实力网站优化公司首选_网页ui设计是什么_关键词挖掘啊爱站网_百度一下你就知道手机版

在 Spring Security 中集成多数据源和验证码登录需要结合自定义认证逻辑和过滤器链扩展。以下是完整实现方案及代码示例：

一、多数据源认证配置

1. 定义两个数据源的 `UserDetailsService`

// 数据源1：数据库用户
@Service("db1UserDetailsService")
public class DB1UserDetailsService implements UserDetailsService {@Autowiredprivate UserRepositoryDB1 userRepoDB1;@Overridepublic UserDetails loadUserByUsername(String username) {UserDB1 user = userRepoDB1.findByUsername(username);return new CustomUserDetails(user.getUsername(), user.getPassword(), "DB1_ROLE");}
}// 数据源2：外部API用户
@Service("db2UserDetailsService")
public class DB2UserDetailsService implements UserDetailsService {@Autowiredprivate ApiUserClient apiUserClient;@Overridepublic UserDetails loadUserByUsername(String username) {UserApi user = apiUserClient.fetchUser(username);return new CustomUserDetails(user.getUsername(), user.getPassword(), "DB2_ROLE");}
}

2. 自定义 `AuthenticationProvider` 选择数据源

public class MultiSourceAuthProvider implements AuthenticationProvider {@Autowired@Qualifier("db1UserDetailsService")private UserDetailsService db1Service;@Autowired@Qualifier("db2UserDetailsService")private UserDetailsService db2Service;@Autowiredprivate PasswordEncoder passwordEncoder;@Overridepublic Authentication authenticate(Authentication auth) throws AuthenticationException {String username = auth.getName();// 根据用户名前缀选择数据源（如 "db1:user"）UserDetails userDetails = null;if (username.startsWith("db1:")) {userDetails = db1Service.loadUserByUsername(username.substring(4));} else if (username.startsWith("db2:")) {userDetails = db2Service.loadUserByUsername(username.substring(4));} else {throw new BadCredentialsException("Invalid username prefix");}// 验证密码if (passwordEncoder.matches((String) auth.getCredentials(), userDetails.getPassword())) {return new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());} else {throw new BadCredentialsException("Password mismatch");}}@Overridepublic boolean supports(Class<?> authentication) {return UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication);}
}

3. 注册 `AuthenticationProvider`

@Configuration
@EnableWebSecurity
public class SecurityConfig {@Beanpublic SecurityFilterChain filterChain(HttpSecurity http) throws Exception {http.authorizeRequests(auth -> auth.anyRequest().authenticated()).formLogin(form -> form.loginPage("/login").defaultSuccessUrl("/home"));return http.build();}@Beanpublic AuthenticationProvider multiSourceAuthProvider() {return new MultiSourceAuthProvider();}@Beanpublic PasswordEncoder passwordEncoder() {return new BCryptPasswordEncoder();}
}

二、验证码集成

1. 生成验证码（使用 Kaptcha 库）

<!-- pom.xml 添加依赖 -->
<dependency><groupId>com.github.penggle</groupId><artifactId>kaptcha</artifactId><version>2.3.2</version>
</dependency>

@Configuration
public class CaptchaConfig {@Beanpublic Producer captchaProducer() {Properties props = new Properties();props.setProperty("kaptcha.textproducer.char.length", "4");props.setProperty("kaptcha.image.width", "120");DefaultKaptcha kaptcha = new DefaultKaptcha();kaptcha.setConfig(new Config(props));return kaptcha;}
}

2. 验证码接口与缓存

@RestController
public class CaptchaController {@Autowiredprivate Producer captchaProducer;@Autowiredprivate RedisTemplate<String, String> redisTemplate;@GetMapping("/captcha")public void generateCaptcha(HttpServletRequest request, HttpServletResponse response) throws IOException {String code = captchaProducer.createText();String sessionId = request.getSession().getId();// 存储到 Redis（过期时间 2 分钟）redisTemplate.opsForValue().set("captcha:" + sessionId, code, 2, TimeUnit.MINUTES);response.setContentType("image/jpeg");BufferedImage image = captchaProducer.createImage(code);ImageIO.write(image, "jpg", response.getOutputStream());}
}

3. 自定义验证码过滤器

public class CaptchaFilter extends OncePerRequestFilter {@Autowiredprivate RedisTemplate<String, String> redisTemplate;@Overrideprotected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {if ("/login".equals(request.getRequestURI()) && "POST".equalsIgnoreCase(request.getMethod())) {String sessionId = request.getSession().getId();String captchaCode = redisTemplate.opsForValue().get("captcha:" + sessionId);String userInput = request.getParameter("captcha");if (userInput == null || !userInput.equalsIgnoreCase(captchaCode)) {throw new AuthenticationServiceException("验证码错误");}}chain.doFilter(request, response);}
}

4. 将过滤器插入到 Spring Security 链中

@Configuration
@EnableWebSecurity
public class SecurityConfig {@Beanpublic SecurityFilterChain filterChain(HttpSecurity http) throws Exception {http.addFilterBefore(new CaptchaFilter(), UsernamePasswordAuthenticationFilter.class) // 插入验证码过滤器// 其他配置...return http.build();}
}

三、前端集成示例

<!-- login.html -->
<form action="/login" method="post"><input type="text" name="username" placeholder="用户名"><input type="password" name="password" placeholder="密码"><input type="text" name="captcha" placeholder="验证码"><img src="/captcha" onclick="this.src='/captcha?t='+new Date().getTime()"><button>登录</button>
</form>

四、关键配置总结

功能	实现方式
多数据源选择	自定义 `AuthenticationProvider`，根据用户名前缀选择 `UserDetailsService`
验证码生成	使用 Kaptcha 生成图片，存储到 Redis
验证码校验	自定义过滤器拦截 `/login` 请求，比对输入值与 Redis 缓存
密码加密	统一使用 `BCryptPasswordEncoder`