Spring Security实现微信公众号网页授权功能

<dependency>

           <groupId>org.springframework.boot</groupId>

           <artifactId>spring-boot-starter-security</artifactId>

       </dependency>

       <dependency>

           <groupId>org.springframework.boot</groupId>

           <artifactId>spring-boot-starter-oauth2-client</artifactId>

       </dependency>

{baseUrl}/oauth2/authorization/{registrationId}

/**

  * 兼容微信的oauth2 端点.

  *

  * @author n1

  * @since 2021 /8/11 17:04

  */

public class WechatOAuth2AuthRequestBuilderCustomizer {

    private static final String WECHAT_ID= "wechat" ;

     /**

      * Customize.

      *

      * @param builder the builder

      */

     public static void customize(OAuth2AuthorizationRequest.Builder builder) {

        String regId = (String) builder.build()

                .getAttributes()

                .get(OAuth2ParameterNames.REGISTRATION_ID);

        if (WECHAT_ID.equals(regId)){

            builder.authorizationRequestUri(WechatOAuth2RequestUriBuilderCustomizer::customize);

        }

     }

     /**

      * 定制微信OAuth2请求URI

      *

      * @author n1

      * @since 2021 /8/11 15:31

      */

     private static class WechatOAuth2RequestUriBuilderCustomizer {

         /**

          * 默认情况下Spring Security会生成授权链接：

          * {@code https://open.weixin.qq.com/connect/oauth2/authorize?response_type=code

          * &client_id=wxdf9033184b238e7f

          * &scope=snsapi_userinfo

          * &state=5NDiQTMa9ykk7SNQ5-OIJDbIy9RLaEVzv3mdlj8TjuE%3D

          * &redirect_uri=https%3A%2F%2Fmovingsale-h5-test.nashitianxia.com}

          * 缺少了微信协议要求的{@code #wechat_redirect}，同时 {@code client_id}应该替换为{@code app_id}

          *

          * @param builder the builder

          * @return the uri

          */

         public static URI customize(UriBuilder builder) {

             String reqUri = builder.build().toString()

                     .replaceAll( "client_id=" , "appid=" )

                     .concat( "#wechat_redirect" );

             return URI.create(reqUri);

         }

     }

}

/**

  * 用来从{@link javax.servlet.http.HttpServletRequest}中检索Oauth2需要的参数并封装成OAuth2请求对象{@link OAuth2AuthorizationRequest}

  *

  * @param clientRegistrationRepository the client registration repository

  * @return DefaultOAuth2AuthorizationRequestResolver

  */

private OAuth2AuthorizationRequestResolver oAuth2AuthorizationRequestResolver(ClientRegistrationRepository clientRegistrationRepository) {

     DefaultOAuth2AuthorizationRequestResolver resolver = new DefaultOAuth2AuthorizationRequestResolver(clientRegistrationRepository,

             OAuth2AuthorizationRequestRedirectFilter.DEFAULT_AUTHORIZATION_REQUEST_BASE_URI);

     resolver.setAuthorizationRequestCustomizer(WechatOAuth2AuthRequestBuilderCustomizer::customize);

     return resolver;

}

httpSecurity.oauth2Login()

                //  定制化授权端点的参数封装

                .authorizationEndpoint().authorizationRequestResolver(authorizationRequestResolver)

GET https: //api.weixin.qq.com/sns/oauth2/refresh_token?appid=APPID&grant_type=refresh_token&refresh_token=REFRESH_TOKEN

private MultiValueMap<String, String> buildWechatQueryParameters(OAuth2AuthorizationCodeGrantRequest authorizationCodeGrantRequest) {

        // 获取微信的客户端配置

        ClientRegistration clientRegistration = authorizationCodeGrantRequest.getClientRegistration();

        OAuth2AuthorizationExchange authorizationExchange = authorizationCodeGrantRequest.getAuthorizationExchange();

        MultiValueMap<String, String> formParameters = new LinkedMultiValueMap<>();

        // grant_type

        formParameters.add(OAuth2ParameterNames.GRANT_TYPE, authorizationCodeGrantRequest.getGrantType().getValue());

        // code

        formParameters.add(OAuth2ParameterNames.CODE, authorizationExchange.getAuthorizationResponse().getCode());

        // 如果有redirect-uri

        String redirectUri = authorizationExchange.getAuthorizationRequest().getRedirectUri();

        if (redirectUri != null ) {

            formParameters.add(OAuth2ParameterNames.REDIRECT_URI, redirectUri);

        }

        //appid

        formParameters.add( "appid" , clientRegistration.getClientId());

        //secret

        formParameters.add( "secret" , clientRegistration.getClientSecret());

        return formParameters;

    }

@Override

     public RequestEntity<?> convert(OAuth2AuthorizationCodeGrantRequest authorizationCodeGrantRequest) {

         ClientRegistration clientRegistration = authorizationCodeGrantRequest.getClientRegistration();

         HttpHeaders headers = getTokenRequestHeaders(clientRegistration);

         String tokenUri = clientRegistration.getProviderDetails().getTokenUri();

         // 针对微信的定制  WECHAT_ID表示为微信公众号专用的registrationId

         if (WECHAT_ID.equals(clientRegistration.getRegistrationId())) {

             MultiValueMap<String, String> queryParameters = this .buildWechatQueryParameters(authorizationCodeGrantRequest);

             URI uri = UriComponentsBuilder.fromUriString(tokenUri).queryParams(queryParameters).build().toUri();

             return RequestEntity.get(uri).headers(headers).build();

         }

         // 其它 客户端

         MultiValueMap<String, String> formParameters = this .buildFormParameters(authorizationCodeGrantRequest);

