerifyCode(int w, int h, int charLength) {
 super();
 this.w = w;
 this.h = h;
 this.charLength = charLength;
 }

<img src="/verifycode/image?width=200"/>

/**
 * 处理登录验证码过滤器
 * ClassName: ValidateCodeFilter 
 * @Description:
 * 继承OncePerRequestFilter：spring提供的工具，保证过滤器每次只会被调用一次
 * 实现 InitializingBean接口的目的：
 * 在其他参数都组装完毕的时候，初始化需要拦截的urls的值
 * @author lihaoyang
 * @date 2018年3月2日
 */
public class ValidateCodeFilter extends OncePerRequestFilter implements InitializingBean{
 //认证失败处理器
 private AuthenticationFailureHandler authenticationFailureHandler;
 //获取session工具类
 private SessionStrategy sessionStrategy = new HttpSessionSessionStrategy();
 //需要拦截的url集合
 private Set<String> urls = new HashSet<>();
 //读取配置
 private SecurityProperties securityProperties;
 //spring工具类
 private AntPathMatcher antPathMatcher = new AntPathMatcher();
 @Override
 public void afterPropertiesSet() throws ServletException {
 super.afterPropertiesSet();
 //读取配置的拦截的urls
 String[] configUrls = StringUtils.splitByWholeSeparatorPreserveAllTokens(securityProperties.getCode().getImage().getUrl(), ",");
 for (String configUrl : configUrls) {
  urls.add(configUrl);
 }
 //登录的请求一定拦截
 urls.add("/authentication/form");
 }
 @Override
 protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
  throws ServletException, IOException {
 /**
  * 可配置的验证码校验
  * 判断请求的url和配置的是否有匹配的，匹配上了就过滤
  */
 boolean action = false;
 for(String url:urls){
  if(antPathMatcher.match(url, request.getRequestURI())){
  action = true;
  }
 }
 if(action){
  try {
  validate(new ServletWebRequest(request));
  } catch (ValidateCodeException e) {
  //调用错误处理器，最终调用自己的
  authenticationFailureHandler.onAuthenticationFailure(request, response, e);
  return ;//结束方法，不再调用过滤器链
  }
 }
 //不是登录请求，调用其它过滤器链
 filterChain.doFilter(request, response);
 }
 //省略无关代码，，，
}

#验证码拦截的接口配置
imooc.security.code.image.url = /user,/user/*

package com.imooc.security.core.validate.code;
import org.springframework.web.context.request.ServletWebRequest;
/**
 * 验证码生成接口
 * ClassName: ValidateCodeGenerator 
 * @Description: TODO
 * @author lihaoyang
 * @date 2018年3月2日
 */
public interface ValidateCodeGenerator {
 /**
 * 图片验证码生成接口
 * @Description: TODO
 * @param @param request
 * @param @return 
 * @return ImageCode 
 * @throws
 * @author lihaoyang
 * @date 2018年3月2日
 */
 ImageCode generator(ServletWebRequest request);
}

package com.imooc.security.core.validate.code;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.web.bind.ServletRequestUtils;
import org.springframework.web.context.request.ServletWebRequest;
import com.imooc.security.core.properties.SecurityProperties;
/**
 * 图片验证码生成类
 * ClassName: ImageCodeGenerator 
 * @Description: TODO
 * @author lihaoyang
 * @date 2018年3月2日
 */
public class ImageCodeGenerator implements ValidateCodeGenerator {
 @Autowired
 private SecurityProperties securityProperties;
 @Override
 public ImageCode generator(ServletWebRequest request) {
 //先从request里读取有没有长、宽、字符个数参数，有的话就用，没有用默认的
 int width = ServletRequestUtils.getIntParameter(request.getRequest(), "width",securityProperties.getCode().getImage().getWidth());
 int height = ServletRequestUtils.getIntParameter(request.getRequest(), "height",securityProperties.getCode().getImage().getHeight());
 int charLength = this.securityProperties.getCode().getImage().getLength();
 VerifyCode verifyCode = new VerifyCode(width,height,charLength);
 return new ImageCode(verifyCode.getImage(),verifyCode.getText(),this.securityProperties.getCode().getImage().getExpireIn());
 }
 public SecurityProperties getSecurityProperties() {
 return securityProperties;
 }
 public void setSecurityProperties(SecurityProperties securityProperties) {
 this.securityProperties = securityProperties;
 }
}

package com.imooc.security.core.validate.code;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import com.imooc.security.core.properties.SecurityProperties;
/**
 * 配置验证码生成接口ValidateCodeGenerator的实际实现类的Bean
 * ClassName: ValidateCodeBeanConfig 
 * @Description: 
 * 配置验证码生成接口ValidateCodeGenerator的实际实现类的Bean
 * 如图片验证码的实现、短信验证码的实现
 * @author lihaoyang
 * @date 2018年3月5日
 */
@Configuration
public class ValidateCodeBeanConfig {
 @Autowired
 private SecurityProperties securityProperties;
 /**
 * @Description: 
 * @ConditionalOnMissingBean注解意思是当spring容器不存在imageCodeGenerator时才给配置一个该bean
 * 作用是使程序更具可扩展性，该配置类是配置在core模块，这就意味着，如果引用该模块的项目
 * 如果有一个自己的实现，实现了ValidateCodeGenerator接口，定义了自己的实现，名字也叫imageCodeGenerator时，
 * 就用应用级别的实现，没有的话就用这个默认实现。
 * @param @return 
 * @return ValidateCodeGenerator 
 * @throws
 * @author lihaoyang
 * @date 2018年3月5日
 */
 @Bean
 @ConditionalOnMissingBean(name="imageCodeGenerator") 
 public ValidateCodeGenerator imageCodeGenerator(){ 
 ImageCodeGenerator codeGenerator = new ImageCodeGenerator();
 codeGenerator.setSecurityProperties(securityProperties);
 return codeGenerator;
 }
}

package com.imooc.code;
import org.springframework.stereotype.Component;
import org.springframework.web.context.request.ServletWebRequest;
import com.imooc.security.core.validate.code.ImageCode;
import com.imooc.security.core.validate.code.ValidateCodeGenerator;
@Component("imageCodeGenerator")
public class DemoImageCodeGenerator implements ValidateCodeGenerator {
 @Override
 public ImageCode generator(ServletWebRequest request) {
 System.err.println("demo项目实现的生成验证码，，，");
 return null;
 }
}