Spring Security开发安全的REST服务-学习笔记（3.7-3.10）

• 欢迎
• 3.7使用切片拦截REST服务
• Spring的切面拦截方式（Filter，Interceptor，AspectJ）
• 1.Filter的方式
• 2.Interceptor的方式
• AspectJ方式

• 使用Runable异步处理Rest服务
• 使用DeferredResult异步处理Rest服务
• 异步处理配置

欢迎

本篇博文仅记录该学习过程。

3.7使用切片拦截REST服务

Spring的切面拦截方式（Filter，Interceptor，AspectJ）

测试url请求的controller方法

package com.lwj.securitydemo.controller;

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class UserController {

@GetMapping("/hello/{id}")
public String hello(@PathVariable int id) {
return "hello";
}
}

1.Filter的方式

(1)在Springboot项目中通过@Component注解的方式添加一个过滤器来拦截URL请求。

package com.lwj.securitydemo.filter;

import javax.servlet.*;
import java.io.IOException;
import java.util.Date;
//将TimeFilter添加到Spring容器中
@Component
public class TimeFilter implements Filter {

@Override
public void init(FilterConfig filterConfig) throws ServletException {
System.out.println("TimeFilter init");
}

@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
System.out.println("TimeFilter doFilter");
System.out.println("start do something..." + new Date());
filterChain.doFilter(servletRequest, servletResponse);
System.out.println("something is done" + new Date());
}

@Override
public void destroy() {
System.out.println("TimeFilter destroy");
}
}

(2)使用Springboot的config配置的方式
新建WebConfig类，并添加@Configuration注解，将该类配置为一个配置类。

package com.lwj.securitydemo.config;

import com.lwj.securitydemo.TimeFilter;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import java.util.ArrayList;
import java.util.List;

@Configuration
public class WebConfig {
/**
* 配置过滤器
* @return
*/
@Bean
public FilterRegistrationBean timeFilter() {
FilterRegistrationBean registrationBean = new FilterRegistrationBean();
//  new一個自定義的filter出來
TimeFilter timeFilter = new TimeFilter();
//  將自定義的filter放入到registrationBean
registrationBean.setFilter(timeFilter);

//  設置需要被攔截的親求類型
List<String> filterUrls = new ArrayList<>();
filterUrls.add("/*");
registrationBean.setUrlPatterns(filterUrls);

return registrationBean;
}
}

2.Interceptor的方式

（1）创建TimeInterceptor类

package com.lwj.securitydemo.interceptor;

import org.springframework.stereotype.Component;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.ModelAndView;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.Map;

@Component
public class TimeInterceptor extends HandlerInterceptorAdapter {

@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
System.out.println("preHandle");
Map map = request.getParameterMap();
System.out.println(handler.getClass().getName());

System.out.println("param "+ map.toString());
return true;
}
/**
* 该方法如果调用的方法抛出异常就不会再被调用了
*/
@Override
public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
System.out.println("postHandle");
}

/**
*	该方法最终都会执行
*/
@Override
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
System.out.println("afterCompletion");
}
}

PS：此处的handler中虽然不能获取到请求中的参数，但是通过request对象中的方法也可以获取到param参数！
(2)将自定义的Interceptor添加到配置中

@Configuration
public class WebConfig implements WebMvcConfigurer {

/**
* 注入自定义的TimeInterceptor
*/
@Autowired
private TimeInterceptor timeInterceptor;

/**
* 配置自定义的Interceptor
* @param registry
*/
@Override
public void addInterceptors(InterceptorRegistry registry) {
registry.addInterceptor(timeInterceptor);
}

/**
* 配置过滤器
* @return
*/
@Bean
public FilterRegistrationBean timeFilter() {
FilterRegistrationBean registrationBean = new FilterRegistrationBean();
//  new一個自定義的filter出來
TimeFilter timeFilter = new TimeFilter();
//  將自定義的filter放入到registrationBean
registrationBean.setFilter(timeFilter);

//  設置需要被攔截的親求類型
List<String> filterUrls = new ArrayList<>();
filterUrls.add("/*");
registrationBean.setUrlPatterns(filterUrls);

return registrationBean;
}
}

AspectJ方式

Aspect方式代码

package com.lwj.securitydemo.web.aspect;

import org.aspectj.lang.ProceedingJoinPoint;
import org.aspectj.lang.annotation.Around;
import org.aspectj.lang.annotation.Aspect;
import org.springframework.stereotype.Component;

@Aspect
@Component
public class TimeAspect {

@Around("execution(* com.lwj.securitydemo.controller.UserController.*(..))")
public Object handleControllerMethod(ProceedingJoinPoint pjp) throws Throwable {
System.out.println("time aspect 方法被调用！");
long start = System.currentTimeMillis();

//  获取切片方法的参数
Object[] args = pjp.getArgs();
for (Object arg : args) {
System.out.println("args : " + arg);
}

//  执行切片的方法
Object obj = pjp.proceed();

System.out.println("time aspect 耗时: " + (System.currentTimeMillis() - start));
System.out.println("time aspect 方法结束！");
return obj;
}

}

REST API 拦截

3.9 异步处理REST服务

使用Runable异步处理Rest服务

package com.lwj.securitydemo.web.async;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import java.util.concurrent.Callable;

@RestController
public class AsyncController {

private Logger logger = LoggerFactory.getLogger(getClass());

