June, 2022 - AsenView

Detailed WebSecurityConfigurerAdapter

June 16, 2022June 16, 2022asenview

This article will detail the WebSecurityConfigurerAdapter in security.

Overview
Today we are going to further learn how to customize Spring Security. We have mentioned WebSecurityConfigurerAdapter many times, and we know that the automatic configuration in Spring Boot is actually the Spring Boot Web Security imported through the SecurityAutoConfiguration general configuration class under the automatic configuration package. Configuration class SpringBootWebSecurityConfiguration to configure.

SpringBootWebSecurityConfiguration source code

package org.springframework.boot.autoconfigure.security.servlet;

import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration(
    proxyBeanMethods = false
)
@ConditionalOnClass({WebSecurityConfigurerAdapter.class})
@ConditionalOnMissingBean({WebSecurityConfigurerAdapter.class})
@ConditionalOnWebApplication(
    type = Type.SERVLET
)
public class SpringBootWebSecurityConfiguration {
    public SpringBootWebSecurityConfiguration() {
    }

    @Configuration(
        proxyBeanMethods = false
    )
    @Order(2147483642)
    static class DefaultConfigurerAdapter extends WebSecurityConfigurerAdapter {
        DefaultConfigurerAdapter() {
        }
    }
}

package org.springframework.boot.autoconfigure.security.servlet;

import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;

import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;

import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;

import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type;

import org.springframework.context.annotation.Configuration;

import org.springframework.core.annotation.Order;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration(

proxyBeanMethods = false

)

@ConditionalOnClass({WebSecurityConfigurerAdapter.class})

@ConditionalOnMissingBean({WebSecurityConfigurerAdapter.class})

@ConditionalOnWebApplication(

type = Type.SERVLET

)

public class SpringBootWebSecurityConfiguration {

public SpringBootWebSecurityConfiguration() {

}

@Configuration(

proxyBeanMethods = false

)

@Order(2147483642)

static class DefaultConfigurerAdapter extends WebSecurityConfigurerAdapter {

DefaultConfigurerAdapter() {

}

Common method
WebSecurityConfigurerAdapter class diagram

Common configuration
Let’s paste the common configuration of WebSecurityConfigurerAdapter in the project

package cn.wideth.framework.config;

import cn.wideth.framework.security.handle.AuthenticationEntryPointImpl;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.authentication.logout.LogoutFilter;
import org.springframework.web.filter.CorsFilter;
import cn.wideth.framework.security.filter.JwtAuthenticationTokenFilter;
import cn.wideth.framework.security.handle.LogoutSuccessHandlerImpl;

/**
 * spring security configuration
 *
 */
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    /**
     * Custom user authentication logic
     */
    @Autowired
    private UserDetailsService userDetailsService;

    /**
     * Authentication failure handling class
     */
    @Autowired
    private AuthenticationEntryPointImpl unauthorizedHandler;

    /**
     * Exit handler class
     */
    @Autowired
    private LogoutSuccessHandlerImpl logoutSuccessHandler;

    /**
     * token authentication filter
     */
    @Autowired
    private JwtAuthenticationTokenFilter authenticationTokenFilter;

    /**
     * Cross domain filter
     */
    @Autowired
    private CorsFilter corsFilter;

    /**
     * Solved the inability to directly inject AuthenticationManager
     *
     * @return
     * @throws Exception
     */
    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    /**
     * Strong hash hash encryption implementation
     */
    @Bean
    public BCryptPasswordEncoder bCryptPasswordEncoder() {

        return new BCryptPasswordEncoder();
    }

    /**
     * Identity authentication interface
     */
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        //Associate database and security here
        auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());
    }

    /**
     * anyRequest | matches all request paths
     * access | Accessible when SpringEl expression evaluates to true
     * anonymous | Anonymous can access
     * denyAll | user cannot access
     * fullyAuthenticated | The user is fully authenticated and can access (automatic login without remember-me)
     * hasAnyAuthority | If there are parameters, the parameters represent permissions, any one of them can access
     * hasAnyRole | If there are parameters, the parameters represent roles, any one of them can access
     * hasAuthority | If there is a parameter, the parameter represents the authority, then its authority can access
     * hasIpAddress | If there is a parameter, the parameter represents the IP address, and if the user IP matches the parameter, it can be accessed
     * hasRole | If there is a parameter, the parameter represents a role, then its role can access
     * permitAll | User can access arbitrarily
     * rememberMe | Allow access for users logged in via remember-me
     * authenticated | user can access after login
     */
    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
    
        httpSecurity
                // CSRF disabled because session is not used
                .csrf().disable()
                // Authentication failure handling class
                .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
                // Based on token, so no session is needed
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
                // filter request
                .authorizeRequests()
                // Allow anonymous access for login verification code captchaImage
                .antMatchers("/login", "/captchaImage").anonymous()
                .antMatchers(
                        HttpMethod.GET,
                        "/*.html",
                        "/**/*.html",
                        "/**/*.css",
                        "/**/*.js"
                ).permitAll()
                .antMatchers("/profile/**").permitAll()
                .antMatchers("/common/download**").permitAll()
                .antMatchers("/common/download/resource**").permitAll()
                .antMatchers("/swagger-ui.html").permitAll()
                .antMatchers("/swagger-resources/**").permitAll()
                .antMatchers("/webjars/**").permitAll()
                .antMatchers("/*/api-docs").permitAll()
                .antMatchers("/druid/**").permitAll()
                .antMatchers("/flowable/**").permitAll()
                .antMatchers("/socket/**").permitAll()
                .antMatchers("/api/common/**").permitAll()
                .antMatchers("/api/contract/**").permitAll()
                .antMatchers("/api/project/**").permitAll()
                .antMatchers("/api/document/**").permitAll()
                .antMatchers("/api/purchase/**").permitAll()
                // All requests except the above require authentication
                .anyRequest().authenticated()
                .and()
                .headers().frameOptions().disable();
        httpSecurity.logout().logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler);
        // add JWT filter
        httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
        // add CORS filter
        httpSecurity.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class);
        httpSecurity.addFilterBefore(corsFilter, LogoutFilter.class);
    }

    /***
     * Core filter configuration method
     * @param web
     * @throws Exception
     */
    @Override
    public void configure(WebSecurity web) throws Exception {
        super.configure(web);
    }
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

package cn.wideth.framework.config;

import cn.wideth.framework.security.handle.AuthenticationEntryPointImpl;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.context.annotation.Bean;

import org.springframework.http.HttpMethod;

import org.springframework.security.authentication.AuthenticationManager;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.builders.WebSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import org.springframework.security.config.http.SessionCreationPolicy;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import org.springframework.security.web.authentication.logout.LogoutFilter;

import org.springframework.web.filter.CorsFilter;

import cn.wideth.framework.security.filter.JwtAuthenticationTokenFilter;

import cn.wideth.framework.security.handle.LogoutSuccessHandlerImpl;

/**

* spring security configuration

@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)

public class SecurityConfig extends WebSecurityConfigurerAdapter {

/**

* Custom user authentication logic

@Autowired

private UserDetailsService userDetailsService;

/**

* Authentication failure handling class

@Autowired

private AuthenticationEntryPointImpl unauthorizedHandler;

/**

* Exit handler class

@Autowired

private LogoutSuccessHandlerImpl logoutSuccessHandler;

/**

* token authentication filter

@Autowired

private JwtAuthenticationTokenFilter authenticationTokenFilter;

/**

* Cross domain filter

@Autowired

private CorsFilter corsFilter;

/**

* Solved the inability to directly inject AuthenticationManager

* @return

* @throws Exception

@Bean

@Override

public AuthenticationManager authenticationManagerBean() throws Exception {

return super.authenticationManagerBean();

}

/**

* Strong hash hash encryption implementation

@Bean

public BCryptPasswordEncoder bCryptPasswordEncoder() {

return new BCryptPasswordEncoder();

}

/**

* Identity authentication interface

@Override

protected void configure(AuthenticationManagerBuilder auth) throws Exception {

//Associate database and security here

auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());

}

/**

* anyRequest | matches all request paths

* access | Accessible when SpringEl expression evaluates to true

* anonymous | Anonymous can access

* denyAll | user cannot access

* fullyAuthenticated | The user is fully authenticated and can access (automatic login without remember-me)

