手工实现HttpBasic校验

 

HttpBasic：

是RFC中定义的一种控制HTTP协议访问资源的方式。具体当HTTP请求受限资源时，就需要在请求头中添加以"Authorization"为key的header，value的具体形式是"Basic <credentials>", 其中<credentials>

是以“${username}:${password}"进行BASE64编码后的字符串。如果携带的这个请求头的信息和服务端保存

的用户名密码信息不匹配，就需要服务端必须返回401的状态码和WWW-Authenticate的返回头，其中值要形如

”Basic realm=testHttpBasic"其中”Basic realm"是固定死的

特性：

是最简单的控制访问方式，不需要cookies啊，session identifiers（session id)啊/login pages什么的。

各大浏览器都会以好RFC定义的约定规则实现对应的逻辑的。

 

实现：

SpringSecurity框架中就包含了HttpBasic的功能，但如果不想依赖这么重的玩意儿，可以自己写一个。

我是写了一个Filter，用于过滤请求，已通过Chrome浏览器验证Ok.

package org.zeng.test.test.web.httpbasic;

import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.IOException;
import java.util.Base64;

@WebFilter(servletNames = "authFilter", urlPatterns = "/basic/*")
public class AuthFilter implements Filter {

    private final String USERNAME = "admin";
    private final String PASSWORD = "123456";

    /**
     * 核心逻辑比较简单，就是：
     * 1.简单的字符串解析
     * 2.解码Base64
     * 3.验证用户名密码
     * 4.将用户标识放入session中
     *
     * @param servletRequest
     * @param servletResponse
     * @param filterChain
     * @throws IOException
     * @throws ServletException
     */
    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest)servletRequest;
        HttpSession session = request.getSession();

        if (session.getAttribute("user") == null) {
            String basicValue = request.getHeader("Authorization");

            //打印出了值形如 "Basic YW423222222lalalla"
            System.out.println("Authorization: " + basicValue);

            if (basicValue != null && basicValue.length() > 0) {
                String[] authorizationValue = basicValue.split(" ");
                if (authorizationValue.length == 2) {

                    //获取到解码后的值，形如 "admin:123456"
                    String base64Encoded = new String(Base64.getDecoder().decode(authorizationValue[1]));
                    if (authorizationValue != null && base64Encoded.length() > 0) {
                        String userAndPwdArray[] = base64Encoded.split(":");
                        if (userAndPwdArray.length != 2) {
                            checkFailed(servletResponse);
                        } else {
                            String user = userAndPwdArray[0];
                            String password = userAndPwdArray[1];
                            if (USERNAME.equals(user) && PASSWORD.equals(password)) {

                                //放入session中，下次登录无需再次提示登录框
                                session.setAttribute("user", USERNAME);

                                checkSuccess(servletRequest, servletResponse, filterChain);
                            } else {
                                checkFailed(servletResponse);
                            }
                        }
                    } else {
                        checkFailed(servletResponse);
                    }
                } else {
                    checkFailed(servletResponse);
                }
            } else {
                checkFailed(servletResponse);
            }
        } else {
            checkSuccess(servletRequest, servletResponse, filterChain);
        }
    }

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void destroy() {

    }

    /**
     * 校验成功
     * @param servletRequest
     * @param servletResponse
     * @param filterChain
     * @throws IOException
     * @throws ServletException
     */
    private void checkSuccess(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        filterChain.doFilter(servletRequest, servletResponse);
    }

    /**
     * 校验失败返回
     * @param servletResponse
     */
    private void checkFailed(ServletResponse servletResponse) {
        HttpServletResponse response = (HttpServletResponse) servletResponse;
        response.setStatus(401);
        response.setHeader("WWW-Authenticate", "Basic realm=anything you can write!");
    }
}