         URI uri = UriComponentsBuilder.fromUriString(tokenUri).build()

                 .toUri();

         return new RequestEntity<>(formParameters, headers, HttpMethod.POST, uri);

     }

/**

     * 调用token-uri去请求授权服务器获取token的OAuth2 Http 客户端

     *

     * @return OAuth2AccessTokenResponseClient

     */

    private OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> accessTokenResponseClient() {

        DefaultAuthorizationCodeTokenResponseClient tokenResponseClient = new DefaultAuthorizationCodeTokenResponseClient();

        tokenResponseClient.setRequestEntityConverter( new WechatOAuth2AuthorizationCodeGrantRequestEntityConverter());

        OAuth2AccessTokenResponseHttpMessageConverter tokenResponseHttpMessageConverter = new OAuth2AccessTokenResponseHttpMessageConverter();

        // 微信返回的content-type 是 text-plain

        tokenResponseHttpMessageConverter.setSupportedMediaTypes(Arrays.asList(MediaType.APPLICATION_JSON,

                MediaType.TEXT_PLAIN,

                new MediaType( "application" , "*+json" )));

        // 兼容微信解析

        tokenResponseHttpMessageConverter.setTokenResponseConverter( new WechatMapOAuth2AccessTokenResponseConverter());

        RestTemplate restTemplate = new RestTemplate(

                Arrays.asList( new FormHttpMessageConverter(),

                        tokenResponseHttpMessageConverter

                ));

        restTemplate.setErrorHandler( new OAuth2ErrorResponseErrorHandler());

        tokenResponseClient.setRestOperations(restTemplate);

        return tokenResponseClient;

    }

// 获取token端点配置  比如根据code 获取 token              

httpSecurity.oauth2Login()

    .tokenEndpoint().accessTokenResponseClient(accessTokenResponseClient)

@FunctionalInterface

public interface OAuth2UserService<R extends OAuth2UserRequest, U extends OAuth2User> {

     U loadUser(R userRequest) throws OAuth2AuthenticationException;

}

/**

  * 微信授权的OAuth2User用户信息

  *

  * @author n1

  * @since 2021/8/12 17:37

  */

@Data

public class WechatOAuth2User implements OAuth2User {

     private String openid;

     private String nickname;

     private Integer sex;

     private String province;

     private String city;

     private String country;

     private String headimgurl;

     private List<String> privilege;

     private String unionid;

     @Override

     public Map<String, Object> getAttributes() {

         // 原本返回前端token 但是微信给的token比较敏感 所以不返回

         return Collections.emptyMap();

     }

     @Override

     public Collection<? extends GrantedAuthority> getAuthorities() {

         // 这里放scopes 或者其它你业务逻辑相关的用户权限集 目前没有什么用

         return null ;

     }

     @Override

     public String getName() {

         // 用户唯一标识比较合适，这个不能为空啊，如果你能保证unionid不为空，也是不错的选择。

         return openid;

     }

}

LinkedMultiValueMap<String, String> queryParams = new LinkedMultiValueMap<>();

// access_token

queryParams.add(OAuth2ParameterNames.ACCESS_TOKEN, userRequest.getAccessToken().getTokenValue());

// openid

queryParams.add(OPENID_KEY, String.valueOf(userRequest.getAdditionalParameters().get(OPENID_KEY)));

// lang=zh_CN

queryParams.add(LANG_KEY, DEFAULT_LANG);

// 构建 user-info-uri端点

URI userInfoEndpoint = UriComponentsBuilder.fromUriString(userInfoUri).queryParams(queryParams).build().toUri();

// 请求

return this .restOperations.exchange(userInfoEndpoint, HttpMethod.GET, null , OAUTH2_USER_OBJECT);

// 获取用户信息端点配置  根据accessToken获取用户基本信息

httpSecurity.oauth2Login()

       .userInfoEndpoint().userService(oAuth2UserService);

// 默认跳转到 /  如果没有会 404 所以弄个了接口

httpSecurity.oauth2Login().defaultSuccessUrl( "/weixin/h5/redirect" )

@GetMapping ( "/h5/redirect" )

public void sendRedirect(HttpServletResponse response,

                          @RegisteredOAuth2AuthorizedClient ( "wechat" ) OAuth2AuthorizedClient authorizedClient,

                          @AuthenticationPrincipal WechatOAuth2User principal) throws IOException {

     //todo 你可以再这里模拟一些授权后的业务逻辑 比如用户静默注册 等等

     // 当前认证的客户端 token 不要暴露给前台

     OAuth2AccessToken accessToken = authorizedClient.getAccessToken();

     System.out.println( "accessToken = " + accessToken);

     // 当前用户的userinfo

     System.out.println( "principal = " + principal);

     response.sendRedirect( "https://felord.cn" );

}

spring:

   security:

     oauth2:

       client:

         registration:

           wechat:

             # 可以去试一下沙箱

             # 公众号服务号 appid

             client-id: wxdf9033184b2xxx38e7f

             # 公众号服务号 secret

             client-secret: bf1306baaa0dxxxxxxb15eb02d68df5

             # oauth2 login 用 '{baseUrl}/login/oauth2/code/{registrationId}' 会自动解析

             # oauth2 client 写你业务的链接即可

             redirect-uri:  '{baseUrl}/login/oauth2/code/{registrationId}'

             authorization-grant-type: authorization_code

             scope: snsapi_userinfo

         provider:

           wechat:

             authorization-uri: https: //open.weixin.qq.com/connect/oauth2/authorize

             token-uri: https: //api.weixin.qq.com/sns/oauth2/access_token

             user-info-uri: https: //api.weixin.qq.com/sns/userinfo