* hasAnyAuthority | If there are parameters, the parameters represent permissions, any one of them can access

* hasAnyRole | If there are parameters, the parameters represent roles, any one of them can access

* hasAuthority | If there is a parameter, the parameter represents the authority, then its authority can access

* hasIpAddress | If there is a parameter, the parameter represents the IP address, and if the user IP matches the parameter, it can be accessed

* hasRole | If there is a parameter, the parameter represents a role, then its role can access

* permitAll | User can access arbitrarily

* rememberMe | Allow access for users logged in via remember-me

* authenticated | user can access after login

@Override

protected void configure(HttpSecurity httpSecurity) throws Exception {

httpSecurity

// CSRF disabled because session is not used

.csrf().disable()

// Authentication failure handling class

.exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()

// Based on token, so no session is needed

.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()

// filter request

.authorizeRequests()

// Allow anonymous access for login verification code captchaImage

.antMatchers("/login", "/captchaImage").anonymous()

.antMatchers(

HttpMethod.GET,

"/*.html",

"/**/*.html",

"/**/*.css",

"/**/*.js"

).permitAll()

.antMatchers("/profile/**").permitAll()

.antMatchers("/common/download**").permitAll()

.antMatchers("/common/download/resource**").permitAll()

.antMatchers("/swagger-ui.html").permitAll()

.antMatchers("/swagger-resources/**").permitAll()

.antMatchers("/webjars/**").permitAll()

.antMatchers("/*/api-docs").permitAll()

.antMatchers("/druid/**").permitAll()

.antMatchers("/flowable/**").permitAll()

.antMatchers("/socket/**").permitAll()

.antMatchers("/api/common/**").permitAll()

.antMatchers("/api/contract/**").permitAll()

.antMatchers("/api/project/**").permitAll()

.antMatchers("/api/document/**").permitAll()

.antMatchers("/api/purchase/**").permitAll()

// All requests except the above require authentication

.anyRequest().authenticated()

.and()

.headers().frameOptions().disable();

httpSecurity.logout().logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler);

// add JWT filter

httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);

// add CORS filter

httpSecurity.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class);

httpSecurity.addFilterBefore(corsFilter, LogoutFilter.class);

}

/***

* Core filter configuration method

* @param web

* @throws Exception

@Override

public void configure(WebSecurity web) throws Exception {

super.configure(web);

}

I believe someone has noticed that I have overridden (@Override) three configure methods in the WebSecurityConfigurerAdapter above. We generally customize our security access policy by customizing these three methods.

Authentication Manager Configuration Methods
AuthenticationManagerBuilder (Authentication Manager Builder)

void configure(AuthenticationManagerBuilder auth) is used to configure AuthenticationManager. To put it bluntly, it manages all UserDetails related, including PasswordEncoder passwords, etc. If you are not clear, you can find out through UserDetail in Spring Security. This article does not do a specific analysis and explanation of AuthenticationManager, and there will be a special article about this later.

Common usage

@Override
 protected void configure(AuthenticationManagerBuilder auth) throws Exception {
     auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());
 }

@Override

protected void configure(AuthenticationManagerBuilder auth) throws Exception {

auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());

}

Core filter configuration method
WebSecurity (WEB security)

void configure(WebSecurity web) is used to configure WebSecurity . And WebSecurity is based on Servlet Filter to configure springSecurityFilterChain . The springSecurityFilterChain is delegated to the Spring Security core filter Bean DelegatingFilterProxy . The related logic can be found in WebSecurityConfiguration. We generally don’t customize WebSecurity too much, and use more of its ignoring() method to ignore Spring Security’s control of static resources.

Security filter chain configuration method
HttpSecurity (HTTP request security processing)

void configure(HttpSecurity http) This is what we use the most to configure HttpSecurity . HttpSecurity is used to build a security filter chain SecurityFilterChain . The SecurityFilterChain is eventually injected into the core filter. HttpSecurity has many configurations that we need. We can use it to customize the security access policy. So we have a separate chapter to explain this stuff.

HttpSecurity configuration
HttpSecurity is the focus of the following articles, and we will actually operate it to achieve some practical functions. So this article will focus on it.

HttpSecurity class diagram

Default Allocation

  protected void configure(HttpSecurity http) throws Exception {
        this.logger.debug("Using default configure(HttpSecurity).
         If subclassed this will potentially override subclass configure(HttpSecurity).");
        ((HttpSecurity)((HttpSecurity((AuthorizedUrl)
        http.
           authorizeRequests().
           anyRequest()).authenticated().
           and()).
           formLogin().
           and()).
           httpBasic();
    }

protected void configure(HttpSecurity http) throws Exception {

this.logger.debug("Using default configure(HttpSecurity).

If subclassed this will potentially override subclass configure(HttpSecurity).");

((HttpSecurity)((HttpSecurity((AuthorizedUrl)

http.

authorizeRequests().

anyRequest()).authenticated().

and()).

formLogin().

and()).

httpBasic();

}

The above is the default configuration of Spring Security in Spring Boot. Through the above configuration, your application has the following functions:

All requested access requires authorization.
Use the form form to log in (the default path is /login), which is the login page we saw in the previous articles.
Prevent CSRF attack, XSS attack.
Enable HTTP Basic Authentication

Summary of this article
This article introduces the knowledge and content related to WebSecurityConfigurerAdapter in detail, and will introduce the knowledge related to HttpSecurity in detail later, which is also the most used place in normal development.

The difference between BIO, NIO, and AIO

June 16, 2022June 16, 2022asenview

Many articles just throw a bunch of definitions and some vivid examples when talking about BIO, NIO, and AIO. Seems to be well understood. However, the most basic essential principles are not revealed. If you do not start from the principle of IO, it is difficult to understand the difference between the three. In this article, you will get: the performance difference between synchronous/asynchronous + blocking/non-blocking; the difference between BIO, NIO, and AIO; understanding and implementing multiplexing when NIO operates Sockets; at the same time, master the bottom and core operation skills of IO.

IO principle in Java

First of all, IO in Java depends on the operating system kernel. The IO reading and writing in our program actually calls the two system calls of read and write in the operating system kernel.

How does the kernel interact with IO?

The network card receives the network data transmitted through the network cable, and writes the network data to the memory.
2When the network card writes the data into the memory, the network card sends an interrupt signal to the cpu, and the operating system can know that there is new data coming, and then process the data through the network card interrupt program.
Write the network data in the memory to the receive buffer of the corresponding socket.
After the data in the receive buffer is written, the application starts data processing.

A simple example of socket code corresponding to abstraction to java is as follows:

public class MySocketServer {

   public static void main(String&#91;] args) throws Exception {
  
         // listen on the specified port
        int port = 8080;
        ServerSocket server = new ServerSocket(port);
        // The server will always wait for the connection to arrive
        Socket socket = server.accept();
        // After the connection is established, get the input stream from the socket and create a buffer for reading
        InputStream inputStream = socket.getInputStream();
        byte&#91;] bytes = new byte&#91;1024];
        int len;
        while ((len = inputStream.read(bytes)) != -1) {
      
            // get data for processing
            String message = new String(bytes, 0, len,"UTF-8");
        }
        // socket, server, stream close operation, omitted is not shown
   }
}

public class MySocketServer {

public static void main(String[] args) throws Exception {

// listen on the specified port

int port = 8080;

ServerSocket server = new ServerSocket(port);

// The server will always wait for the connection to arrive

Socket socket = server.accept();

// After the connection is established, get the input stream from the socket and create a buffer for reading

InputStream inputStream = socket.getInputStream();

byte[] bytes = new byte[1024];

int len;

while ((len = inputStream.read(bytes)) != -1) {

// get data for processing

String message = new String(bytes, 0, len,"UTF-8");

}

// socket, server, stream close operation, omitted is not shown

}

It can be seen that this process is very similar to the network IO of the underlying kernel, which is mainly reflected in accept() waiting for a request from the network, and then the bytes[] array is used as a buffer to wait for the data to be filled before processing. The difference between BIO, NIO, and AIO is whether these operations are synchronous or asynchronous, blocking or non-blocking.

So we introduce the concepts of synchronous and asynchronous, blocking and non-blocking.

