Это очень простая конфигурация безопасности, которую я собрал на лету (Reactive Java Rest API) для глупой демонстрации. Я ни в коем случае не эксперт по безопасности, но он может дать вам представление о том, что с этим связано.
import org.springframework.context.annotation.Configuration;
import org.springframework.data.redis.core.RedisTemplate;
import XXXXXXXX.Permissions;
import XXXXXXXXX.UserPermissions;
import java.util.concurrent.CompletableFuture;
import java.util.concurrent.TimeUnit;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.security.authentication.ReactiveAuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.authorization.AuthorizationDecision;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity.AuthorizeExchangeSpec;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.server.SecurityWebFilterChain;
import org.springframework.security.web.server.authorization.AuthorizationContext;
import reactor.core.publisher.Mono;
@Configuration
@EnableWebFluxSecurity
public class ApiSecurityConfiguration implements ReactiveAuthenticationManager{
@Autowired
Permissions permissions;
@Autowired
RedisTemplate<String, Object> redisCache;
private static final Logger logger = LoggerFactory.getLogger(ApiSecurityConfiguration.class);
private UserPermissions userPermissionTable;
@Bean
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
AuthorizeExchangeSpec authorize;
http.formLogin().disable();
http.csrf().disable();
http.logout().disable();å
http.httpBasic().disable();
http.httpBasic().
authenticationManager(this::authenticate);
authorize = http.authorizeExchange();
authorize.anyExchange().access(this::check);
return http.build();
}
private Mono<AuthorizationDecision> check(Mono<Authentication> authentication, AuthorizationContext context) {
return authentication.map(a ->this.checkAuthorizations(a, context)).map(granted -> new AuthorizationDecision(granted));
}
private boolean checkAuthorizations(Authentication a, AuthorizationContext context){
boolean ret = false;
String name = a.getName();
if (a.isAuthenticated()){
logger.info(String.format("FOUND %s, authorizing...", name));
ret = userPermissionTable.canAccess("XXXX", context.getExchange().getRequest().getPath().value(), context.getExchange().getRequest().getMethodValue());
logger.info(String.format("%s access granted: %B", name, ret));
}
return ret;
}
@Override
public Mono<Authentication> authenticate(Authentication authentication) {
CompletableFuture<UserPermissions> cup;
Authentication auth;
String name = null;
auth = authentication;
auth.setAuthenticated(false);
try {
name = authentication.getName();
logger.info(String.format("Looking %s in cache...", name));
userPermissionTable = (UserPermissions)redisCache.opsForValue().get(name);
if (userPermissionTable == null){
logger.info(String.format("NOT in cache, authenticating: %s ...", name));
cup = permissions.getPermissionsForUser(name, authentication.getCredentials().toString());
userPermissionTable = cup.get(1000, TimeUnit.MILLISECONDS);
redisCache.opsForValue().set(name, userPermissionTable, userPermissionTable.getTTL(), TimeUnit.MINUTES);
auth = new UsernamePasswordAuthenticationToken(authentication.getPrincipal(), authentication.getCredentials(), null);
logger.info(String.format("Authenticated: %s", name));
}
else{
auth = new UsernamePasswordAuthenticationToken(authentication.getPrincipal(), authentication.getCredentials(), null);
redisCache.expire(name, userPermissionTable.getTTL(), TimeUnit.MINUTES);
}
} catch (Exception e) {
logger.info(String.format("FAILED to authenticate: %s", name));
}
return Mono.just(auth);
}
}