Spring Boot使用AOP实现REST接口简易灵活的安全认证的方法

package com.power.demo测试数据mon;

import java.lang.annotation.*;

/*

  * 安全认证

  * */

@target ({elementtype.type, elementtype.method})

@retention (retentionpolicy.runtime)

@documented

public @interface authorized {

   string value() default "" ;

}

@authorized

   @requestmapping (value = "/getinfobyid" , method = requestmethod.post)

   @apioperation ( "根据商品id查询商品信息" )

   @apiimplicitparams ({

       @apiimplicitparam (paramtype = "header" , name = "authtoken" , required = true , value = "authtoken" , datatype =

           "string" ),

   })

   public getgoodsbygoodsidresponse getgoodsbygoodsid( @requestheader string authtoken, @requestbody getgoodsbygoodsidrequest request) {

     return _goodsapiservice.getgoodsbygoodsid(request);

   }

package com.power.demo.controller.tool;

import com.power.demo测试数据mon.appconst;

import com.power.demo测试数据mon.authorized;

import com.power.demo测试数据mon.bizresult;

import com.power.demo.service.contract.authtokenservice;

import com.power.demo.util.powerlogger;

import com.power.demo.util.serializeutil;

import org.aspectj.lang.joinpoint;

import org.aspectj.lang.annotation.aspect;

import org.aspectj.lang.annotation.before;

import org.aspectj.lang.annotation.pointcut;

import org.springframework.beans.factory.annotation.autowired;

import org.springframework.stereotype测试数据ponent;

import org.springframework.web.context.request.requestcontextholder;

import org.springframework.web.context.request.servletrequestattributes;

import javax.servlet.http.httpservletrequest;

import java.lang.annotation.annotation;

/**

  * 请求认证切面，验证自定义请求header的authtoken是否合法

  **/

@aspect

@component

public class authorizedaspect {

   @autowired

   private authtokenservice authtokenservice;

   @pointcut ( "@annotation(org.springframework.web.bind.annotation.requestmapping)" )

   public void requestmapping() {

   }

   @pointcut ( "execution(* com.power.demo.controller.*controller.*(..))" )

   public void methodpointcut() {

   }

   /**

    * 某个方法执行前进行请求合法性认证 注入authorized注解 （先）

    */

   @before ( "requestmapping() && methodpointcut()&&@annotation(authorized)" )

   public void dobefore(joinpoint joinpoint, authorized authorized) throws exception {

     powerlogger.info( "方法认证开始..." );

     class type = joinpoint.getsignature().getdeclaringtype();

     annotation[] annotations = type.getannotationsbytype(authorized. class );

     if (annotations != null && annotations.length > 0 ) {

       powerlogger.info( "直接类认证" );

       return ;

     }

     //获取当前http请求

     servletrequestattributes attributes = (servletrequestattributes) requestcontextholder.getrequestattributes();

     httpservletrequest request = attributes.getrequest();

     string token = request.getheader(appconst.auth_token);

     bizresult<string> bizresult = authtokenservice.powercheck(token);

     system.out.println(serializeutil.serialize(bizresult));

     if (bizresult.getisok() == true ) {

       powerlogger.info( "方法认证通过" );

     } else {

       throw new exception(bizresult.getmessage());

     }

   }

   /**

    * 类下面的所有方法执行前进行请求合法性认证 （后）

    */

   @before ( "requestmapping() && methodpointcut()" )

   public void dobefore(joinpoint joinpoint) throws exception {

     powerlogger.info( "类认证开始..." );

     annotation[] annotations = joinpoint.getsignature().getdeclaringtype().getannotationsbytype(authorized. class );

     if (annotations == null || annotations.length == 0 ) {

       powerlogger.info( "类不需要认证" );

       return ;