Synchronous and Asynchronous

Synchronization and asynchrony: Synchronization means that when the completion of a task needs to depend on another task, the dependent task can be completed only after waiting for the dependent task to complete. This is a reliable task sequence. Either all successes succeed, and all failures fail, and the status of the two tasks can be kept the same. Asynchronous means that there is no need to wait for the dependent task to complete, but only to notify the dependent task of what work to complete, and the dependent task is executed immediately, as long as the entire task is completed by itself. As for whether the dependent task is actually completed in the end, the task that depends on it cannot be determined, so it is an unreliable task sequence. We can use phone calls and text messages to describe synchronous versus asynchronous operations well.

Synchronization and asynchrony refer to whether each method in an execution flow must depend on the completion of the previous method before it can continue to execute. Suppose our execution process is: method one and method two in turn.

Synchronization means that once the call has started, the caller must wait until the method call returns before continuing the subsequent behavior. That is, method 2 must wait until method 1 is executed before it can be executed.

Asynchronous means that the call returns immediately, and the caller can continue the subsequent behavior without waiting for the execution of the code in the method to end. (The code in the specific method may be called back after it is executed by another thread.) That is, when method 1 is executed, it is directly handed over to other threads for execution, and it is not executed by the main thread, so it will not block the main thread, so method 2 does not have to wait until method 1 is completed to start execution.

Synchronization and asynchrony focus on whether the executor of the method is the main thread or another thread. The main thread needs to wait for the method execution to complete, and other threads do not need to wait for the method call to return immediately, and the main thread can directly execute the next code.

Synchronous and asynchronous is to achieve efficiency difference from the coordination between multiple threads.

Why do you need asynchrony? The author believes that the essence of asynchrony is to solve the blocking of the main thread, so many discussions on the Internet have made four combinations of synchronous asynchronous and blocking non-blocking. One of them has the situation of asynchronous blocking. If asynchronous is also blocking? So why do you want to perform asynchronous operations specifically?

Blocking and Non-Blocking
Blocking and non-blocking: Blocking and non-blocking are mainly in terms of CPU consumption. Blocking means that the CPU stops and waits for a slow operation to complete the CPU before completing other things. Non-blocking means that the CPU does other things while the slow operation is executing, and when the slow operation is completed, the CPU then completes the subsequent operations. Although the non-blocking method on the surface can significantly improve the utilization of the CPU, it also brings another consequence that the thread switching of the system increases. Whether the increased CPU usage time can compensate for the switching cost of the system needs to be carefully evaluated.

Blocking and non-blocking refer to whether to do nothing in place when a single thread encounters a synchronous wait.

Blocking means that after encountering a synchronization wait, it has been waiting for the synchronization method to complete the processing in place.

Non-blocking refers to encountering synchronous waiting, not waiting in place, do other operations first, and then observe whether the synchronization method is completed after a time interval.

Blocking and non-blocking concern whether the thread is waiting in place.

The author believes that blocking and non-blocking can only be combined with synchronization. Asynchronous is naturally non-blocking, and this non-blocking is for the main thread. (Some people may think that putting a blocking operation in an asynchronous method is asynchronous blocking, but think about it, it is precisely because it is a blocking operation that it is put into an asynchronous method, do not block the main thread)

Example to explain
Haidilao is delicious, but there are often queues. Let’s take this example from life to explain.

Customer A went to eat Haidilao and just sat and waited for an hour before eating hot pot. (BIO)
Customer B went to eat Haidilao. He saw that he had to wait for a long time, so he went to the mall, and every time he went shopping for a while, he ran back to see if he was in line. So he ended up shopping and eating Haidilao. (NIO)
Customer C went to eat Haidilao. Since he is a senior member, the store manager said, you can go to the mall to play casually, and I will call you immediately when there is a seat. So customer C doesn’t have to sit and wait, and don’t have to run back every once in a while to see if they can wait, and finally eat Haidilao (AIO)
Which way is more efficient? Is it obvious at a glance?

BIO
BIO is a traditional java.io package. It is implemented based on the stream model. The interaction method is synchronous and blocking. That is to say, when reading the input stream or output stream, the thread will be blocked until the read and write actions are completed. There, calls between them are in a reliable linear order. Its advantage is that the code is relatively simple and intuitive; the disadvantage is that the efficiency and scalability of IO is very low, and it is easy to become an application performance bottleneck.

The full name of BIO is Blocking IO, which is the traditional IO model before JDK1.4, and itself is a synchronous blocking mode. After the thread initiates an IO request, it keeps blocking the IO until the buffer data is ready, and then goes to the next step. For network communication, it is a request-response method. Although the upper-layer application development is simplified, there is a huge bottleneck in terms of performance and reliability. Imagine if each request needs to create a new thread for special processing, then in high In a concurrent scenario, machine resources are quickly exhausted.

NIO
NIO is the java.nio package introduced in Java 1.4. It provides new abstractions such as Channel, Selector, Buffer, etc. It can build multiplexed, synchronous non-blocking IO programs, and at the same time provides high-performance data operations that are closer to the underlying operating system. Way.

NIO, also called Non-Blocking IO, is a synchronous non-blocking IO model. After the thread initiates an io request, it returns immediately (non-blocking io). Synchronization means that you must wait for the data in the IO buffer to be ready. Non-blocking means that the user thread does not wait for the IO buffer in place. You can do some other operations first, but you need to poll regularly to check whether the IO buffer data is ready. .

NIO in Java means new IO. In fact, it is NIO plus IO multiplexing technology. Ordinary NIO is thread polling to see if an IO buffer is ready, while new IO in Java refers to threads polling to see which ones are ready in a bunch of IO buffers, which is an idea of IO multiplexing . In the IO multiplexing model, the task of checking whether the IO data is ready is handed over to the system-level select or epoll model, which is monitored by the system to reduce the burden on user threads.

NIO mainly integrates three technologies: buffer, channel, and selector. Data is obtained through zero-copy buffer, and each client registers on the selector (multiplexer) through channel. The server continuously polls the channel to obtain information about the client. There are four status flags on the channel: connect, accept (blocking), read (readable), and write (writable). Follow up with the identification. So a server can receive an infinite number of channels. No need to open a new thread. Greatly improved performance.

AIO
AIO is a package introduced after Java 1.7. It is an upgraded version of NIO. It provides an asynchronous non-blocking IO operation mode, so people call it AIO (Asynchronous IO). Asynchronous IO is implemented based on events and callback mechanisms, that is, application operations. After that, it will return directly and will not be blocked there. When the background processing is completed, the operating system will notify the corresponding thread to perform subsequent operations.

AIO is a true asynchronous non-blocking IO model. In the above NIO implementation, the user thread needs to poll regularly to check whether the IO buffer data is ready, which occupies the application thread resources. In fact, polling is equivalent to blocking, and does not really liberate the current thread, because it still needs to query which IO ready. The real ideal asynchronous non-blocking IO should let the kernel system complete, and the user thread only needs to tell the kernel that when the buffer is ready, notify me or execute the callback function I handed you.

AIO can perform real asynchronous operations, but it is more complicated to implement. There are very few operating systems that support pure asynchronous IO. Currently, windows are implemented by IOCP technology, while on Linux, the bottom layer is still implemented by epoll.

Implementing Permission Management System Based On Spring Security

June 15, 2022June 15, 2022asenview

Slightly more complex background systems will involve user rights management. What are user rights? My understanding is that permission is the centralized management of data (the entity class of the system) and the operations that can be performed on the data (addition, deletion, search, and modification). To build a usable permission management system, three core classes are involved: one is the user User, the other is the role, and the last is the permission Permission. Next, this article will introduce how to build an interface-level permission management system step by step based on Spring Security 4.0.

Related concepts
Permission = Resource + Privilege
Role = a set of low-level permissions
User = collection of roles (high-level roles)
Spring Security’s maven dependencies
Although the Spring Boot version has reached 2.0, some pits were found when it was used before, so it is recommended to use the relatively stable version 1.5 for the time being.