@RequestMapping("/order")
public Callable<String> order() {
logger.info("主线程开始！");

Callable<String> result = () -> {
logger.info("副线程开始！");
Thread.sleep(1000);
logger.info("副线程结束！");
return "success";
};
logger.info("主线程结束！");

return result;
}
}

param org.apache.catalina.util.ParameterMap@16e52a1
2019-03-20 11:47:36.206  INFO 15556 --- [nio-8080-exec-1] c.l.s.web.async.AsyncController          : 主线程开始！
2019-03-20 11:47:36.207  INFO 15556 --- [nio-8080-exec-1] c.l.s.web.async.AsyncController          : 主线程结束！
2019-03-20 11:47:36.215  INFO 15556 --- [         task-1] c.l.s.web.async.AsyncController          : 副线程开始！
2019-03-20 11:47:37.216  INFO 15556 --- [         task-1] c.l.s.web.async.AsyncController          : 副线程结束！

可以看到日志信息中，在主线程结束后副线程立马开始了

使用DeferredResult异步处理Rest服务

1.创建MockQueue

package com.lwj.securitydemo.web.async;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Component;

@Component
public class MockQueue {
private Logger logger = LoggerFactory.getLogger(getClass());

private String placeOrder;

private String completeOrder;

public String getPlaceOrder() {
return placeOrder;
}

public void setPlaceOrder(String placeOrder) throws Exception {
new Thread(() -> {
logger.info("接到下单请求：" + placeOrder);
try {
Thread.sleep(1000);
} catch (InterruptedException e) {
e.printStackTrace();
}
this.completeOrder = placeOrder;
logger.info("下单请求处理完毕：" + placeOrder);
}).start();

}

public String getCompleteOrder() {
return completeOrder;
}

public void setCompleteOrder(String completeOrder) {
this.completeOrder = completeOrder;
}
}

2.创建DeferredResultHolder类

package com.lwj.securitydemo.web.async;

import org.springframework.stereotype.Component;
import org.springframework.web.context.request.async.DeferredResult;

import java.util.HashMap;
import java.util.Map;

@Component
public class DeferredResultHolder {

private Map<String, DeferredResult<String>> map = new HashMap<>();

public Map<String, DeferredResult<String>> getMap() {
return map;
}

public void setMap(Map<String, DeferredResult<String>> map) {
this.map = map;
}
}

3.创建QueueListener

package com.lwj.securitydemo.web.async;

import cn.hutool.core.util.StrUtil;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.ApplicationListener;
import org.springframework.context.event.ContextRefreshedEvent;
import org.springframework.stereotype.Component;

/**
* ContextRefreshedEvent 為spring容器初始化完畢事件
*/

@Component
public class QueueListener implements ApplicationListener<ContextRefreshedEvent> {
private Logger logger = LoggerFactory.getLogger(getClass());

@Autowired
private MockQueue mockQueue;

@Autowired
private DeferredResultHolder deferredResultHolder;

@Override
public void onApplicationEvent(ContextRefreshedEvent contextRefreshedEvent) {
new Thread(()->{
while (true) {
if (StrUtil.isNotBlank(mockQueue.getCompleteOrder())) {
String orderNumber = mockQueue.getCompleteOrder();
logger.info("返回订单处理结果：" + orderNumber);
deferredResultHolder.getMap().get(orderNumber).setResult("place order success");

mockQueue.setCompleteOrder(null);
} else {
try {
Thread.sleep(100);
} catch (InterruptedException e) {
e.printStackTrace();
}
}
}
}).start();
}
}

4.修改AsyncController中的方法

package com.lwj.securitydemo.web.async;

import cn.hutool.core.util.RandomUtil;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.context.request.async.DeferredResult;

import java.util.concurrent.Callable;

@RestController
public class AsyncController {

private Logger logger = LoggerFactory.getLogger(getClass());

@Autowired
private MockQueue mockQueue;

@Autowired
private DeferredResultHolder deferredResultHolder;

@RequestMapping("/order")
public DeferredResult<String> order() throws Exception {
logger.info("主线程开始！");

String orderNumber = RandomUtil.randomNumbers(8);
mockQueue.setPlaceOrder(orderNumber);

DeferredResult<String> result = new DeferredResult<>();
deferredResultHolder.getMap().put(orderNumber, result);

//        Callable<String> result = () -> {
//            logger.info("副线程开始！");
//            Thread.sleep(1000);
//            logger.info("副线程结束！");
//            return "success";
//        };
logger.info("主线程结束！");

return result;
}
}

console日志

2019-03-20 14:21:12.700  INFO 6508 --- [nio-8080-exec-1] c.l.s.web.async.AsyncController          : 主线程开始！
2019-03-20 14:21:12.701  INFO 6508 --- [nio-8080-exec-1] c.l.s.web.async.AsyncController          : 主线程结束！
2019-03-20 14:21:12.701  INFO 6508 --- [      Thread-10] c.lwj.securitydemo.web.async.MockQueue   : 接到下单请求：89428880
2019-03-20 14:21:13.702  INFO 6508 --- [      Thread-10] c.lwj.securitydemo.web.async.MockQueue   : 下单请求处理完毕：89428880
2019-03-20 14:21:13.703  INFO 6508 --- [       Thread-7] c.l.s.web.async.QueueListener            : 返回订单处理结果：89428880

异步处理配置