     }

     //获取当前http请求

     servletrequestattributes attributes = (servletrequestattributes) requestcontextholder.getrequestattributes();

     httpservletrequest request = attributes.getrequest();

     string token = request.getheader(appconst.auth_token);

     bizresult<string> bizresult = authtokenservice.powercheck(token);

     system.out.println(serializeutil.serialize(bizresult));

     if (bizresult.getisok() == true ) {

       powerlogger.info( "类认证通过" );

     } else {

       throw new exception(bizresult.getmessage());

     }

   }

}

package com.power.demo.controller.exhandling;

import com.power.demo测试数据mon.errorinfo;

import org.springframework.http.httpstatus;

import org.springframework.web.bind.annotation.controlleradvice;

import org.springframework.web.bind.annotation.exceptionhandler;

import org.springframework.web.bind.annotation.responsebody;

import javax.servlet.http.httpservletrequest;

import java.util.date;

/**

  * 全局统一异常处理增强

  **/

@controlleradvice

public class globalexceptionhandler {

   /**

    * api统一异常处理

    **/

   @exceptionhandler (value = exception. class )

   @responsebody

   public errorinfo<exception> jsonapierrorhandler(httpservletrequest request, exception e) {

     errorinfo<exception> errorinfo = new errorinfo<>();

     try {

       system.out.println( "统一异常处理..." );

       e.printstacktrace();

       throwable innerex = e.getcause();

       while (innerex != null ) {

         //innerex.printstacktrace();

         if (innerex.getcause() == null ) {

           break ;

         }

         innerex = innerex.getcause();

       }

       if (innerex == null ) {

         errorinfo.setmessage(e.getmessage());

         errorinfo.seterror(e.tostring());

       } else {

         errorinfo.setmessage(innerex.getmessage());

         errorinfo.seterror(innerex.tostring());

       }

       errorinfo.setdata(e);

       errorinfo.settimestamp( new date());

       errorinfo.setstatus(httpstatus.internal_server_error.value()); //500错误

       errorinfo.seturl(request.getrequesturl().tostring());

       errorinfo.setpath(request.getservletpath());

     } catch (exception ex) {

       ex.printstacktrace();

       errorinfo.setmessage(ex.getmessage());

       errorinfo.seterror(ex.tostring());

     }

     return errorinfo;

   }

}

import java.lang.reflect.invocationhandler;

import java.lang.reflect.method;

import java.lang.reflect.proxy;

/**

  * 动态代理类

  */

public class dynamicproxy implements invocationhandler {

   /**

    * 需要代理的目标类

    */

   private object target;

   /**

    * 写法固定，aop专用:绑定委托对象并返回一个代理类

    *

    * @param target

    * @return

    */

   public object bind(object target) {

     this .target = target;

     return proxy.newproxyinstance(target.getclass().getclassloader(), target.getclass().getinterfaces(), this );

   }

   /**

    * 调用 invocationhandler接口定义方法

    *

    * @param proxy 指被代理的对象。

    * @param method 要调用的方法

    * @param args  方法调用时所需要的参数

    */

   @override

   public object invoke(object proxy, method method, object[] args) throws throwable {

     object result = null ;

     // 切面之前执行

     system.out.println( "[动态代理]切面之前执行" );

     // 执行业务

     result = method.invoke(target, args);

     // 切面之后执行

     system.out.println( "[动态代理]切面之后执行" );

     return result;

   }

}

import org.springframework.cglib.proxy.enhancer;

import org.springframework.cglib.proxy.methodinterceptor;

import org.springframework.cglib.proxy.methodproxy;

import java.lang.reflect.method;

/**

  * 使用cglib动态代理

  * <p>

  * jdk中的动态代理使用时，必须有业务接口，而cglib是针对类的

  */

public class cglibproxy implements methodinterceptor {

   private object target;

   /**

    * 创建代理对象

    *

    * @param target

    * @return

    */

   public object getinstance(object target) {

     this .target = target;

     enhancer enhancer = new enhancer();

     enhancer.setsuperclass( this .target.getclass());

     // 回调方法

     enhancer.setcallback( this );

     // 创建代理对象

     return enhancer.create();