Define the permission set of the system
Permissions are a collection of resources and the operations that can be performed on them. For our system, almost all entity classes can be regarded as a resource, and the common operations are adding, deleting, checking, and modifying four categories. Of course, according to our actual business needs, there may be other special operations, such as ours here Added an action to import users. Here is a brief list of two basic permission sets:

&#91;
   {
     "resourceId":"permission",
     "resourceName":"Permissions",
     "privileges": {
       "read":"View",
       "write":"Add",
       "update":"Update",
       "delete":"Delete"
     }
   },
   {
     "resourceId":"user",
     "resourceName":"User",
     "privileges": {
       "read":"View user list",
       "write":"Add User",
       "import":"Import users",
       "update":"Modify user information",
       "delete":"Delete user"
     }
   }
]

[

{

"resourceId":"permission",

"resourceName":"Permissions",

"privileges": {

"read":"View",

"write":"Add",

"update":"Update",

"delete":"Delete"

}

{

"resourceId":"user",

"resourceName":"User",

"privileges": {

"read":"View user list",

"write":"Add User",

"import":"Import users",

"update":"Modify user information",

"delete":"Delete user"

}

]

In the definition of permissions, the key is the key of resourceId and privileges, and the combination of the two will be used to judge the user’s permissions later. I use the form of resourceId-privilege here to uniquely represent an operation on a resource.

Role-related operations
The resource and operation permission collection class defines JsonPermissions:

@Data
public class JsonPermissions {

     private List&lt;SimplePermission&gt; permissions;

     @Data
     public static class SimplePermission {

         /**
          * resource id
          */
         private String resourceId;

         /**
          * resource name
          */
         private String resourceName;

         /**
          * list of permissions
          */
         private Map&lt;String, String&gt; privileges;

         /**
          * Is it abandoned
          */
         private boolean abandon = false;
     }
}

@Data

public class JsonPermissions {

private List<SimplePermission> permissions;

@Data

public static class SimplePermission {

/**

* resource id

private String resourceId;

/**

* resource name

private String resourceName;

/**

* list of permissions

private Map<String, String> privileges;

/**

* Is it abandoned

private boolean abandon = false;

}

The role class defines Role:

import lombok.Data;
import org.springframework.data.mongodb.core.mapping.Document;
import java.util.List;

@Document(collection = "role")
@Data
public class Role {

    @Id
    private String id;

    /**
     * Creation time
     */
    private Long createdTime = System.currentTimeMillis();

    /**
     * is it removed
     */
    private Boolean isRemoved = false;

    /**
     * Role name, used for permission verification
     */
    private String name;

    /**
     * Character Chinese name for display
     */
    private String nickname;

    /**
     * Character description information
     */
    private String description;

    /**
     * Is it built-in
     */
    private boolean builtIn = false;

    /**
     * Role status, is it disabled
     */
    private Boolean banned = false;

    /**
     * A list of actions that the character can perform
     */
    private List&lt;JsonPermissions.SimplePermission&gt; permissions;

    /**
     * Character creator
     */
    private String proposer;

    /**
     * The roles of Spring Security 4.0 and above all start with 'ROLE_' by default
     * @param name
     */
    public void setName(String name) {
        if (name.indexOf("ROLE_") == -1) {
            this.name = "ROLE_" + name;
        } else {
            this.name = name;
        }
    }
}

import lombok.Data;

import org.springframework.data.mongodb.core.mapping.Document;

import java.util.List;

@Document(collection = "role")

@Data

public class Role {

@Id

private String id;

/**

* Creation time

private Long createdTime = System.currentTimeMillis();

/**

* is it removed

private Boolean isRemoved = false;

/**

* Role name, used for permission verification

private String name;

/**

* Character Chinese name for display

private String nickname;

/**

* Character description information

private String description;

/**

* Is it built-in

private boolean builtIn = false;

/**

* Role status, is it disabled

private Boolean banned = false;

/**

* A list of actions that the character can perform

private List<JsonPermissions.SimplePermission> permissions;

/**

* Character creator

private String proposer;

/**

* The roles of Spring Security 4.0 and above all start with 'ROLE_' by default

* @param name

public void setName(String name) {

if (name.indexOf("ROLE_") == -1) {

this.name = "ROLE_" + name;

} else {

this.name = name;

}

Assign roles to users
The Spring Security framework provides a basic user interface UserDetails, which provides basic user-related operations, such as obtaining username/password, whether the user account has expired, and whether user authentication has expired, etc. We need to implement this when we define our own User class. interface.

import com.fasterxml.jackson.annotation.JsonIgnore;
import lombok.Data;
import lombok.NoArgsConstructor;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import java.util.*;

@Data
@NoArgsConstructor
public class User implements UserDetails {

    public static final PasswordEncoder PASSWORD_ENCODER = new BCryptPasswordEncoder();

    @Id
    private String id;

    /**
     * Creation time
     */
    private Long createdTime = System.currentTimeMillis();

    /**
     * User login name
     */
    private String username;

    /**
     * User's real name
     */
    private String realName;

    /**
     * User login password, the user's password should not be exposed to the client
     */
    @JsonIgnore
    private String password;

    /**
     * user type
     */
    private String type;

    /**
     * The enterprise/block id associated with the user
     */
    private Map&lt;String, Object&gt; associatedResources = new HashMap&lt;&gt;();

    /**
     * List of companies that users follow
     */
    private List&lt;String&gt; favourite = new ArrayList&lt;&gt;();

    /**
     * The user's role list in the system, and the user's operation authority will be restricted according to the role
     */
    private List&lt;String&gt; roles = new ArrayList&lt;&gt;();
    
    public void setPassword(String password) {
        this.password = PASSWORD_ENCODER.encode(password);
    }

    @Override
    public Collection&lt;? extends GrantedAuthority&gt; getAuthorities() {
        return null;
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }
}

import com.fasterxml.jackson.annotation.JsonIgnore;

import lombok.Data;

import lombok.NoArgsConstructor;

import org.springframework.security.core.GrantedAuthority;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import org.springframework.security.crypto.password.PasswordEncoder;

import java.util.*;

@Data

@NoArgsConstructor

public class User implements UserDetails {

public static final PasswordEncoder PASSWORD_ENCODER = new BCryptPasswordEncoder();

@Id

private String id;

/**

* Creation time

private Long createdTime = System.currentTimeMillis();

/**

* User login name

private String username;

/**

* User's real name

private String realName;

/**

* User login password, the user's password should not be exposed to the client

@JsonIgnore

private String password;

/**

* user type

private String type;

/**

* The enterprise/block id associated with the user

private Map<String, Object> associatedResources = new HashMap<>();

/**

* List of companies that users follow

private List<String> favourite = new ArrayList<>();

/**

* The user's role list in the system, and the user's operation authority will be restricted according to the role

private List<String> roles = new ArrayList<>();

public void setPassword(String password) {

this.password = PASSWORD_ENCODER.encode(password);

}

@Override

public Collection<? extends GrantedAuthority> getAuthorities() {

return null;

}

@Override

public boolean isAccountNonExpired() {

return true;

}

@Override

public boolean isAccountNonLocked() {

return true;

}

@Override

public boolean isCredentialsNonExpired() {

return true;

}

@Override

public boolean isEnabled() {

return true;

}

Create initial roles and super administrators for the system
If we impose access restrictions on all interfaces of the system, who will log in to the system as the initial user and create other users? Therefore, we need to define the initial role and initial user of the system, and automatically enter the initial role and initial user into the system when the system starts, and then use the initial user to log in to the system to create other business-related users. Define the super administrator role of the system: roles.json

&#91;
  {
    "name":"ROLE_ADMINISTRATOR",
    "nickname":"Administrator",
    "description":"System super administrator, users are not allowed to change",
    "banned": false,
    "state":"normal",
    "permissions":&#91;
        {
            "resourceId":"permission",
            "resourceName":"Permissions",
            "privileges": {
            "read":"View",
            "write":"Add",
            "update":"Update",
            "delete":"Delete"
            }
        },
        {
            "resourceId":"user",
            "resourceName":"User",
            "privileges": {
            "read":"View user list",
            "write":"Add User",
            "import":"Import users",
            "update":"Modify user information",
            "delete":"Delete user"
            }
        }
    ]
  }
]

[

{

"name":"ROLE_ADMINISTRATOR",

"nickname":"Administrator",

"description":"System super administrator, users are not allowed to change",

"banned": false,

"state":"normal",

"permissions":[

{

"resourceId":"permission",

"resourceName":"Permissions",

"privileges": {

"read":"View",

"write":"Add",

"update":"Update",

"delete":"Delete"

}

{

"resourceId":"user",

"resourceName":"User",

"privileges": {

"read":"View user list",

"write":"Add User",

"import":"Import users",

"update":"Modify user information",

"delete":"Delete user"

}

]

