手工实现HttpBasic校验

HttpBasic：

是RFC中定义的一种控制HTTP协议访问资源的方式。具体当HTTP请求受限资源时，就需要在请求头中添加以"Authorization"为key的header，value的具体形式是"Basic <credentials>", 其中<credentials>

是以“${username}:${password}"进行BASE64编码后的字符串。如果携带的这个请求头的信息和服务端保存

的用户名密码信息不匹配，就需要服务端必须返回401的状态码和WWW-Authenticate的返回头，其中值要形如

”Basic realm=testHttpBasic"其中”Basic realm"是固定死的

特性：

是最简单的控制访问方式，不需要cookies啊，session identifiers（session id)啊/login pages什么的。

各大浏览器都会以好RFC定义的约定规则实现对应的逻辑的。

实现：

SpringSecurity框架中就包含了HttpBasic的功能，但如果不想依赖这么重的玩意儿，可以自己写一个。

我是写了一个Filter，用于过滤请求，已通过Chrome浏览器验证Ok.

 package org.zeng.test.test.web.httpbasic;

 import javax.servlet.*;

 import javax.servlet.annotation.WebFilter;

 import javax.servlet.http.HttpServletRequest;

 import javax.servlet.http.HttpServletResponse;

 import javax.servlet.http.HttpSession;

 import java.io.IOException;

 import java.util.Base64;

 @WebFilter(servletNames = "authFilter", urlPatterns = "/basic/*")

 public class AuthFilter implements Filter {

     private final String USERNAME = "admin";

     private final String PASSWORD = "123456";

     /**

      * 核心逻辑比较简单，就是：

      * 1.简单的字符串解析

      * 2.解码Base64

      * 3.验证用户名密码

      * 4.将用户标识放入session中

      *

      * @param servletRequest

      * @param servletResponse

      * @param filterChain

      * @throws IOException

      * @throws ServletException

      */

     @Override

     public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {

         HttpServletRequest request = (HttpServletRequest)servletRequest;

         HttpSession session = request.getSession();

         if (session.getAttribute("user") == null) {

             String basicValue = request.getHeader("Authorization");

             //打印出了值形如 "Basic YW423222222lalalla"

             System.out.println("Authorization: " + basicValue);

             if (basicValue != null && basicValue.length() > 0) {

                 String[] authorizationValue = basicValue.split(" ");

                 if (authorizationValue.length == 2) {

                     //获取到解码后的值，形如 "admin:123456"

                     String base64Encoded = new String(Base64.getDecoder().decode(authorizationValue[1]));

                     if (authorizationValue != null && base64Encoded.length() > 0) {

                         String userAndPwdArray[] = base64Encoded.split(":");

                         if (userAndPwdArray.length != 2) {

                             checkFailed(servletResponse);

                         } else {

                             String user = userAndPwdArray[0];

                             String password = userAndPwdArray[1];

                             if (USERNAME.equals(user) && PASSWORD.equals(password)) {

                                 //放入session中，下次登录无需再次提示登录框

                                 session.setAttribute("user", USERNAME);

                                 checkSuccess(servletRequest, servletResponse, filterChain);

                             } else {

                                 checkFailed(servletResponse);

                             }

                         }

                     } else {

                         checkFailed(servletResponse);

                     }

                 } else {

                     checkFailed(servletResponse);

                 }

             } else {

                 checkFailed(servletResponse);

             }

         } else {

             checkSuccess(servletRequest, servletResponse, filterChain);

         }

     }

     @Override

     public void init(FilterConfig filterConfig) throws ServletException {

     }

     @Override

     public void destroy() {

     }

     /**

      * 校验成功

      * @param servletRequest

      * @param servletResponse

      * @param filterChain

      * @throws IOException

      * @throws ServletException

      */

     private void checkSuccess(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {

         filterChain.doFilter(servletRequest, servletResponse);

     }

     /**

      * 校验失败返回

      * @param servletResponse

      */

     private void checkFailed(ServletResponse servletResponse) {

         HttpServletResponse response = (HttpServletResponse) servletResponse;

         response.setStatus(401);

         response.setHeader("WWW-Authenticate", "Basic realm=anything you can write!");

     }

 }

巴特西

手工实现HttpBasic校验

最新文章

热门文章