   }

   @override

   public object intercept(object proxy, method method, object[] args, methodproxy methodproxy) throws throwable {

     object result = null ;

     system.out.println( "[cglib]切面之前执行" );

     result = methodproxy.invokesuper(proxy, args);

     system.out.println( "[cglib]切面之后执行" );

     return result;

   }

}

package com.power.demo.controller.tool;

import com.power.demo.apientity.baseapirequest;

import com.power.demo.apientity.baseapiresponse;

import com.power.demo.util.datetimeutil;

import com.power.demo.util.serializeutil;

import org.aspectj.lang.proceedingjoinpoint;

import org.aspectj.lang.signature;

import org.aspectj.lang.annotation.around;

import org.aspectj.lang.annotation.aspect;

import org.aspectj.lang.annotation.pointcut;

import org.slf4j.logger;

import org.slf4j.loggerfactory;

import org.springframework.stereotype测试数据ponent;

import org.springframework.util.stopwatch;

/**

  * 服务日志切面，主要记录接口日志及耗时

  **/

@aspect

@component

public class svclogaspect {

   @pointcut ( "@annotation(org.springframework.web.bind.annotation.requestmapping)" )

   public void requestmapping() {

   }

   @pointcut ( "execution(* com.power.demo.controller.*controller.*(..))" )

   public void methodpointcut() {

   }

   @around ( "requestmapping() && methodpointcut()" )

   public object around(proceedingjoinpoint pjd) throws throwable {

     system.out.println( "spring aop方式记录服务日志" );

     object response = null ; //定义返回信息

     baseapirequest baseapirequest = null ; //请求基类

     int index = 0 ;

     signature cursignature = pjd.getsignature();

     string classname = cursignature.getclass().getname(); //类名

     string methodname = cursignature.getname(); //方法名

     logger logger = loggerfactory.getlogger(classname); //日志

     stopwatch watch = datetimeutil.startnew(); //用于统计调用耗时

     // 获取方法参数

     object[] reqparamarr = pjd.getargs();

     stringbuffer sb = new stringbuffer();

     //获取请求参数集合并进行遍历拼接

     for (object reqparam : reqparamarr) {

       if (reqparam == null ) {

         index++;

         continue ;

       }

       try {

         sb.append(serializeutil.serialize(reqparam));

         //获取继承自baseapirequest的请求实体

         if (baseapirequest == null && reqparam instanceof baseapirequest) {

           index++;

           baseapirequest = (baseapirequest) reqparam;

         }

       } catch (exception e) {

         sb.append(reqparam.tostring());

       }

       sb.append( "," );

     }

     string strparam = sb.tostring();

     if (strparam.length() > 0 ) {

       strparam = strparam.substring( 0 , strparam.length() - 1 );

     }

     //记录请求

     logger.info(string.format( "【%s】类的【%s】方法，请求参数：%s" , classname, methodname, strparam));

     response = pjd.proceed(); // 执行服务方法

     watch.stop();

     //记录应答

     logger.info(string.format( "【%s】类的【%s】方法，应答参数：%s" , classname, methodname, serializeutil.serialize(response)));

     // 获取执行完的时间

     logger.info(string.format( "接口【%s】总耗时(毫秒)：%s" , methodname, watch.gettotaltimemillis()));

     //标准请求-应答模型

     if (baseapirequest == null ) {

       return response;

     }

     if ((response != null && response instanceof baseapiresponse) == false ) {

       return response;

     }

     system.out.println( "spring aop方式记录标准请求-应答模型服务日志" );

     object request = reqparamarr[index];

     baseapiresponse bizresp = (baseapiresponse) response;

     //记录日志

     string msg = string.format( "请求：%s======应答：%s======总耗时(毫秒)：%s" , serializeutil.serialize(request),

         serializeutil.serialize(response), watch.gettotaltimemillis());

     if (bizresp.getisok() == true ) {

       logger.info(msg);

     } else {

       logger.error(msg); //记录错误日志

     }

     return response;

   }

}