}

]

Defines the initial admin user for the system: users.json

&#91;
   {
     "username":"admin",
     "realName":"Super Super Administrator",
     "password":"$2a$10$GhI1umKcTHysip4iSFXPXOQG1x9U.4eCWMEFwF/h3LBAt98K4o1B.",
     "number":"admin",
     "type":"system",
     "activated": true,
     "roles":&#91;"ROLE_ADMINISTRATOR"]
   }
]

[

{

"username":"admin",

"realName":"Super Super Administrator",

"password":"$2a$10$GhI1umKcTHysip4iSFXPXOQG1x9U.4eCWMEFwF/h3LBAt98K4o1B.",

"number":"admin",

"type":"system",

"activated": true,

"roles":["ROLE_ADMINISTRATOR"]

}

]

Load system initialization role and user data
When the system is deployed, the initialization roles and users of the system need to be automatically loaded into the database, so that they can be used for normal login. Use the @Component and @PostConstruct annotations to automatically import initial roles and users at system startup.

import com.google.gson.reflect.TypeToken;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.beans.factory.annotation.Value;

import javax.annotation.PostConstruct;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.lang.reflect.Type;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;

/**
 * System initialization configuration class, mainly used to load built-in data to the target database
 */
@Component
public class SystemInitializer {

@Value("${initialzation.file.users:users.json}") private String userFileName;

@Value("${initialzation.file.roles:roles.json}") private String roleFileName;

@Autowired
    private UserRepository userRepository;

@Autowired private RoleRepository roleRepository;

@PostConstruct
public boolean initialize() throws Exception {
try {
InputStream userInputStream = getClass().getClassLoader().getResourceAsStream(userFileName);
if(userInputStream == null){
throw new Exception("initialzation user file not found: " + userFileName);
}

InputStream roleInputStream = getClass().getClassLoader().getResourceAsStream(roleFileName);
if(roleInputStream == null){
throw new Exception("initialzation role file not found: " + roleFileName);
}

//Import the initial system super administrator role
Type roleTokenType = new TypeToken&lt;ArrayList&lt;Role&gt;&gt;(){}.getType();
ArrayList&lt;Role&gt; roles = CommonGsonBuilder.create().fromJson(new InputStreamReader(roleInputStream, StandardCharsets.UTF_8), roleTokenType);
for (Role role: roles) {
if (roleRepository.findByName(role.getName()) == null) {
roleRepository.save(role);
}
}

//Import the initial sysadmin user
Type teacherTokenType = new TypeToken&lt;ArrayList&lt;User&gt;&gt;(){}.getType();
ArrayList&lt;User&gt; users = CommonGsonBuilder.create().fromJson(new InputStreamReader(userInputStream, StandardCharsets.UTF_8), teacherTokenType);
for (User user : users) {
if (userRepository.findByUsername(user.getUsername()) == null) {
                    userRepository.save(user);
}
}
} catch (Exception e) {
e.printStackTrace();
}

return true;
}
}

import com.google.gson.reflect.TypeToken;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.stereotype.Component;

import org.springframework.beans.factory.annotation.Value;

import javax.annotation.PostConstruct;

import java.io.InputStream;

import java.io.InputStreamReader;

import java.lang.reflect.Type;

import java.nio.charset.StandardCharsets;

import java.util.ArrayList;

/**

* System initialization configuration class, mainly used to load built-in data to the target database

@Component

public class SystemInitializer {

@Value("${initialzation.file.users:users.json}") private String userFileName;

@Value("${initialzation.file.roles:roles.json}") private String roleFileName;

@Autowired

private UserRepository userRepository;

@Autowired private RoleRepository roleRepository;

@PostConstruct

public boolean initialize() throws Exception {

try {

InputStream userInputStream = getClass().getClassLoader().getResourceAsStream(userFileName);

if(userInputStream == null){

throw new Exception("initialzation user file not found: " + userFileName);

}

InputStream roleInputStream = getClass().getClassLoader().getResourceAsStream(roleFileName);

if(roleInputStream == null){

throw new Exception("initialzation role file not found: " + roleFileName);

}

//Import the initial system super administrator role

Type roleTokenType = new TypeToken<ArrayList<Role>>(){}.getType();

ArrayList<Role> roles = CommonGsonBuilder.create().fromJson(new InputStreamReader(roleInputStream, StandardCharsets.UTF_8), roleTokenType);

for (Role role: roles) {

if (roleRepository.findByName(role.getName()) == null) {

roleRepository.save(role);

}

//Import the initial sysadmin user

Type teacherTokenType = new TypeToken<ArrayList<User>>(){}.getType();

ArrayList<User> users = CommonGsonBuilder.create().fromJson(new InputStreamReader(userInputStream, StandardCharsets.UTF_8), teacherTokenType);

for (User user : users) {

if (userRepository.findByUsername(user.getUsername()) == null) {

userRepository.save(user);

}

} catch (Exception e) {

e.printStackTrace();

}

return true;

}

Implement your own UserDetailsService
Customize user information in UserDetailService, and set all Permissions related to user role role to Authorities of Authentication for PermissionEvaluator to judge user permissions. Note that the form of resourceId-privilege is used here for splicing and storage. My user information here is stored in the MongoDB database, or it can be replaced with other databases.

import lombok.AllArgsConstructor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.mongodb.core.MongoTemplate;
import org.springframework.data.mongodb.core.query.Criteria;
import org.springframework.data.mongodb.core.query.Query;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import java.util.ArrayList;
import java.util.List;

@Service
public class MyUserDetailsService implements UserDetailsService {

    @Autowired
    private IUserService userService;

    @Autowired
    private MongoTemplate mongoTemplate;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

        User user = userService.findByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException(String.format("No user found with username: %s", username));
        }

        List&lt;SimpleGrantedAuthority&gt; authorities = new ArrayList&lt;&gt;();
        List&lt;String&gt; roles = user.getRoles();
        for (String roleName : roles) {
            Role role = mongoTemplate.findOne(Query.query(Criteria.where("name").is(roleName)), Role.class);
            if (role == null) {
                continue;
            }
            for (JsonPermissions.SimplePermission permission : role.getPermissions()) {
                for (String privilege : permission.getPrivileges().keySet()) {
                    authorities.add(new SimpleGrantedAuthority(String.format("%s-%s", permission.getResourceId(), privilege)));
                }
            }
        }

        return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), user.isEnabled(), user.isAccountNonExpired(), user.isCredentialsNonExpired(), user.isAccountNonLocked(), authorities);
    }
}

import lombok.AllArgsConstructor;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.data.mongodb.core.MongoTemplate;

import org.springframework.data.mongodb.core.query.Criteria;

import org.springframework.data.mongodb.core.query.Query;

import org.springframework.security.core.authority.SimpleGrantedAuthority;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.core.userdetails.UsernameNotFoundException;

import org.springframework.stereotype.Service;

import java.util.ArrayList;

import java.util.List;

@Service

public class MyUserDetailsService implements UserDetailsService {

@Autowired

private IUserService userService;

@Autowired

private MongoTemplate mongoTemplate;

@Override

public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

User user = userService.findByUsername(username);

if (user == null) {

throw new UsernameNotFoundException(String.format("No user found with username: %s", username));

}

List<SimpleGrantedAuthority> authorities = new ArrayList<>();

List<String> roles = user.getRoles();

for (String roleName : roles) {

Role role = mongoTemplate.findOne(Query.query(Criteria.where("name").is(roleName)), Role.class);

if (role == null) {

continue;

}

for (JsonPermissions.SimplePermission permission : role.getPermissions()) {

for (String privilege : permission.getPrivileges().keySet()) {

authorities.add(new SimpleGrantedAuthority(String.format("%s-%s", permission.getResourceId(), privilege)));

}

return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), user.isEnabled(), user.isAccountNonExpired(), user.isCredentialsNonExpired(), user.isAccountNonLocked(), authorities);

}

9.Config UserDetailsService

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.authentication.logout.LogoutHandler;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
                .authorizeRequests().antMatchers(
                "/js/**",
                "/css/**",
                "/img/**",
                "/login/**").permitAll()
                .anyRequest().authenticated()
                .and().formLogin().permitAll()
                .cors();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService());
    }
}

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import org.springframework.security.web.authentication.logout.LogoutHandler;

@Configuration

@EnableWebSecurity

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Override

protected void configure(HttpSecurity httpSecurity) throws Exception {

httpSecurity

.authorizeRequests().antMatchers(

"/js/**",

"/css/**",

"/img/**",

"/login/**").permitAll()

.anyRequest().authenticated()

.and().formLogin().permitAll()

.cors();

}

@Autowired

public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {

auth.userDetailsService(userDetailsService());

}

The back-end interface implements access restrictions based on permissions
Add the PreAuthorize annotation to the interface method that requires access restrictions. In this annotation, we can use a variety of verification methods, the more common ones are hasPermisson and hasRole. Similar to PreAuthorize, there is the PostAuthorize annotation. It is also better to understand from the literal meaning that PreAuthorize performs verification before accessing the interface, and PostAuthorize performs verification when the result is returned after accessing the interface.

@GetMapping(value = "/list")
@PreAuthorize("hasPermission('user', 'read') or hasRole('ROLE_ADMINISTRATOR')")
public List&lt;?&gt; getUserList(@RequestParam(value = "text", defaultValue = "") String text,
                                            @RequestParam(value = "page", defaultValue = "0") int page,
                                            @RequestParam(value = "size", defaultValue = "20") int size) {
    return userService.list(text, page, size);
}

@GetMapping(value = "/list")

@PreAuthorize("hasPermission('user', 'read') or hasRole('ROLE_ADMINISTRATOR')")

public List<?> getUserList(@RequestParam(value = "text", defaultValue = "") String text,

@RequestParam(value = "page", defaultValue = "0") int page,

@RequestParam(value = "size", defaultValue = "20") int size) {

return userService.list(text, page, size);

}

By analogy, corresponding access restrictions can be added to the interfaces that need to restrict user access.

Implement your own PermissionEvaluator
After adding the PreAuthorize annotation to the interface method, you also need to implement your own PermissionEvaluator. Spring Security will verify the validity of the resource that the currently logged-in user is accessing and the operations performed on the resource in the hasPermission() method.
Note that the targetDomainObject here is the resourceId we defined before, and the permission is the privilege. When verifying, it should be combined into a format consistent with the format stored in the UserDetailsService. Here we use – dash to connect.

import java.io.Serializable;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.access.PermissionEvaluator;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;

@Configuration
public class MyPermissionEvaluator implements PermissionEvaluator {

	@Override
	public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
		boolean accessable = false;
		if(authentication.getPrincipal().toString().compareToIgnoreCase("anonymousUser") != 0){
			String privilege = targetDomainObject + "-" + permission;
			for(GrantedAuthority authority : authentication.getAuthorities()){
				if(privilege.equalsIgnoreCase(authority.getAuthority())){
					accessable = true;
					break;
				}
			}
			
			return accessable;
		}

		return accessable;
	}

	@Override
	public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
		// TODO Auto-generated method stub
		return false;
	}
}

import java.io.Serializable;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.access.PermissionEvaluator;

import org.springframework.security.core.Authentication;

import org.springframework.security.core.GrantedAuthority;

@Configuration

public class MyPermissionEvaluator implements PermissionEvaluator {

@Override

public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {

boolean accessable = false;

if(authentication.getPrincipal().toString().compareToIgnoreCase("anonymousUser") != 0){

String privilege = targetDomainObject + "-" + permission;

for(GrantedAuthority authority : authentication.getAuthorities()){

if(privilege.equalsIgnoreCase(authority.getAuthority())){

accessable = true;

break;

}

return accessable;

}

return accessable;

}

@Override

public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {

// TODO Auto-generated method stub

return false;

}

Annotation support
After implementing PermissionEvaluator, the annotation of globalMethodSecurity must be added, otherwise the permission judgment added on the interface will not take effect. Add this annotation to the inherited class of SpringBootServletInitializer to enable method security.

Access test: 403
Since the user I am currently logged in has not set the role and access rights for it, I do not have access to the list interface, and the following 403 error occurs when I forcibly access it.

Front-end pages implement personalized pages according to permissions
It doesn’t end when the backend implements interface-level access restrictions. For the part of the user-visible interface, users with different roles should see different interfaces according to their roles when they log in to the system. Our current experience is that after the user logs in successfully, the user’s permission list is returned to the front-end, and then the front-end judges the permissions. If there is no permission, the corresponding button or function module is hidden. Through the combination of front and back ends, users can only see the operation interface and data within the scope of their permissions. At the same time, even if some users directly modify the interface parameters to obtain data, they will be judged twice at the back end. Make sure that users can see their own data and can only perform operations within the scope of their authority!

Java Several Methods Of Converting Between Map and Object

June 15, 2022June 15, 2022asenview

**
 * Convert using com.fasterxml.jackson.databind.ObjectMapper
 */
class A {

    public static Object mapToObject (Map&lt;String, Object&gt; map, Class&lt;?&gt; beanClass) throws Exception {
        if (map == null) {
            return null;
        }

        ObjectMapper objectMapper = new ObjectMapper();
        Object obj = objectMapper.convertValue(map, beanClass);

        return obj;
    }

    public static Map&lt;?, ?&gt; objectToMap (Object obj) {
        if (obj == null) {
            return null;
        }

        ObjectMapper objectMapper = new ObjectMapper();
        Map&lt;?, ?&gt; mappedObject = objectMapper.convertValue(obj, Map.class);

        return mappedObject;
    }
}

/**
 * Use org.apache.commons.beanutils for conversion
 */
class B {

    public static Object mapToObject(Map&lt;String, Object&gt; map, Class&lt;?&gt; beanClass) throws Exception {
        if (map == null) {
            return null;
        }

        Object obj = beanClass.newInstance();

        org.apache.commons.beanutils.BeanUtils.populate(obj, map);

        return obj;
    }

    public static Map&lt;?, ?&gt; objectToMap(Object obj) {
        if (obj == null) {
            return null;
        }

        return new org.apache.commons.beanutils.BeanMap(obj);
    }

}

/**
 * Convert using Introspector
 */
class C {

    public static Object mapToObject(Map&lt;String, Object&gt; map, Class&lt;?&gt; beanClass) throws Exception {
        if (map == null) {
            return null;
        }

        Object obj = beanClass.newInstance();

        BeanInfo beanInfo = Introspector.getBeanInfo(obj.getClass());
        PropertyDescriptor&#91;] propertyDescriptors = beanInfo.getPropertyDescriptors();
        for (PropertyDescriptor property : propertyDescriptors) {
            Method setter = property.getWriteMethod();
            if (setter != null) {
                setter.invoke(obj, map.get(property.getName()));
            }
        }

        return obj;
    }

    public static Map&lt;String, Object&gt; objectToMap(Object obj) throws Exception {
        if (obj == null) {
            return null;
        }

        Map&lt;String, Object&gt; map = new HashMap&lt;String, Object&gt;();

        BeanInfo beanInfo = Introspector.getBeanInfo(obj.getClass());
        PropertyDescriptor&#91;] propertyDescriptors = beanInfo.getPropertyDescriptors();
        for (PropertyDescriptor property : propertyDescriptors) {
            String key = property.getName();
            if (key.compareToIgnoreCase("class") == 0) {
                continue;
            }
            Method getter = property.getReadMethod();
            Object value = getter!=null ? getter.invoke(obj) : null;
            map.put(key, value);
        }

        return map;
    }

}

/**
 * use reflect to convert
 */
class D {

    public static Object mapToObject(Map&lt;String, Object&gt; map, Class&lt;?&gt; beanClass) throws Exception {
        if (map == null) {
            return null;
        }

        Object obj = beanClass.newInstance();

        Field&#91;] fields = obj.getClass().getDeclaredFields();
        for (Field field : fields) {
            int mod = field.getModifiers();
            if (Modifier.isStatic(mod) || Modifier.isFinal(mod)) {
                continue;
            }

            field.setAccessible(true);
            field.set(obj, map.get(field.getName()));
        }

        return obj;
    }

    public static Map&lt;String, Object&gt; objectToMap(Object obj) throws Exception {
        if (obj == null) {
            return null;
        }

        Map&lt;String, Object&gt; map = new HashMap&lt;String, Object&gt;();

        Field&#91;] declaredFields = obj.getClass().getDeclaredFields();
        for (Field field : declaredFields) {
            field.setAccessible(true);
            map.put(field.getName(), field.get(obj));
        }

        return map;
    }
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

* Convert using com.fasterxml.jackson.databind.ObjectMapper

class A {

public static Object mapToObject (Map<String, Object> map, Class<?> beanClass) throws Exception {

if (map == null) {

return null;

}

ObjectMapper objectMapper = new ObjectMapper();

Object obj = objectMapper.convertValue(map, beanClass);

return obj;

}

public static Map<?, ?> objectToMap (Object obj) {

if (obj == null) {

return null;

}

ObjectMapper objectMapper = new ObjectMapper();

Map<?, ?> mappedObject = objectMapper.convertValue(obj, Map.class);

return mappedObject;

}

/**

* Use org.apache.commons.beanutils for conversion

class B {

public static Object mapToObject(Map<String, Object> map, Class<?> beanClass) throws Exception {

if (map == null) {

return null;

}

Object obj = beanClass.newInstance();

org.apache.commons.beanutils.BeanUtils.populate(obj, map);

return obj;

}

public static Map<?, ?> objectToMap(Object obj) {

if (obj == null) {

return null;

}

return new org.apache.commons.beanutils.BeanMap(obj);

}

/**

* Convert using Introspector

class C {

public static Object mapToObject(Map<String, Object> map, Class<?> beanClass) throws Exception {

if (map == null) {

return null;

}

Object obj = beanClass.newInstance();

BeanInfo beanInfo = Introspector.getBeanInfo(obj.getClass());

PropertyDescriptor[] propertyDescriptors = beanInfo.getPropertyDescriptors();

for (PropertyDescriptor property : propertyDescriptors) {

Method setter = property.getWriteMethod();

if (setter != null) {

setter.invoke(obj, map.get(property.getName()));

}

return obj;

}

public static Map<String, Object> objectToMap(Object obj) throws Exception {

if (obj == null) {

return null;

}

Map<String, Object> map = new HashMap<String, Object>();

BeanInfo beanInfo = Introspector.getBeanInfo(obj.getClass());

PropertyDescriptor[] propertyDescriptors = beanInfo.getPropertyDescriptors();

for (PropertyDescriptor property : propertyDescriptors) {

String key = property.getName();

if (key.compareToIgnoreCase("class") == 0) {

continue;

}

Method getter = property.getReadMethod();

Object value = getter!=null ? getter.invoke(obj) : null;

map.put(key, value);

}

return map;

}

/**

* use reflect to convert

class D {

public static Object mapToObject(Map<String, Object> map, Class<?> beanClass) throws Exception {

if (map == null) {

return null;

}

Object obj = beanClass.newInstance();

Field[] fields = obj.getClass().getDeclaredFields();

for (Field field : fields) {

int mod = field.getModifiers();

if (Modifier.isStatic(mod) || Modifier.isFinal(mod)) {

continue;

}

field.setAccessible(true);

field.set(obj, map.get(field.getName()));

}

return obj;

}

public static Map<String, Object> objectToMap(Object obj) throws Exception {

if (obj == null) {

return null;

}

Map<String, Object> map = new HashMap<String, Object>();

Field[] declaredFields = obj.getClass().getDeclaredFields();

for (Field field : declaredFields) {

field.setAccessible(true);

map.put(field.getName(), field.get(obj));

}

return map;

}

Java Json And Object Conversion

June 15, 2022June 15, 2022asenview

1.Java object to JSON object

Student stu = new Student("Public Number BiggerBoy", "m", 2);
JSONObject jsonObject = (JSONObject) JSONObject.toJSON(stu);

1 2	Student stu = new Student("Public Number BiggerBoy", "m", 2); JSONObject jsonObject = (JSONObject) JSONObject.toJSON(stu);

2.Java object to JSON string

Student stu = new Student("Public Number BiggerBoy", "m", 2);
String stuString = JSONObject.toJSONString(stu);

1 2	Student stu = new Student("Public Number BiggerBoy", "m", 2); String stuString = JSONObject.toJSONString(stu);

3.JSON object to JSON string

Student stu = new Student("Public Number BiggerBoy", "m", 2);
JSONObject jsonObject = (JSONObject) JSONObject.toJSON(stu);
String jsonString = jsonObject.toJSONString();

Student stu = new Student("Public Number BiggerBoy", "m", 2);

JSONObject jsonObject = (JSONObject) JSONObject.toJSON(stu);

String jsonString = jsonObject.toJSONString();

4.JSON object to java object

Student stu = new Student("Public Number BiggerBoy", "m", 2);
JSONObject jsonObject = (JSONObject) JSONObject.toJSON(stu);
Student student = JSONObject.toJavaObject(jsonObject, Student.class);

Student stu = new Student("Public Number BiggerBoy", "m", 2);

JSONObject jsonObject = (JSONObject) JSONObject.toJSON(stu);

Student student = JSONObject.toJavaObject(jsonObject, Student.class);

5.json string to JSON object

String stuString = "{\"age\":2,\"name\":\"Public Account BiggerBoy\",\"sex\":\"m\"}";
JSONObject jsonObject1 = JSONObject.parseObject(stuString);

1 2	String stuString = "{\"age\":2,\"name\":\"Public Account BiggerBoy\",\"sex\":\"m\"}"; JSONObject jsonObject1 = JSONObject.parseObject(stuString);

6.JSON string to Java object

String stuString = "{\"age\":2,\"name\":\"Public Account BiggerBoy\",\"sex\":\"m\"}";
Student student1 = JSONObject.parseObject(stuString, Student.class);

1 2	String stuString = "{\"age\":2,\"name\":\"Public Account BiggerBoy\",\"sex\":\"m\"}"; Student student1 = JSONObject.parseObject(stuString, Student.class);

7.JSON string to list

String stuString = "&#91;{\"age\":2,\"name\":\"Public Account\",\"sex\":\"m\"},{\"age\":18,\ "name\":\"BiggerBoy\",\"sex\":\"m\"}]";
List studentList = JSONObject.parseArray(stuString, Student.class);

1 2	String stuString = "[{\"age\":2,\"name\":\"Public Account\",\"sex\":\"m\"},{\"age\":18,\ "name\":\"BiggerBoy\",\"sex\":\"m\"}]"; List studentList = JSONObject.parseArray(stuString, Student.class);

Interview Question About Spring Cloud Context, You Can Answer Like This

June 15, 2022June 15, 2022asenview

Spring cloud, I believe everyone is familiar with it. Spring cloud is a cloud application development tool based on Spring boot; Spring boot focuses on a single individual that is fast and easy to integrate.

So the question is, what is the context in the Spring cloud monomer?

First of all, let’s recall the application context of Spring. What is the application context? It can be simply understood that it is a container object that puts the objects you need Spring to manage for you into the container. The application context is an abstract representation of the Spring container, and our common ApplicationContext is essentially a powerful interface that maintains the bean definition and the cooperative relationship between objects. The core of Spring is the container, and the container is not unique. The framework itself provides many container implementations, which are roughly divided into two types: one is the less commonly used BeanFactory, which is the simplest container and can only provide basic DI function; another is the application context derived from inheriting the BeanFactory, and its abstract interface is the ApplicationContext we mentioned above, which can provide more enterprise-level services, such as parsing configuration files, etc., which is also the application context. The most common use case for instance objects. With the context object, we can register objects that need to be managed by Spring with the container. For the context abstract interface, Spring also provides us with multiple types of container implementations, which can be selected in different application scenarios:

AnnotationConfigApplicationContext: Load context definitions from one or more java-based configuration classes, suitable for java annotations
ClassPathXmlApplicationContext: Load context definitions from one or more xml configuration files under the classpath, suitable for xml configuration
XmlWebApplicationContext: Load context definitions from one or more xml configuration files under the web application, suitable for xml configuration
FileSystemXmlApplicationContext: Load context definitions from one or more xml configuration files under the file system, that is, load xml configuration files in the system disk
AnnotationConfigWebApplicationContext: specially prepared for web applications, suitable for annotation methods

In this way, we only need to configure the managed objects (we call them beans in Spring) and the collaboration relationship between beans, load the configuration into the IOC container through the application context, and let Spring manage the objects for us. When the time comes, you can get the bean from the container, because the container can provide the object management service you want for your program.

So in fact, there is a concept of “bootstrap context” in a Spring cloud application, which is the parent context of the main application. The bootstrap context is responsible for loading configuration properties from the configuration server, as well as decrypting properties in external configuration files. Unlike the main application, which loads properties in the application, the bootstrap context loads properties in the bootstrap. Properties configured in bootstrap have higher priority, so they cannot be overridden by local configuration by default.

If you want to disable the bootstrap process, set spring.cloud.bootstrap.enabled=false.

Application scenarios of bootstrap configuration files:

When using the Spring Cloud Config configuration center, you need to add configuration properties connected to the configuration center in the bootstrap configuration file to load the configuration information of the external configuration center
Some fixed properties that cannot be overridden
Some encryption/decryption scenarios

The application configuration file is mainly used for automatic configuration of Spring Boot projects

OK, the context is over.

Spring Boot gets the file under java resources

June 15, 2022June 15, 2022asenview

Spring Boot gets the files under java resources Springboot gets the directories under the resources directory (for example: get the template directory under the resources directory):
method 1:

ResourceUtils.getFile("classpath:template");

1	ResourceUtils.getFile("classpath:template");

Method 2:

ClassPathResource resource = new ClassPathResource("template" + File.separator + "excelTemplate.xlsx");
// get the file stream
InputStream inputStream = resource.getInputStream();
// get the file
File file = resource.getFile();

ClassPathResource resource = new ClassPathResource("template" + File.separator + "excelTemplate.xlsx");

// get the file stream

InputStream inputStream = resource.getInputStream();

// get the file

File file = resource.getFile();

Latest 20 Spring Boot Interview Questions That I Often Ask Candidates

June 15, 2022June 15, 2022asenview

I interviewed some people who said on their resumes that they were familiar with Spring Boot, or that they were learning Spring Boot. When I asked them, they only stayed at the stage of simple use, and many things were not clear, which also made me disappointed with the interviewees.

Below, I will summarize some Spring Boot interview questions that I often ask candidates. I hope they will help you.

1. What is Spring Boot?

Spring Boot is a sub-project of Spring open source organization. It is a one-stop solution for Spring components. It mainly simplifies the difficulty of using Spring, saves heavy configuration, and provides various initiators for developers to get started quickly.

2. Why Spring Boot?

Spring Boot has many advantages, such as:

Independent operation

Simplify the configuration

Automatic configuration

No code generation and XML configuration

Application of monitoring

The easier

…

With all these advantages, why not use Spring Boot?

3. What are the core configuration files of Spring Boot? What’s the difference?

The core configuration files for Spring Boot are the Application and Bootstrap configuration files.

Application configuration file This is easy to understand and is mainly used for automatic configuration of Spring Boot projects.

The bootstrap configuration file can be used in the following scenarios.

When you use Spring Cloud Config to configure the configuration center, you need to add the configuration properties connected to the configuration center in the bootstrap configuration file to load the configuration information of the external configuration center.

Properties that are fixed and cannot be overridden;

Some encryption/decryption scenarios;

4. What are the formats of Spring Boot configuration files? What’s the difference?

.properties and.yml, the main difference between them is the writing format.

1).properties

    app.user.name = javastack

1	app.user.name = javastack

2).yml

  app:
   user:
     name:javastack

app:

user:

name:javastack

In addition, the. Yml format does not support @propertysource annotation import configuration.

5. What are the core annotations for Spring Boot? Which notes are it mainly composed of?

The annotation above the Boot class is @SpringBootApplication, which is the core annotation of SpringBoot. The main combination contains the following three annotations:

&lt;!-- wp:paragraph --&gt;
&lt;p&gt;@springBootConfiguration: The @Configuration annotation is combined to realize the function of the Configuration file.&lt;/p&gt;
&lt;!-- /wp:paragraph --&gt;

&lt;!-- wp:paragraph --&gt;
&lt;p&gt;@enableAutoConfiguration: Enable the automatic configuration function or disable an automatic configuration option, such as data source automatic configuration:&amp;nbsp;@ SpringBootApplication (exclude = {DataSourceAutoConfiguration. Class}).&lt;/p&gt;
&lt;!-- /wp:paragraph --&gt;

&lt;!-- wp:paragraph --&gt;
&lt;p&gt;@ComponentScan: Spring component scanning.&lt;/p&gt;
&lt;!-- /wp:paragraph --&gt;

@springBootConfiguration: The @Configuration annotation is combined to realize the function of the Configuration file.

@enableAutoConfiguration: Enable the automatic configuration function or disable an automatic configuration option, such as data source automatic configuration:&nbsp;@ SpringBootApplication (exclude = {DataSourceAutoConfiguration. Class}).

@ComponentScan: Spring component scanning.

6. What are the ways to enable Spring Boot?

1) Inherit the spring-boot-starter-parent project

2) Import the spring-boot-Dependencies dependencies project dependencies

7. Does Spring Boot need a separate container to run?

You don’t need it, Tomcat/ Jetty containers are built in.

8.What are the ways to run Spring Boot?

1) Package with command or put in a container to run

2) Run the Maven/ Gradle plugin

3) Run the main method directly

9.What is the principle of Spring Boot automatic configuration?

The @enableAutoConfiguration, @Configuration, and @conditionalonClass annotations are at the heart of the auto-configuration, which must first be a Configuration file and then be automatically configured based on whether the class is present in the classpath.

10.What is the directory structure of Spring Boot?


- javastack

- MyApplication. Java

- the customer

- Customer. Java

- CustomerController. Java

- the CustomerService. Java

- CustomerRepository. Java

- order

- Order. Java

- OrderController. Java

- the OrderService. Java

- OrderRepository. Java

- javastack

- MyApplication. Java

- the customer

- Customer. Java

- CustomerController. Java

- the CustomerService. Java

- CustomerRepository. Java

- order

- Order. Java

- OrderController. Java

- the OrderService. Java

- OrderRepository. Java

This directory structure is the prevailing and recommended practice, while the @SpringBootApplication annotation on the main entry class enables SpringBoot capabilities such as automatic configuration, component scanning, and so on.

11. How do you understand the Starters in Spring Boot?

“Starters” is a set of “Starters” that can be integrated into your app, giving you a one-stop way to integrate Spring and other technologies without having to dig around for sample code and dependencies. If you want to use Spring JPA to access a database, simply add the spring-boot-starter-data-jPA initiator dependency.

“Starters” includes a lot of the dependencies that you’ll need for projects that will run quickly and continuously, and are a set of supported, managed transitive dependencies.

How do I run some specific code when Spring Boot starts?

You can implement interfaces ApplicationRunner or CommandLineRunner, both of which are implemented in the same way, providing only a run method

13. What are the configuration reading methods available in Spring Boot?

Spring Boot can bind variables via @propertysource,@Value,@Environment, and @ConfigurationProperties

14. What logging frameworks does Spring Boot support? What are the recommended and default logging frameworks?

Spring Boot supports Java Util Logging, Log4j2, Lockback as the Logging framework, and if you use the Starters launcher, Spring Boot will use Logback as the default Logging framework.

15. What are the ways to implement hot deployment in SpringBoot?

There are two main ways:

Spring Loaded

Spring-boot-devtools

16, How do you understand the Spring Boot configuration load order?

In Spring Boot, you can load configurations in the following ways.

1) Properties file;

2) YAML files;

3) System environment variables;

4) Command line parameters;

And so on…

17, Spring Boot how to define multiple sets of different environment configuration?

Provides multiple sets of configuration files, such as:

applcation.properties

application-dev.properties

application-test.properties

application-prod.properties

The runtime specifies the specific configuration file

18. Is Spring Boot compatible with old Spring projects?

Compatible, using the @importResource annotation to import the old Spring project configuration file.

19. What are the methods to protect Spring Boot applications?

Use HTTPS in production

Check your dependencies using Snyk

Upgrade to the latest version

Enable CSRF protection

Use content security policies to prevent XSS attacks

…

20.What’s new with Spring Boot 2.X? What’s the difference from 1.x?

Configuration changes

JDK Version Upgrade

Upgrade the third-party class library

Responsive Spring programming support

Support HTTP / 2

Configuring property Binding

More improvements and enhancements…

Finally finished writing, I hope you study hard before going to the interview, otherwise the interviewer asked these questions, and can not answer it will be embarrassing. Understanding these issues will also help you understand Spring Boot.

These 20 interview questions are for season 1, and more Spring Boot/Cloud related interview questions will be compiled later.